Merge pull request #12 from cesarhernandezgt/tomcat-7.0.109-TT

Prepare for release 7.0.109-TT.3
tomitribe · Jun 28, 2022 · accce4e · accce4e
2 parents 8a65811 + f76f148
commit accce4e
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 3 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -41,7 +41,7 @@ jobs:
       run: unzip -qq tomcat6-build-libs-.zip -d /home/runner/
 
     - name: replace java.7.home
-      run: sed -i.bak 's:.*java.7.home.*:java.7.home=/opt/hostedtoolcache/jdk/7.0.332/x64:' build.properties.default
+      run: sed -i.bak 's:.*java.7.home.*:java.7.home=/opt/hostedtoolcache/jdk/7.0.342/x64:' build.properties.default
 
     - name: ant_build
       run: ant

diff --git a/build.properties.default b/build.properties.default
@@ -27,7 +27,7 @@ version.major=7
 version.minor=0
 version.build=109
 version.patch=0
-version.suffix=-TT.2
+version.suffix=-TT.3
 
 # ----- Source control flags -----
 git.branch=7.0.x

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
@@ -145,6 +145,10 @@
         <bug>65235</bug>: Correct name of <code>changeLocalName</code> in the
         documentation for the <code>RemoteIpValve</code>. (markt)
       </fix>
+      <fix>
+        Examples. Fix CVE-2022-34305, a low severity XSS vulnerability in the
+        Form authentication example. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Other">

diff --git a/webapps/examples/jsp/security/protected/index.jsp b/webapps/examples/jsp/security/protected/index.jsp
@@ -95,7 +95,10 @@ To add some data to the authenticated session, enter it here:
   while (names.hasMoreElements()) {
     String name = names.nextElement();
 %>
-<tr><td><%= name %></td><td><%= session.getAttribute(name) %></td>
+<tr>
+  <td><%= util.HTMLFilter.filter(name) %></td>
+  <td><%= util.HTMLFilter.filter(String.valueOf(session.getAttribute(name))) %></td>
+</tr>
 <%
   }
 %>