commit 11b0b8ded36da131966219bc45b9bd1e2600fed7
author Holger Voormann <eclipse@voormann.de> Wed Nov 28 00:10:32 2018 +0100
committer Holger Voormann <eclipse@voormann.de> Wed Nov 28 00:10:32 2018 +0100
tree 927160fe4d1ab9b40a9f002c619b9564a776eb75
parent b4361a89654c64dfcc0ebef8d25ada3c0f6ac3d0

Bug 538726 - Eclipse Help Server XSS

Use "UrlUtil.htmlEncode()" instead of "UrlUtil.JavaScriptEncode()" to
encode "data.getTitle()" to avoid that the search tab title is displayed
as "Search\u0020Results" (instead of as "Search Results").

Change-Id: I0daf7203b062fc32f7d2c3dca3c4b7d332637b99
Signed-off-by: Holger Voormann <eclipse@voormann.de>

org.eclipse.help.webapp/advanced/toolbar.jsp

diff --git a/org.eclipse.help.webapp/advanced/toolbar.jsp b/org.eclipse.help.webapp/advanced/toolbar.jsp
index d5c3f67..2b94d78 100644
--- a/org.eclipse.help.webapp/advanced/toolbar.jsp
+++ b/org.eclipse.help.webapp/advanced/toolbar.jsp
@@ -452,7 +452,7 @@
 
 	<tr>
 		<td nowrap style="font: <%=prefs.getToolbarFont()%>" valign="middle">
-			<div id="titleTextTableDiv" style="overflow:hidden; height:22px;"><table><tr><td nowrap style="font:<%=prefs.getToolbarFont()%>"><div id="titleText" >&nbsp;<%= UrlUtil.JavaScriptEncode(data.getTitle()) %></div></td></tr></table>
+			<div id="titleTextTableDiv" style="overflow:hidden; height:22px;"><table><tr><td nowrap style="font:<%=prefs.getToolbarFont()%>"><div id="titleText" >&nbsp;<%=UrlUtil.htmlEncode(data.getTitle())%></div></td></tr></table>
 			</div>