Fix ill-encoding of UriBuilder class
This method misses URLEncode.encode() encapsulation, which leaves the
danger of URL injection.
package com.google.appinventor.server.util;
+import java.net.URLEncoder;
+
public class UriBuilder {
private StringBuilder sb = new StringBuilder();
private boolean first = true;
@@ -30,7 +32,7 @@ public class UriBuilder {
} else {
sb.append("&");
}
- sb.append(key + "=" + value);
+ sb.append(URLEncoder.encode(key) + "=" + URLEncoder.encode(value));
return this;
}
