lucene-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From dna...@apache.org
Subject cvs commit: jakarta-lucene/src/jsp results.jsp
Date Sat, 16 Oct 2004 16:21:58 GMT
dnaber      2004/10/16 09:21:58

  Modified:    src/jsp  results.jsp
  Log:
  security: the error message was not escaped, this could enable cross site scripting
  
  Revision  Changes    Path
  1.4       +12 -2     jakarta-lucene/src/jsp/results.jsp
  
  Index: results.jsp
  ===================================================================
  RCS file: /home/cvs/jakarta-lucene/src/jsp/results.jsp,v
  retrieving revision 1.3
  retrieving revision 1.4
  diff -u -r1.3 -r1.4
  --- results.jsp	12 Oct 2004 22:14:26 -0000	1.3
  +++ results.jsp	16 Oct 2004 16:21:58 -0000	1.4
  @@ -15,6 +15,16 @@
   
   */
   %>
  +<%!
  +public String escapeHTML(String s) {
  +  s = s.replaceAll("&", "&amp;");
  +  s = s.replaceAll("<", "&lt;");
  +  s = s.replaceAll(">", "&gt;");
  +  s = s.replaceAll("\"", "&quot;");
  +  s = s.replaceAll("'", "&apos;");
  +  return s;
  +}
  +%>
   <%@include file="header.jsp"%>
   <%
           boolean error = false;                  //used to control flow for error messages
  @@ -40,7 +50,7 @@
                                                           //or otherwise corrupt index
   %>
                   <p>ERROR opening the Index - contact sysadmin!</p>
  -                <p>While parsing query: <%=e.getMessage()%></p>   
  +                <p>Error message: <%=escapeHTML(e.getMessage())%></p>
  
   <%                error = true;                                  //don't do anything
up to the footer
           }
   %>
  @@ -72,7 +82,7 @@
                                                                         //send them a nice
error HTML
                                                                         
   %>
  -                        <p>Error while parsing query: <%=e.getMessage()%></p>
  +                        <p>Error while parsing query: <%=escapeHTML(e.getMessage())%></p>
   <%
                           error = true;                                 //don't bother with
the rest of
                                                                         //the page
  
  
  

---------------------------------------------------------------------
To unsubscribe, e-mail: lucene-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: lucene-dev-help@jakarta.apache.org


Mime
View raw message