Description: fix cross-site scripting in HTML Manager interface
Origin: upstream, http://svn.apache.org/viewvc?view=revision&revision=1057270
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=612257

Index: tomcat6-6.0.24/java/org/apache/catalina/manager/HTMLManagerServlet.java
===================================================================
--- tomcat6-6.0.24.orig/java/org/apache/catalina/manager/HTMLManagerServlet.java	2010-01-02 10:53:43.000000000 -0500
+++ tomcat6-6.0.24/java/org/apache/catalina/manager/HTMLManagerServlet.java	2011-03-24 11:08:15.023072695 -0400
@@ -405,10 +405,11 @@
                 
                 args = new Object[7];
                 args[0] = URL_ENCODER.encode(displayPath);
-                args[1] = displayPath;
-                args[2] = context.getDisplayName();
-                if (args[2] == null) {
+                args[1] = RequestUtil.filter(displayPath);
+                if (context.getDisplayName() == null) {
                     args[2] = "&nbsp;";
+                } else {
+                    args[2] = RequestUtil.filter(context.getDisplayName());
                 }
                 args[3] = new Boolean(context.getAvailable());
                 args[4] = response.encodeURL
Index: tomcat6-6.0.24/java/org/apache/catalina/manager/StatusTransformer.java
===================================================================
--- tomcat6-6.0.24.orig/java/org/apache/catalina/manager/StatusTransformer.java	2006-10-23 23:17:11.000000000 -0400
+++ tomcat6-6.0.24/java/org/apache/catalina/manager/StatusTransformer.java	2011-03-24 11:08:15.023072695 -0400
@@ -575,7 +575,7 @@
                 }
 
                 writer.print("<a href=\"#" + (count++) + ".0\">");
-                writer.print(webModuleName);
+                writer.print(filter(webModuleName));
                 writer.print("</a>");
                 if (iterator.hasNext()) {
                     writer.print("<br>");
@@ -650,7 +650,7 @@
             }
 
             writer.print("<h1>");
-            writer.print(name);
+            writer.print(filter(name));
             writer.print("</h1>");
             writer.print("</a>");
 
@@ -778,11 +778,11 @@
                 mBeanServer.invoke(objectName, "findMappings", null, null);
             
             writer.print("<h2>");
-            writer.print(servletName);
+            writer.print(filter(servletName));
             if ((mappings != null) && (mappings.length > 0)) {
                 writer.print(" [ ");
                 for (int i = 0; i < mappings.length; i++) {
-                    writer.print(mappings[i]);
+                    writer.print(filter(mappings[i]));
                     if (i < mappings.length - 1) {
                         writer.print(" , ");
                     }
