tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 40901] New: - listings page does not escape XML characters
Date Mon, 06 Nov 2006 04:38:27 GMT
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG·
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40901>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND·
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=40901

           Summary: listings page does not escape XML characters
           Product: Tomcat 5
           Version: 5.5.17
          Platform: Other
        OS/Version: Solaris
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Unknown
        AssignedTo: tomcat-dev@jakarta.apache.org
        ReportedBy: dies@jp.fujitsu.com


On Solaris you can have a file or directory name called "<b>xxx" or "<i>yyy".
Using Tomcat's listings feature, you get a directory listing with the file name
in bold or italics.

I am not familiar with Javascript or cross-site scripting security problems, but
I believe Tomcat escapes XML characters like ">" and "<" to prevent client
browsers to interpret HTML codes that are not intended to be interpreted as such
for the default error page.
I think the same should be done for listings, or a warning should be added to
the documentation not to use it if you have no control over the file/directory
names you list.

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


Mime
View raw message