URIUtil.encodePath() allows some characters to break the URI string

Some characters present in bad paths (typically seen from XSS attacks) can break the URI encoding of paths.

Need to add support for invalid path/filename characters, just to prevent the URI from becoming invalid.

is depended upon by

JETTY-980 Security / Directory Listing XSS present

Hide

Permalink

Joakim Erdfelt added a comment - 20/Apr/09 10:21 PM

Adding support for '"', '\'', '<', '>' characters in URIUtil.encodePath()

Show

Joakim Erdfelt added a comment - 20/Apr/09 10:21 PM Adding support for '"', '\'', '<', '>' characters in URIUtil.encodePath()

Vote (0)

Watch (0)