From 9831ecf543009ac8937716752d5da9f56ed15e0e Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Tue, 20 Mar 2012 09:10:37 +0000
Subject: [PATCH] Adds better way to handle JavaScript injection into request
 parameters

git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@1302803 13f79535-47bb-0310-9956-ffa450edef68
---
 .../apache/struts2/views/util/UrlHelper.java  |  5 ++--
 .../struts2/views/util/UrlHelperTest.java     | 29 +++++++++++++------
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/core/src/main/java/org/apache/struts2/views/util/UrlHelper.java b/core/src/main/java/org/apache/struts2/views/util/UrlHelper.java
index 751efeb67..f294a4b65 100644
--- a/core/src/main/java/org/apache/struts2/views/util/UrlHelper.java
+++ b/core/src/main/java/org/apache/struts2/views/util/UrlHelper.java
@@ -27,6 +27,7 @@ import com.opensymphony.xwork2.util.TextParseUtil;
 import com.opensymphony.xwork2.util.ValueStack;
 import com.opensymphony.xwork2.util.logging.Logger;
 import com.opensymphony.xwork2.util.logging.LoggerFactory;
+import org.apache.commons.lang3.StringEscapeUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.struts2.ServletActionContext;
 import org.apache.struts2.StrutsConstants;
@@ -176,8 +177,8 @@ public class UrlHelper {
 
         String result = link.toString();
 
-        while (result.indexOf("<script>") > 0){
-        	result = result.replaceAll("<script>", "script");
+        if (StringUtils.containsIgnoreCase(result, "<script")){
+            result = StringEscapeUtils.escapeEcmaScript(result);
         }
         try {
             result = encodeResult ? response.encodeURL(result) : result;
diff --git a/core/src/test/java/org/apache/struts2/views/util/UrlHelperTest.java b/core/src/test/java/org/apache/struts2/views/util/UrlHelperTest.java
index 5897237d2..ca32a6f4a 100644
--- a/core/src/test/java/org/apache/struts2/views/util/UrlHelperTest.java
+++ b/core/src/test/java/org/apache/struts2/views/util/UrlHelperTest.java
@@ -21,26 +21,21 @@
 
 package org.apache.struts2.views.util;
 
-import com.mockobjects.dynamic.C;
 import com.mockobjects.dynamic.Mock;
 import com.opensymphony.xwork2.ActionContext;
-import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
 import com.opensymphony.xwork2.inject.Container;
 import com.opensymphony.xwork2.inject.Scope.Strategy;
-import com.opensymphony.xwork2.util.ValueStack;
+import org.apache.struts2.StrutsConstants;
+import org.apache.struts2.StrutsTestCase;
 
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.Map;
 import java.util.Set;
 import java.util.TreeMap;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.apache.struts2.StrutsConstants;
-import org.apache.struts2.StrutsTestCase;
-
 
 /**
  * Test case for UrlHelper.
@@ -116,6 +111,22 @@ public class UrlHelperTest extends StrutsTestCase {
            expectedUrl, url.toString());
     }
 
+    public void testBuildParametersStringWithJavaScriptInjected() throws Exception {
+        String expectedUrl = "http://localhost:8080/myContext/myPage.jsp?initParam=initValue&amp;param1=value1&amp;param2=value2&amp;param3%22%3Cscript+type%3D%22text%2Fjavascript%22%3Ealert%281%29%3B%3C%2Fscript%3E=value3";
+
+        Map parameters = new LinkedHashMap();
+        parameters.put("param1", "value1");
+        parameters.put("param2", "value2");
+        parameters.put("param3\"<script type=\"text/javascript\">alert(1);</script>","value3");
+
+        StringBuilder url = new StringBuilder("http://localhost:8080/myContext/myPage.jsp?initParam=initValue");
+
+        UrlHelper.buildParametersString(parameters, url);
+
+        assertEquals(
+           expectedUrl, url.toString());
+    }
+
     public void testForceAddNullSchemeHostAndPort() throws Exception {
         String expectedUrl = "http://localhost/contextPath/path1/path2/myAction.action";