From accf8301ad22fefb0ad7a70c29d0bfb51931c936 Mon Sep 17 00:00:00 2001 From: Zlatin Balevsky Date: Tue, 6 Jul 2021 20:37:23 +0100 Subject: [PATCH 1/2] escape occurrences of short id --- webui/src/main/webapp/AboutMe.jsp | 3 ++- webui/src/main/webapp/BrowseHost.jsp | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/webui/src/main/webapp/AboutMe.jsp b/webui/src/main/webapp/AboutMe.jsp index eb42c026..72198cda 100644 --- a/webui/src/main/webapp/AboutMe.jsp +++ b/webui/src/main/webapp/AboutMe.jsp @@ -13,6 +13,7 @@ String pagetitle=Util._t("About Me"); String helptext = Util._t("This page shows information about your MuWire identity."); Core core = (Core) application.getAttribute("core"); +String shortId = Util.escapeHTMLinXML(core.getMe().getHumanReadableName()); %> @@ -36,7 +37,7 @@ openAccordion = 3;

<%=Util._t("MuWire ID")%>

-

<%=Util._t("Your short MuWire ID: {0}", core.getMe().getHumanReadableName())%>

+

<%=Util._t("Your short MuWire ID: {0}", shortId)%>

<%=Util._t("Your full MuWire ID:")%>

<%=Util._t("Copy to clipboard")%>

diff --git a/webui/src/main/webapp/BrowseHost.jsp b/webui/src/main/webapp/BrowseHost.jsp index 3cab9b13..ea367dfe 100644 --- a/webui/src/main/webapp/BrowseHost.jsp +++ b/webui/src/main/webapp/BrowseHost.jsp @@ -14,7 +14,7 @@ String helptext = Util._t("Use this page to browse the files shared by other MuW String currentBrowse = null; if (request.getParameter("currentHost") != null) { Persona host = new Persona(new ByteArrayInputStream(Base64.decode(request.getParameter("currentHost")))); - currentBrowse = host.getHumanReadableName(); + currentBrowse = Util.escapeHTMLinXML(host.getHumanReadableName()); } %> From a73a7a4ad3777c4e46a44aac6244b3ba9c9ddce4 Mon Sep 17 00:00:00 2001 From: Zlatin Balevsky Date: Tue, 6 Jul 2021 20:37:58 +0100 Subject: [PATCH 2/2] sanitize input in /FileDetails page. Thanks to Beardog for the report --- webui/src/main/webapp/FileDetails.jsp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/webui/src/main/webapp/FileDetails.jsp b/webui/src/main/webapp/FileDetails.jsp index c1ee5c9f..0f7f3ce7 100644 --- a/webui/src/main/webapp/FileDetails.jsp +++ b/webui/src/main/webapp/FileDetails.jsp @@ -11,7 +11,7 @@ String helptext = Util._t("View details about the selected shared file here."); String path = request.getParameter("path"); File file = Util.getFromPathElements(path); - +String filePath = Util.escapeHTMLinXML(file.getAbsolutePath()); %> @@ -31,7 +31,7 @@ File file = Util.getFromPathElements(path); <%@include file="sidebar.jsi"%>
-

<%=Util._t("Details for {0}", file.getAbsolutePath())%>

+

<%=Util._t("Details for {0}", filePath)%>

<%=Util._t("Search Hits")%>