modules/enterprise/gui/portal-war/src/main/webapp/common/Error.jsp | 8
+++++---
modules/enterprise/gui/portal-war/src/main/webapp/common/GenericError.jsp | 6 ++++--
2 files changed, 9 insertions(+), 5 deletions(-)
New commits:
commit fafae32f2077a6f0836ba92d440ab4c4cd143765
Author: Lukas Krejci <lkrejci(a)redhat.com>
Date: Thu Dec 23 12:56:34 2010 +0100
BZ 665215 - xml-escaping the stacktraces to protect against XSS via malicious code
inserted into the exception messages.
diff --git a/modules/enterprise/gui/portal-war/src/main/webapp/common/Error.jsp
b/modules/enterprise/gui/portal-war/src/main/webapp/common/Error.jsp
index 915510d..ad0bb72 100644
--- a/modules/enterprise/gui/portal-war/src/main/webapp/common/Error.jsp
+++ b/modules/enterprise/gui/portal-war/src/main/webapp/common/Error.jsp
@@ -62,10 +62,12 @@ int randomNum=(int)(Math.random()*1000);
</c:if>
<c:catch>
- <c:if test="${not empty exception}">
- <div id="exception<%= randomNum %>"
style="visibility:hidden"><%=StringUtil.getStackTrace(exception)%></div>
+ <c:if test="${not empty exception}">
+ <c:set
var="stacktrace"><%=StringUtil.getStackTrace(exception)%></c:set>
+ <div id="exception<%= randomNum %>"
style="visibility:hidden"><c:out value="${stacktrace}"
/></div>
<c:if test="${not empty root}">
- <div id="root<%= randomNum %>"
style="visibility:hidden"><%=StringUtil.getStackTrace(root)%></div>
+ <c:set
var="rootStacktrace"><%=StringUtil.getStackTrace(root)%></c:set>
+ <div id="root<%= randomNum %>"
style="visibility:hidden"><c:out value="${rootStacktrace}"
/></div>
</c:if>
</c:if>
</c:catch>
diff --git a/modules/enterprise/gui/portal-war/src/main/webapp/common/GenericError.jsp
b/modules/enterprise/gui/portal-war/src/main/webapp/common/GenericError.jsp
index c35fa67..1c3e8be 100644
--- a/modules/enterprise/gui/portal-war/src/main/webapp/common/GenericError.jsp
+++ b/modules/enterprise/gui/portal-war/src/main/webapp/common/GenericError.jsp
@@ -120,8 +120,10 @@ if (exception != null) {
while (exception != null) {
%>
- <div id="exceptionMessage<%=i%>"
style="visibility:hidden"><%=exception.getLocalizedMessage()%></div>
- <div id="exception<%=i++%>"
style="visibility:hidden"><%=StringUtil.getFirstStackTrace(exception)%></div>
+ <c:set
var="message"><%=exception.getLocalizedMessage()%></c:set>
+ <c:set
var="stacktrace"><%=StringUtil.getFirstStackTrace(exception)%></c:set>
+ <div id="exceptionMessage<%=i%>"
style="visibility:hidden"><c:out value="${message}"
/></div>
+ <div id="exception<%=i++%>"
style="visibility:hidden"><c:out value="${stacktrace}"
/></div>
<%
exception = exception.getCause();
}
Show replies by date