(sling-org-apache-sling-xss) branch master updated: fix(webconsole): escape consoleRoot to prevent XSS in web console plugin (#65)

[cziegeler]

This is an automated email from the ASF dual-hosted git repository.

cziegeler pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git


The following commit(s) were added to refs/heads/master by this push:
     new 48b522a  fix(webconsole): escape consoleRoot to prevent XSS in web 
console plugin (#65)
48b522a is described below

commit 48b522a1f9bd63edbd4cf8bad452faa1fe044177
Author: Carsten Ziegeler <cziege...@apache.org>
AuthorDate: Tue Jun 2 16:44:58 2026 +0200

    fix(webconsole): escape consoleRoot to prevent XSS in web console plugin 
(#65)
    
    Co-authored-by: Maia <maia@noreply>
---
 .../impl/webconsole/XSSProtectionAPIWebConsolePlugin.java  | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git 
a/src/main/java/org/apache/sling/xss/impl/webconsole/XSSProtectionAPIWebConsolePlugin.java
 
b/src/main/java/org/apache/sling/xss/impl/webconsole/XSSProtectionAPIWebConsolePlugin.java
index ca2e23d..1150bdf 100644
--- 
a/src/main/java/org/apache/sling/xss/impl/webconsole/XSSProtectionAPIWebConsolePlugin.java
+++ 
b/src/main/java/org/apache/sling/xss/impl/webconsole/XSSProtectionAPIWebConsolePlugin.java
@@ -114,15 +114,16 @@ public class XSSProtectionAPIWebConsolePlugin extends 
HttpServlet {
         } else {
             try {
                 PrintWriter printWriter = response.getWriter();
-                printWriter.printf(LINK_TAG, consoleRoot + RES_URI_XSS_CSS);
-                printWriter.printf(SCRIPT_TAG, consoleRoot + RES_URI_XSS_JS);
+                String escapedConsoleRoot = 
StringEscapeUtils.escapeHtml4(consoleRoot);
+                printWriter.printf(LINK_TAG, escapedConsoleRoot + 
RES_URI_XSS_CSS);
+                printWriter.printf(SCRIPT_TAG, escapedConsoleRoot + 
RES_URI_XSS_JS);
                 printWriter.println("<div id='xss-tabs'>");
                 printWriter.println("<ul>");
                 printWriter.println("<li id='blocked-tab'><a 
href='#blocked'><span>Status</span></a></li>");
                 if (xssFilter != null) {
                     printWriter.println(String.format(
                             "<li id='config-tab'><a href='%s'><span>Active 
Configuration</span></a></li>",
-                            consoleRoot + URI_CONFIG_XHR));
+                            escapedConsoleRoot + URI_CONFIG_XHR));
                 }
                 printWriter.println("</ul>");
                 printWriter.println("<div id='blocked'>");
@@ -182,10 +183,11 @@ public class XSSProtectionAPIWebConsolePlugin extends 
HttpServlet {
         if (antiSamyPolicy != null) {
             try {
                 PrintWriter printWriter = response.getWriter();
-                printWriter.printf(SCRIPT_TAG, consoleRoot + 
RES_URI_CONFIG_JS);
+                String escapedConsoleRoot = 
StringEscapeUtils.escapeHtml4(consoleRoot);
+                printWriter.printf(SCRIPT_TAG, escapedConsoleRoot + 
RES_URI_CONFIG_JS);
                 printWriter.write("<div id='config'>");
-                printWriter.printf(LINK_TAG, consoleRoot + 
RES_URI_PRETTIFY_CSS);
-                printWriter.printf(SCRIPT_TAG, consoleRoot + 
RES_URI_PRETTIFY_JS);
+                printWriter.printf(LINK_TAG, escapedConsoleRoot + 
RES_URI_PRETTIFY_CSS);
+                printWriter.printf(SCRIPT_TAG, escapedConsoleRoot + 
RES_URI_PRETTIFY_JS);
                 printWriter.write("<p class='statline ui-state-highlight'>The 
current AntiSamy configuration ");
                 if (antiSamyPolicy.isEmbedded()) {
                     printWriter.write("is the default one embedded in the 
org.apache.sling.xss bundle.");