apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-11-03 04:12:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

bug 11973: Escape VM name to prevent from XSS attack. Reviewed-by: Alex huang

Browse Source
This commit is contained in:
Kelven Yang 2011-11-10 12:01:36 -08:00
parent a7ac3d577a
commit c3eba2933e
1 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
server/src/com/cloud/servlet/ConsoleProxyServlet.java
View File

@ -248,7 +248,7 @@ public class ConsoleProxyServlet extends HttpServlet {
}
StringBuffer sb = new StringBuffer();
sb.append("<html><title>").append(vmName).append("</title><frameset><frame src=\"").append(composeConsoleAccessUrl(rootUrl, vm, host));
sb.append("<html><title>").append(escapeHTML(vmName)).append("</title><frameset><frame src=\"").append(composeConsoleAccessUrl(rootUrl, vm, host));
sb.append("\"></frame></frameset></html>");
sendResponse(resp, sb.toString());
}
@ -554,4 +554,23 @@ public class ConsoleProxyServlet extends HttpServlet {
}
return false;
}
public static final String escapeHTML(String content){
if(content == null || content.isEmpty())
return content;
StringBuffer sb = new StringBuffer();
for (int i = 0; i < content.length(); i++) {
char c = content.charAt(i);
switch (c) {
case '<': sb.append("&lt;"); break;
case '>': sb.append("&gt;"); break;
case '&': sb.append("&amp;"); break;
case '"': sb.append("&quot;"); break;
case ' ': sb.append("&nbsp;");break;
default: sb.append(c); break;
}
}
return sb.toString();
}
}