etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

bug 11973: Escape VM name to prevent from XSS attack. Reviewed-by: Alex huang

This commit is contained in:
Kelven Yang 2011-11-10 12:01:36 -08:00
parent f9bea27d0b
commit 84e50db0ee
1 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
server/src/com/cloud/servlet/ConsoleProxyServlet.java
View File

@ -243,7 +243,7 @@ public class ConsoleProxyServlet extends HttpServlet {
}
StringBuffer sb = new StringBuffer();
sb.append("<html><title>").append(vmName).append("</title><frameset><frame src=\"").append(composeConsoleAccessUrl(rootUrl, vm, host));
sb.append("<html><title>").append(escapeHTML(vmName)).append("</title><frameset><frame src=\"").append(composeConsoleAccessUrl(rootUrl, vm, host));
sb.append("\"></frame></frameset></html>");
sendResponse(resp, sb.toString());
}
@ -547,4 +547,23 @@ public class ConsoleProxyServlet extends HttpServlet {
}
return false;
}
public static final String escapeHTML(String content){
if(content == null || content.isEmpty())
return content;
StringBuffer sb = new StringBuffer();
for (int i = 0; i < content.length(); i++) {
char c = content.charAt(i);
switch (c) {
case '<': sb.append("&lt;"); break;
case '>': sb.append("&gt;"); break;
case '&': sb.append("&amp;"); break;
case '"': sb.append("&quot;"); break;
case ' ': sb.append("&nbsp;");break;
default: sb.append(c); break;
}
}
return sb.toString();
}
}