This is an automated email from the ASF dual-hosted git repository.
dixitdeepak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 6868d3ab07 Fixed: Escape HTML output in SOAPEventHandler to prevent XSS
6868d3ab07 is described below
commit 6868d3ab07b6cfeff2c8a42c5621eb132d6e506f
Author: Deepak Dixit <[email protected]>
AuthorDate: Tue Jun 16 15:27:46 2026 +0530
Fixed: Escape HTML output in SOAPEventHandler to prevent XSS
---
.../main/java/org/apache/ofbiz/webapp/event/SOAPEventHandler.java | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/SOAPEventHandler.java
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/SOAPEventHandler.java
index fbdabf43a8..f7c55917e6 100644
---
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/SOAPEventHandler.java
+++
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/SOAPEventHandler.java
@@ -45,6 +45,7 @@ import org.apache.axiom.soap.SOAPEnvelope;
import org.apache.axiom.soap.SOAPFactory;
import org.apache.axiom.soap.SOAPModelBuilder;
import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.UtilCodec;
import org.apache.ofbiz.base.util.UtilGenerics;
import org.apache.ofbiz.base.util.UtilProperties;
import org.apache.ofbiz.base.util.UtilXml;
@@ -116,11 +117,13 @@ public class SOAPEventHandler implements EventHandler {
sb.append("<html><head><title>OFBiz SOAP/1.1
Services</title></head>");
sb.append("<body>No such
service.").append("<p>Services:<ul>");
+ String encodedLocationUri =
UtilCodec.getEncoder("html").encode(locationUri);
for (String scvName: dctx.getAllServiceNames()) {
ModelService model = dctx.getModelService(scvName);
if (model.isExport()) {
- sb.append("<li><a
href=\"").append(locationUri).append("/").append(model.getName()).append("?wsdl\">");
- sb.append(model.getName()).append("</a></li>");
+ String encodedName =
UtilCodec.getEncoder("html").encode(model.getName());
+ sb.append("<li><a
href=\"").append(encodedLocationUri).append("/").append(encodedName).append("?wsdl\">");
+ sb.append(encodedName).append("</a></li>");
}
}
sb.append("</ul></p></body></html>");
