diff options
| author | Jouni Koivuviita <jouni.koivuviita@itmill.com> | 2008-07-24 07:57:56 +0000 |
|---|---|---|
| committer | Jouni Koivuviita <jouni.koivuviita@itmill.com> | 2008-07-24 07:57:56 +0000 |
| commit | 5a21271a367a85507d399e15ce66861efb320b11 (patch) | |
| tree | 7466be6287fe0429d092dc2b4a3e2836f50bfad3 | |
| parent | 36262e475ded6021dc3a32500bbd808f7cd21e04 (diff) | |
| download | vaadin-framework-5a21271a367a85507d399e15ce66861efb320b11.tar.gz vaadin-framework-5a21271a367a85507d399e15ce66861efb320b11.zip | |
Fixed a possible security vulnerability in IWindow. The window caption string was not escaped, and any HTML could be passed and parsed inside it.
svn changeset:5115/svn branch:trunk
| -rw-r--r-- | src/com/itmill/toolkit/terminal/gwt/client/ui/IWindow.java | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/com/itmill/toolkit/terminal/gwt/client/ui/IWindow.java b/src/com/itmill/toolkit/terminal/gwt/client/ui/IWindow.java index 10bfd939be..76c7a9ea81 100644 --- a/src/com/itmill/toolkit/terminal/gwt/client/ui/IWindow.java +++ b/src/com/itmill/toolkit/terminal/gwt/client/ui/IWindow.java @@ -491,7 +491,7 @@ public class IWindow extends PopupPanel implements Paintable, ScrollListener { } public void setCaption(String c, String icon) { - String html = c; + String html = Util.escapeHTML(c); if (icon != null) { icon = client.translateToolkitUri(icon); html = "<img src=\"" + icon + "\" class=\"i-icon\" />" + html; |