Skip to content

Commit fed39c3

Browse files
dejanbdejanb
committed
https://issues.apache.org/activemq/browse/AMQ-2613 - fix XSS security problem in web console
git-svn-id: https://svn.apache.org/repos/asf/activemq/trunk@915269 13f79535-47bb-0310-9956-ffa450edef68
1 parent d71eefc commit fed39c3

File tree

9 files changed

+32
-26
lines changed

9 files changed

+32
-26
lines changed

‎activemq-web-console/src/main/webapp/WEB-INF/tags/form/short.tag‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717
<%@ attribute name="text" type="java.lang.String" required="true" %>
1818
<%@ attribute name="length" type="java.lang.Integer" required="false" %>
1919
<%
20+
text = org.apache.commons.lang.StringEscapeUtils.escapeHtml(text);
21+
text = org.apache.commons.lang.StringEscapeUtils.escapeJavaScript(text);
2022
if (length == null)
2123
length = 20;
2224
if (text.length() <= 20) {

‎activemq-web-console/src/main/webapp/WEB-INF/tags/form/text.tag‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,12 @@
1919
<%
2020
String value = request.getParameter(name);
2121
if (value == null || value.trim().length() == 0) {
22-
value = defaultValue;
23-
}
24-
if (value == null) {
25-
value = "";
26-
}
22+
value = defaultValue;
23+
}
24+
if (value == null) {
25+
value = "";
26+
}
27+
value = org.apache.commons.lang.StringEscapeUtils.escapeHtml(value);
28+
2729
%>
2830
<input type="text" name="${name}" value="<%= value %>"/>

‎activemq-web-console/src/main/webapp/browse.jsp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
<tbody>
4040
<jms:forEachMessage queueBrowser="${requestContext.queueBrowser.browser}" var="row">
4141
<tr>
42-
<td><a href="message.jsp?id=${row.JMSMessageID}&JMSDestination=${requestContext.queueBrowser.JMSDestination}"
42+
<td><a href="message.jsp?id=${row.JMSMessageID}&JMSDestination=<c:out value="${requestContext.queueBrowser.JMSDestination}" />"
4343
title="${row.properties}">${row.JMSMessageID}</a></td>
4444
<td>${row.JMSCorrelationID}</td>
4545
<td><jms:persistent message="${row}"/></td>
@@ -49,15 +49,15 @@
4949
<td><jms:formatTimestamp timestamp="${row.JMSTimestamp}"/></td>
5050
<td>${row.JMSType}</td>
5151
<td>
52-
<a href="deleteMessage.action?JMSDestination=${row.JMSDestination}&messageId=${row.JMSMessageID}">Delete</a>
52+
<a href="deleteMessage.action?JMSDestination=<c:out value="${row.JMSDestination}"/>&messageId=${row.JMSMessageID}">Delete</a>
5353
</td>
5454
</tr>
5555
</jms:forEachMessage>
5656
</tbody>
5757
</table>
5858

5959
<div>
60-
<a href="queueConsumers.jsp?JMSDestination=${requestContext.queueBrowser.JMSDestination}">View Consumers</a>
60+
<a href="queueConsumers.jsp?JMSDestination=<c:out value="${requestContext.queueBrowser.JMSDestination}"/>">View Consumers</a>
6161
</div>
6262
</body>
6363
</html>

‎activemq-web-console/src/main/webapp/message.jsp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -130,24 +130,24 @@ No message could be found for ID ${requestContext.messageQuery.id}
130130
</thead>
131131
<tbody>
132132
<tr>
133-
<td colspan="2"><a href="deleteMessage.action?JMSDestination=${row.JMSDestination}&messageId=${row.JMSMessageID}">Delete</a></td>
133+
<td colspan="2"><a href="deleteMessage.action?JMSDestination=<c:out value="${row.JMSDestination}" />&messageId=${row.JMSMessageID}">Delete</a></td>
134134
</tr>
135135
<tr class="odd">
136-
<td><a href="javascript:confirmAction('queue', 'copyMessage.action?destination=%target%&JMSDestination=${row.JMSDestination}&messageId=${row.JMSMessageID}&JMSDestinationType=queue')">Copy</a></td>
136+
<td><a href="javascript:confirmAction('queue', 'copyMessage.action?destination=%target%&JMSDestination=<c:out value="${row.JMSDestination}" />&messageId=${row.JMSMessageID}&JMSDestinationType=queue')">Copy</a></td>
137137
<td rowspan="2">
138138
<select id="queue">
139139
<option value=""> -- Please select --</option>
140140
<c:forEach items="${requestContext.brokerQuery.queues}" var="queues">
141141
<c:if test="${queues.name != requestContext.messageQuery.JMSDestination}">
142-
<option value="${queues.name}"><form:short text="${queues.name}"/></option>
142+
<option value="<c:out value="${queues.name}" />"><form:short text="${queues.name}"/></option>
143143
</c:if>
144144
</c:forEach>
145145
</select>
146146
</td>
147147

148148
</tr>
149149
<tr class="odd">
150-
<td><a href="javascript:confirmAction('queue', 'moveMessage.action?destination=%target%&JMSDestination=${row.JMSDestination}&messageId=${row.JMSMessageID}&JMSDestinationType=queue')">Move</a></td>
150+
<td><a href="javascript:confirmAction('queue', 'moveMessage.action?destination=%target%&JMSDestination=<c:out value="${row.JMSDestination}" />&messageId=${row.JMSMessageID}&JMSDestinationType=queue')">Move</a></td>
151151
</tr>
152152
</tbody>
153153
</table>

