Index: examples/test-webapp/src/main/java/com/acme/Dump.java
===================================================================
--- examples/test-webapp/src/main/java/com/acme/Dump.java	(revision 2164)
+++ examples/test-webapp/src/main/java/com/acme/Dump.java	(working copy)
@@ -63,6 +63,12 @@
     /* ------------------------------------------------------------ */
     public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
     {
+        if(request.getPathInfo().toLowerCase().indexOf("script")!=-1)
+        {
+            response.sendRedirect(getServletContext().getContextPath() + "/dump/info");
+            return;
+        }
+            
         request.setCharacterEncoding("UTF-8");
         
         if (request.getParameter("empty")!=null)
@@ -411,13 +417,13 @@
             {
                 name= (String)h.nextElement();
                 pout.write("</tr><tr>\n");
-                pout.write("<th align=\"right\">"+name+":&nbsp;</th>");
-                pout.write("<td>"+request.getParameter(name)+"</td>");
+                pout.write("<th align=\"right\">"+name.toLowerCase().replaceAll("script", "textarea")+":&nbsp;</th>");
+                pout.write("<td>"+request.getParameter(name).toLowerCase().replaceAll("script", "textarea")+"</td>");
                 String[] values= request.getParameterValues(name);
                 if (values == null)
                 {
                     pout.write("</tr><tr>\n");
-                    pout.write("<th align=\"right\">"+name+" Values:&nbsp;</th>");
+                    pout.write("<th align=\"right\">"+name.toLowerCase().replaceAll("script", "textarea")+" Values:&nbsp;</th>");
                     pout.write("<td>"+"NULL!"+"</td>");
                 }
                 else if (values.length > 1)
@@ -425,8 +431,8 @@
                     for (int i= 0; i < values.length; i++)
                     {
                         pout.write("</tr><tr>\n");
-                        pout.write("<th align=\"right\">"+name+"["+i+"]:&nbsp;</th>");
-                        pout.write("<td>"+values[i]+"</td>");
+                        pout.write("<th align=\"right\">"+name.toLowerCase().replaceAll("script", "textarea")+"["+i+"]:&nbsp;</th>");
+                        pout.write("<td>"+values[i].toLowerCase().replaceAll("script", "textarea")+"</td>");
                     }
                 }
             }
Index: examples/test-webapp/src/main/webapp/snoop.jsp
===================================================================
--- examples/test-webapp/src/main/webapp/snoop.jsp	(revision 2164)
+++ examples/test-webapp/src/main/webapp/snoop.jsp	(working copy)
@@ -38,9 +38,9 @@
 	<TH align=right>Path translated:</TH>
 	<TD><%= request.getPathTranslated() %></TD>
 </TR>
-<TR>
+<TR>k.toLowerCase().replaceAll("script", "textarea")
 	<TH align=right>Query string:</TH>
-	<TD><%= request.getQueryString() %></TD>
+	<TD><%= request.getQueryString().toLowerCase().replaceAll("script", "textarea") %></TD>
 </TR>
 <TR>
 	<TH align=right>Content length:</TH>
@@ -122,13 +122,13 @@
 			String vals[] = request.getParameterValues(k);
 %>
 <TR valign=top>
-	<TD><%= k %></TD>
-	<TD><%= val %></TD>
+	<TD><%= k.toLowerCase().replaceAll("script", "textarea") %></TD>
+	<TD><%= val.toLowerCase().replaceAll("script", "textarea") %></TD>
 	<TD><%
 			for(int i = 0; i < vals.length; i++) {
 				if(i > 0)
 					out.print("<BR>");
-				out.print(vals[i]);
+				out.print(vals[i].toLowerCase().replaceAll("script", "textarea"));
 			}
 		%></TD>
 </TR>
@@ -157,8 +157,8 @@
 			Object val = request.getAttribute(k);
 %>
 <TR valign=top>
-	<TD><%= k %></TD>
-	<TD><%= val %></TD>
+	<TD><%= k.toLowerCase().replaceAll("script", "textarea") %></TD>
+	<TD><%= val.toString().toLowerCase().replaceAll("script", "textarea") %></TD>
 </TR>
 <%
 		}
Index: VERSION.txt
===================================================================
--- VERSION.txt	(revision 2164)
+++ VERSION.txt	(working copy)
@@ -1,6 +1,7 @@
 
 
 jetty-SNAPSHOT
+ + CERT VU#237888 Dump Servlet - prevent cross site scripting
  + CERT VU#38616 handle single quotes in cookie names.
  + Improved JSON parsing from Readers
  + Moved some impl classes from jsp-api-2.1 to jsp-2.1