tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Mark Thomas <ma...@apache.org>
Subject [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6
Date Mon, 03 Jan 2005 17:04:48 GMT
Patches to fix the minor XSS issues in the examples are below.

I would be grateful if someone with jakarta-servletapi-5 karama could 
commit these.

Cheers,

Mark


Index: jsr152/examples/jsp2/el/functions.jsp
===================================================================
RCS file: 
/home/cvs/jakarta-servletapi-5/jsr152/examples/jsp2/el/functions.jsp,v
retrieving revision 1.4
diff -u -r1.4 functions.jsp
--- jsr152/examples/jsp2/el/functions.jsp	18 Mar 2004 16:40:30 -0000
1.4
+++ jsr152/examples/jsp2/el/functions.jsp	20 Nov 2004 19:02:44 -0000
@@ -13,6 +13,7 @@
    See the License for the specific language governing permissions and
    limitations under the License.
  -->
+<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
  <%@ taglib prefix="my"
uri="http://jakarta.apache.org/tomcat/jsp2-example-taglib"%>

  <html>
@@ -30,7 +31,7 @@
      <blockquote>
        <u><b>Change Parameter</b></u>
        <form action="functions.jsp" method="GET">
-	  foo = <input type="text" name="foo" value="${param['foo']}">
+	  foo = <input type="text" name="foo"
value="${fn:escapeXml(param["foo"])}">
            <input type="submit">
        </form>
        <br>
@@ -42,19 +43,19 @@
  	  </thead>
  	  <tr>
  	    <td>\${param["foo"]}</td>
-	    <td>${param["foo"]}&nbsp;</td>
+	    <td>${fn:escapeXml(param["foo"])}&nbsp;</td>
  	  </tr>
  	  <tr>
  	    <td>\${my:reverse(param["foo"])}</td>
-	    <td>${my:reverse(param["foo"])}&nbsp;</td>
+	    <td>${my:reverse(fn:escapeXml(param["foo"]))}&nbsp;</td>
  	  </tr>
  	  <tr>
  	    <td>\${my:reverse(my:reverse(param["foo"]))}</td>
-	    <td>${my:reverse(my:reverse(param["foo"]))}&nbsp;</td>
+	    <td>${my:reverse(my:reverse(fn:escapeXml(param["foo"])))}&nbsp;</td>
  	  </tr>
  	  <tr>
  	    <td>\${my:countVowels(param["foo"])}</td>
-	    <td>${my:countVowels(param["foo"])}&nbsp;</td>
+	    <td>${my:countVowels(fn:escapeXml(param["foo"]))}&nbsp;</td>
  	  </tr>
  	</table>
        </code>
Index: jsr152/examples/jsp2/el/implicit-objects.jsp
===================================================================
RCS file:
/home/cvs/jakarta-servletapi-5/jsr152/examples/jsp2/el/implicit-objects.jsp,v
retrieving revision 1.3
diff -u -r1.3 implicit-objects.jsp
--- jsr152/examples/jsp2/el/implicit-objects.jsp	18 Mar 2004 16:40:30
-0000	1.3
+++ jsr152/examples/jsp2/el/implicit-objects.jsp	20 Nov 2004 19:04:06
-0000
@@ -13,6 +13,8 @@
    See the License for the specific language governing permissions and
    limitations under the License.
  -->
+<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
+
  <html>
    <head>
      <title>JSP 2.0 Expression Language - Implicit Objects</title>
@@ -49,7 +51,7 @@
      <blockquote>
        <u><b>Change Parameter</b></u>
        <form action="implicit-objects.jsp" method="GET">
-	  foo = <input type="text" name="foo" value="${param["foo"]}">
+	  foo = <input type="text" name="foo"
value="${fn:escapeXml(param["foo"])}">
            <input type="submit">
        </form>
        <br>
@@ -61,11 +63,11 @@
  	  </thead>
  	  <tr>
  	    <td>\${param.foo}</td>
-	    <td>${param.foo}&nbsp;</td>
+	    <td>${fn:escapeXml(param["foo"])}&nbsp;</td>
  	  </tr>
  	  <tr>
  	    <td>\${param["foo"]}</td>
-	    <td>${param["foo"]}&nbsp;</td>
+	    <td>${fn:escapeXml(param["foo"])}&nbsp;</td>
  	  </tr>
  	  <tr>
  	    <td>\${header["host"]}</td>
Index: jsr152/examples/jsp2/jspx/textRotate.jspx
===================================================================
RCS file:
/home/cvs/jakarta-servletapi-5/jsr152/examples/jsp2/jspx/textRotate.jspx,v
retrieving revision 1.3
diff -u -r1.3 textRotate.jspx
--- jsr152/examples/jsp2/jspx/textRotate.jspx	21 Nov 2003 22:06:02 -0000
1.3
+++ jsr152/examples/jsp2/jspx/textRotate.jspx	20 Nov 2004 19:54:10 -0000
@@ -6,11 +6,12 @@
  <svg xmlns="http://www.w3.org/2000/svg"
       width="450" height="500" viewBox="0 0 450 500"
       xmlns:c="http://java.sun.com/jsp/jstl/core"
+     xmlns:fn="http://java.sun.com/jsp/jstl/functions"
       xmlns:jsp="http://java.sun.com/JSP/Page">
    <jsp:directive.page contentType="image/svg+xml" />
    <title>JSP 2.0 JSPX</title>
    <!-- select name parameter, or default to JSPX -->
-  <c:set var="name" value='${empty param["name"] ? "JSPX" : 
param["name"]}'/>
+  <c:set var="name" value='${empty fn:escapeXml(param["name"]) ? "JSPX" :
fn:escapeXml(param["name"])}'/>
    <g id="testContent">
      <text class="title" x="50%" y="10%" font-size="15" 
text-anchor="middle" >
              JSP 2.0 XML Syntax (.jspx) Demo</text>

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org


Mime
View raw message