‎activemq-web-console/src/main/webapp/queueConsumers.jsp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@
1616
--%>
1717
<html>
1818
<head>
19-
<title>Consumers for ${requestContext.queueConsumerQuery.JMSDestination}</title>
19+
<title>Consumers for <c:out value="${requestContext.queueConsumerQuery.JMSDestination}" /></title>
2020
</head>
2121
<body>
2222

23-
<h2>Active Consumers for ${requestContext.queueConsumerQuery.JMSDestination}</h2>
23+
<h2>Active Consumers for <c:out value="${requestContext.queueConsumerQuery.JMSDestination}" /></h2>
2424

2525
<table id="messages" class="sortable autostripe">
2626
<thead>

‎activemq-web-console/src/main/webapp/queues.jsp‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -48,22 +48,23 @@
4848
</thead>
4949
<tbody>
5050
<c:forEach items="${requestContext.brokerQuery.queues}" var="row">
51+
5152
<tr>
52-
<td><a href="browse.jsp?JMSDestination=${row.name}"><form:tooltip text="${row.name}" length="50"/></a></td>
53+
<td><a href="browse.jsp?JMSDestination=<c:out value="${row.name}" />"><form:tooltip text="${row.name}" length="50"/></a></td>
5354
<td>${row.queueSize}</td>
5455
<td>${row.consumerCount}</td>
5556
<td>${row.enqueueCount}</td>
5657
<td>${row.dequeueCount}</td>
5758
<td>
58-
<a href="browse.jsp?JMSDestination=${row.name}">Browse</a>
59-
<a href="queueConsumers.jsp?JMSDestination=${row.name}">Active Consumers</a><br/>
60-
<a href="queueBrowse/${row.name}?view=rss&feedType=atom_1.0" title="Atom 1.0"><img src="images/feed_atom.png"/></a>
61-
<a href="queueBrowse/${row.name}?view=rss&feedType=rss_2.0" title="RSS 2.0"><img src="images/feed_rss.png"/></a>
59+
<a href="browse.jsp?JMSDestination=<c:out value="${row.name}" />">Browse</a>
60+
<a href="queueConsumers.jsp?JMSDestination=<c:out value="${row.name}" />">Active Consumers</a><br/>
61+
<a href="queueBrowse/<c:out value="${row.name}" />?view=rss&feedType=atom_1.0" title="Atom 1.0"><img src="images/feed_atom.png"/></a>
62+
<a href="queueBrowse/<c:out value="${row.name}" />?view=rss&feedType=rss_2.0" title="RSS 2.0"><img src="images/feed_rss.png"/></a>
6263
</td>
6364
<td>
64-
<a href="send.jsp?JMSDestination=${row.name}&JMSDestinationType=queue">Send To</a>
65-
<a href="purgeDestination.action?JMSDestination=${row.name}&JMSDestinationType=queue">Purge</a>
66-
<a href="deleteDestination.action?JMSDestination=${row.name}&JMSDestinationType=queue">Delete</a>
65+
<a href="send.jsp?JMSDestination=<c:out value="${row.name}" />&JMSDestinationType=queue">Send To</a>
66+
<a href="purgeDestination.action?JMSDestination=<c:out value="${row.name}" />&JMSDestinationType=queue">Purge</a>
67+
<a href="deleteDestination.action?JMSDestination=<c:out value="${row.name}" />&JMSDestinationType=queue">Delete</a>
6768
</td>
6869
</tr>
6970
</c:forEach>

‎activemq-web-console/src/main/webapp/send.jsp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
<label for="JMSDestination">Destination</label>
3838
</td>
3939
<td>
40-
<form:text name="JMSDestination" defaultValue="foo.bar"/>
40+
<form:text name="JMSDestination" defaultValue="foo.bar" />
4141
</td>
4242
<td class="label">
4343
<label for="queue">Queue or Topic</label>

‎activemq-web-console/src/main/webapp/topics.jsp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,13 @@
4646
<tbody>
4747
<c:forEach items="${requestContext.brokerQuery.topics}" var="row">
4848
<tr>
49-
<td><a href="send.jsp?JMSDestination=${row.name}&JMSDestinationType=topic"><form:tooltip text="${row.name}" length="50"/></a></td>
49+
<td><a href="send.jsp?JMSDestination=<c:out value="${row.name}" />&JMSDestinationType=topic"><form:tooltip text="${row.name}" length="50"/></a></td>
5050
<td>${row.consumerCount}</td>
5151
<td>${row.enqueueCount}</td>
5252
<td>${row.dequeueCount}</td>
5353
<td>
54-
<a href="send.jsp?JMSDestination=${row.name}&JMSDestinationType=topic">Send To</a>
55-
<a href="deleteDestination.action?JMSDestination=${row.name}&JMSDestinationType=topic">Delete</a>
54+
<a href="send.jsp?JMSDestination=<c:out value="${row.name}" />&JMSDestinationType=topic">Send To</a>
55+
<a href="deleteDestination.action?JMSDestination=<c:out value="${row.name}" />&JMSDestinationType=topic">Delete</a>
5656
</td>
5757
</tr>
5858
</c:forEach>

‎activemq-web/src/main/java/org/apache/activemq/web/BrokerFacadeSupport.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@ public Collection<NetworkConnectorViewMBean> getNetworkConnectors() throws Excep
172172
@SuppressWarnings("unchecked")
173173
public Collection<SubscriptionViewMBean> getQueueConsumers(String queueName) throws Exception {
174174
String brokerName = getBrokerName();
175+
queueName = StringUtils.replace(queueName, "\"", "_");
175176
ObjectName query = new ObjectName("org.apache.activemq:BrokerName=" + brokerName
176177
+ ",Type=Subscription,destinationType=Queue,destinationName=" + queueName + ",*");
177178
Set<ObjectName> queryResult = getManagementContext().queryNames(query, null);

0 commit comments

Comments
 (0)