2.11.0-M4-git-06 Fixing file upload XSS vulnerability
@@ -23,6 +23,7 @@ import java.io.IOException;
import org.apache.wiki.WikiEngine;
import org.apache.wiki.WikiPage;
import org.apache.wiki.attachment.Attachment;
+import org.apache.wiki.util.TextUtil;
/**
* Returns the currently requested page name.
@@ -44,7 +45,7 @@ public class PageNameTag
{
if( page instanceof Attachment )
{
- pageContext.getOut().print( ((Attachment)page).getFileName() );
+ pageContext.getOut().print( TextUtil.replaceEntities( ((Attachment)page).getFileName() ) );
}
else
{
