Attachment 159067 Details for Bug 247994 – proposed patch

[patch] proposed patch

cve-2007-3386.txt (text/plain), 1.06 KB, created by Mark J. Cox on 2007-07-12 15:50:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mark J. Cox

Created: 2007-07-12 15:50:20 UTC

Size: 1.06 KB

patch

obsolete

>Index: java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java
>===================================================================
>--- java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java	(revision 553200)
>+++ java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java	(working copy)
>@@ -253,7 +253,7 @@
> 
>             if (host != null ) {
>                 args = new Object[2];
>-                args[0] = hostName;
>+                args[0] = RequestUtil.filter(hostName);
>                 String[] aliases = host.findAliases();
>                 StringBuffer buf = new StringBuffer();
>                 if (aliases.length > 0) {
>@@ -265,9 +265,11 @@
> 
>                 if (buf.length() == 0) {
>                     buf.append("&nbsp;");
>+                    args[1] = buf.toString();
>+                } else {
>+                    args[1] = RequestUtil.filter(buf.toString());
>                 }
> 
>-                args[1] = buf.toString();
>                 writer.print
>                     (MessageFormat.format(HOSTS_ROW_DETAILS_SECTION, args));
> 
>

Actions: View | Diff

Attachments on bug 247994: 159067