CVE-2011-0013

@@ -106,6 +106,9 @@
       <update>
         Improve documentation of database connection factory. (rjung)
       </update>
+      <fix>
+        Improve filtering of Manager display output. (kkolinko) 
+      </fix>
     </changelog>
   </subsection>
 </section>

@@ -370,15 +370,16 @@ public void list(HttpServletRequest request,
                 }
                 
                 args = new Object[6];
-                args[0] = displayPath;
-                args[1] = context.getDisplayName();
-                if (args[1] == null) {
+                args[0] = RequestUtil.filter(displayPath);
+                if (context.getDisplayName() == null) {
                     args[1] = " ";
+                } else {
+                    args[1] = RequestUtil.filter(context.getDisplayName());
                 }
                 args[2] = new Boolean(context.getAvailable());
-                args[3] = response.encodeURL
+                args[3] = RequestUtil.filter(response.encodeURL
                     (request.getContextPath() +
-                     "/html/sessions?path=" + displayPath);
+                     "/html/sessions?path=" + displayPath));
                 if (context.getManager() != null) {
                     args[4] = new Integer
                         (context.getManager().getActiveSessions());
@@ -392,21 +393,21 @@ public void list(HttpServletRequest request,
                     (MessageFormat.format(APPS_ROW_DETAILS_SECTION, args));
 
                 args = new Object[9];
-                args[0] = response.encodeURL
+                args[0] = RequestUtil.filter(response.encodeURL
                     (request.getContextPath() +
-                     "/html/start?path=" + displayPath);
+                     "/html/start?path=" + displayPath));
                 args[1] = appsStart;
-                args[2] = response.encodeURL
+                args[2] = RequestUtil.filter(response.encodeURL
                     (request.getContextPath() +
-                     "/html/stop?path=" + displayPath);
+                     "/html/stop?path=" + displayPath));
                 args[3] = appsStop;
-                args[4] = response.encodeURL
+                args[4] = RequestUtil.filter(response.encodeURL
                     (request.getContextPath() +
-                     "/html/reload?path=" + displayPath);
+                     "/html/reload?path=" + displayPath));
                 args[5] = appsReload;
-                args[6] = response.encodeURL
+                args[6] = RequestUtil.filter(response.encodeURL
                     (request.getContextPath() +
-                     "/html/undeploy?path=" + displayPath);
+                     "/html/undeploy?path=" + displayPath));
                 args[7] = appsUndeploy;
                 
                 args[8] = highlightColor;

@@ -581,7 +581,7 @@ public static void writeDetailedState(PrintWriter writer,
                 }
 
                 writer.print("<a href=\"#" + (count++) + ".0\">");
-                writer.print(webModuleName);
+                writer.print(filter(webModuleName));
                 writer.print("</a>");
                 if (iterator.hasNext()) {
                     writer.print("<br>");
@@ -656,7 +656,7 @@ protected static void writeContext(PrintWriter writer,
             }
 
             writer.print("<h1>");
-            writer.print(name);
+            writer.print(filter(name));
             writer.print("</h1>");
             writer.print("</a>");
 
@@ -784,11 +784,11 @@ public static void writeWrapper(PrintWriter writer, ObjectName objectName,
                 mBeanServer.invoke(objectName, "findMappings", null, null);
             
             writer.print("<h2>");
-            writer.print(servletName);
+            writer.print(filter(servletName));
             if ((mappings != null) && (mappings.length > 0)) {
                 writer.print(" [ ");
                 for (int i = 0; i < mappings.length; i++) {
-                    writer.print(mappings[i]);
+                    writer.print(filter(mappings[i]));
                     if (i < mappings.length - 1) {
                         writer.print(" , ");
                     }

