Changeset d12b531 for apps/jetty

Timestamp:

Apr 14, 2018 1:25:25 PM (2 years ago)

Author:

zzz <zzz@…>

Branches:

master

Children:

ffad52e

Parents:

941db3a

Message:

Jetty: Fix quote in header line tripping XSS filter (ticket #2215)

File:

• apps/jetty/java/src/net/i2p/servlet/filters/XSSRequestWrapper.java (modified) (1 diff)

apps/jetty/java/src/net/i2p/servlet/filters/XSSRequestWrapper.java

@@ -25 +25 @@
     private static final String WIN_PATTERN     = "^[\\p{L}\\p{Nd}.,:\\-\\/+=~\\[\\]?@_ \r\n\\\\]*$";
     private static final Pattern parameterValuePattern = Pattern.compile(SystemVersion.isWindows() ? WIN_PATTERN : NON_WIN_PATTERN);
-    private static final Pattern headerValuePattern = Pattern.compile("^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ ]*$");
+    private static final Pattern headerValuePattern = Pattern.compile("^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ \"]*$");
     private static final String NOFILTER = "nofilter_";