Merge pull request #549 from sguan-actuate/master

Fix for XSS vulnerability Bug 546816
eclipse-birt · Jul 24, 2019 · 7cb3874 · 7cb3874
2 parents d56caca + 91ef718
commit 7cb3874
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/...report.viewer/birt/WEB-INF/classes/org/eclipse/birt/report/utility/ParameterAccessor.java b/...report.viewer/birt/WEB-INF/classes/org/eclipse/birt/report/utility/ParameterAccessor.java
@@ -2104,7 +2104,7 @@ public static String getParameter( HttpServletRequest request,
 			{
 			}
 		}
-		return request.getParameter( parameterName );
+		return htmlEncode( request.getParameter( parameterName ) );
 	}
 
 	/**
@@ -2258,7 +2258,7 @@ public static String decodeFilePath( HttpServletRequest request,
 		{
 			return null;
 		}
-
+		filePath = htmlDecode( filePath );
 		if ( isEncodedPaths( request ) )
 		{
 			return decodeBase64( filePath );