@@ -523,19 +523,21 @@ protected void list(HttpServletRequest request,
                 }
                 
                 args = new Object[7];
-                args[0] = "<a href=\"" + URL_ENCODER.encode(displayPath) +
-                        "\">" + displayPath + "</a>";
-                args[1] = ctxt.getWebappVersion();
-                if ("".equals(args[1])) {
-                    args[1]= noVersion;
+                args[0] = "<a href=\"" + URL_ENCODER.encode(displayPath)
+                        + "\">" + RequestUtil.filter(displayPath) + "</a>";
+                if ("".equals(ctxt.getWebappVersion())) {
+                    args[1] = noVersion;
+                } else {
+                    args[1] = RequestUtil.filter(ctxt.getWebappVersion());
                 }
-                args[2] = ctxt.getDisplayName();
-                if (args[2] == null) {
+                if (ctxt.getDisplayName() == null) {
                     args[2] = "&nbsp;";
+                } else {
+                    args[2] = RequestUtil.filter(ctxt.getDisplayName());
                 }
                 args[3] = Boolean.valueOf(ctxt.getAvailable());
-                args[4] = response.encodeURL(request.getContextPath() +
-                     "/html/sessions?" + pathVersion);
+                args[4] = RequestUtil.filter(response.encodeURL(request.getContextPath() +
+                     "/html/sessions?" + pathVersion));
                 Manager manager = ctxt.getManager(); 
                 if (manager instanceof DistributedManager && showProxySessions) {
                     args[5] = Integer.valueOf(
@@ -552,20 +554,20 @@ protected void list(HttpServletRequest request,
                     (MessageFormat.format(APPS_ROW_DETAILS_SECTION, args));
 
                 args = new Object[14];
-                args[0] = response.encodeURL(request.getContextPath() +
-                        "/html/start?" + pathVersion);
+                args[0] = RequestUtil.filter(response.encodeURL(request
+                        .getContextPath() + "/html/start?" + pathVersion));
                 args[1] = appsStart;
-                args[2] = response.encodeURL(request.getContextPath() +
-                        "/html/stop?" + pathVersion);
+                args[2] = RequestUtil.filter(response.encodeURL(request
+                        .getContextPath() + "/html/stop?" + pathVersion));
                 args[3] = appsStop;
-                args[4] = response.encodeURL(request.getContextPath() +
-                     "/html/reload?" + pathVersion);
+                args[4] = RequestUtil.filter(response.encodeURL(request
+                        .getContextPath() + "/html/reload?" + pathVersion));
                 args[5] = appsReload;
-                args[6] = response.encodeURL(request.getContextPath() +
-                     "/html/undeploy?" + pathVersion);
+                args[6] = RequestUtil.filter(response.encodeURL(request
+                        .getContextPath() + "/html/undeploy?" + pathVersion));
                 args[7] = appsUndeploy;
-                args[8] = response.encodeURL(request.getContextPath() +
-                     "/html/expire?" + pathVersion);
+                args[8] = RequestUtil.filter(response.encodeURL(request
+                        .getContextPath() + "/html/expire?" + pathVersion));
                 args[9] = appsExpire;
                 args[10] = smClient.getString(
                         "htmlManagerServlet.expire.explain");

@@ -572,7 +572,7 @@ public static void writeDetailedState(PrintWriter writer,
                 }
 
                 writer.print("<a href=\"#" + (count++) + ".0\">");
-                writer.print(webModuleName);
+                writer.print(filter(webModuleName));
                 writer.print("</a>");
                 if (iterator.hasNext()) {
                     writer.print("<br>");
@@ -649,7 +649,7 @@ protected static void writeContext(PrintWriter writer,
             }
 
             writer.print("<h1>");
-            writer.print(name);
+            writer.print(filter(name));
             writer.print("</h1>");
             writer.print("</a>");
 
@@ -778,11 +778,11 @@ public static void writeWrapper(PrintWriter writer, ObjectName objectName,
                 mBeanServer.invoke(objectName, "findMappings", null, null);
             
             writer.print("<h2>");
-            writer.print(servletName);
+            writer.print(filter(servletName));
             if ((mappings != null) && (mappings.length > 0)) {
                 writer.print(" [ ");
                 for (int i = 0; i < mappings.length; i++) {
-                    writer.print(mappings[i]);
+                    writer.print(filter(mappings[i]));
                     if (i < mappings.length - 1) {
                         writer.print(" , ");
                     }

@@ -314,6 +314,9 @@
         <bug>50488</bug>: Update classpath required when using jsvc and add a
         note regarding server VMs. (markt)
       </fix>
+      <fix>
+        Further filtering of Manager and Host Manager display output. (kkolinko) 
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Other">