Escape html in user input

Unidata · Aug 12, 2024 · 859ef5e · 859ef5e
1 parent 3bd01bf
commit 859ef5e
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/dap4/d4servlet/build.gradle b/dap4/d4servlet/build.gradle
@@ -8,6 +8,7 @@ dependencies {
   implementation 'edu.ucar:httpservices'
   implementation 'edu.ucar:cdm-core'
 
+  compileOnly 'org.apache.commons:commons-lang3'
   compileOnly 'jakarta.servlet:jakarta.servlet-api'
   compileOnly 'org.slf4j:slf4j-api'
 }
diff --git a/dap4/d4servlet/src/main/java/dap4/servlet/DapDSR.java b/dap4/d4servlet/src/main/java/dap4/servlet/DapDSR.java
@@ -17,6 +17,8 @@
 import java.net.MalformedURLException;
 import java.net.URL;
 
+import org.apache.commons.lang3.StringEscapeUtils;
+
 /**
  * Generate the DSR for a dataset.
  * Currently only generates a minimal DSR.
@@ -132,6 +134,8 @@ protected String getTemplate(ResponseFormat format) throws IOException {
   }
 
   protected void substitute(StringBuilder buf, String macro, String value) {
+    value = StringEscapeUtils.escapeHtml4(value);
+
     int from = 0;
     String tag = "${" + macro + "}";
     int taglen = tag.length();