From 5645ba2d5d044c26364082752d82c2a7a85e61f9 Mon Sep 17 00:00:00 2001
From: mikewse <mikewse@users.noreply.github.com>
Date: Sat, 30 Aug 2014 09:12:30 +0000
Subject: [PATCH] DWR-619: escape forward slashes in generated JS to avoid
 </script> attacks

---
 .../main/java/org/directwebremoting/json/types/JsonObject.java    | 2 +-
 .../main/java/org/directwebremoting/json/types/JsonString.java    | 2 +-
 core/api/main/java/org/directwebremoting/util/JavascriptUtil.java | 8 ++++++--
 .../main/java/org/directwebremoting/convert/StringConverter.java  | 2 +-
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/core/api/main/java/org/directwebremoting/json/types/JsonObject.java b/core/api/main/java/org/directwebremoting/json/types/JsonObject.java
index 63c3ce08..747fe04f 100644
--- a/core/api/main/java/org/directwebremoting/json/types/JsonObject.java
+++ b/core/api/main/java/org/directwebremoting/json/types/JsonObject.java
@@ -51,7 +51,7 @@ public class JsonObject extends JsonValue implements Map<String, JsonValue>
             }
 
             output.append('\'');
-            output.append(JavascriptUtil.escapeJavaScript(entry.getKey(), false, false));
+            output.append(JavascriptUtil.escapeJavaScript(entry.getKey(), false));
             output.append("':");
             output.append(entry.getValue().toExternalRepresentation());
         }
diff --git a/core/api/main/java/org/directwebremoting/json/types/JsonString.java b/core/api/main/java/org/directwebremoting/json/types/JsonString.java
index e8ec5810..905ea823 100644
--- a/core/api/main/java/org/directwebremoting/json/types/JsonString.java
+++ b/core/api/main/java/org/directwebremoting/json/types/JsonString.java
@@ -48,7 +48,7 @@ public class JsonString extends JsonValue
     @Override
     public String toExternalRepresentation()
     {
-        return "'" + JavascriptUtil.escapeJavaScript(value, false, false) + "'";
+        return "'" + JavascriptUtil.escapeJavaScript(value, false) + "'";
     }
 
     /* (non-Javadoc)
diff --git a/core/api/main/java/org/directwebremoting/util/JavascriptUtil.java b/core/api/main/java/org/directwebremoting/util/JavascriptUtil.java
index 21a298f8..afc5798e 100644
--- a/core/api/main/java/org/directwebremoting/util/JavascriptUtil.java
+++ b/core/api/main/java/org/directwebremoting/util/JavascriptUtil.java
@@ -40,7 +40,7 @@ public class JavascriptUtil
 {
     public static String escapeJavaScript(String str)
     {
-        return escapeJavaScript(str, true, false);
+        return escapeJavaScript(str, true);
     }
 
     /**
@@ -64,12 +64,16 @@ public class JavascriptUtil
      * @param str  String to escape values in, may be null
      * @return String with escaped values, <code>null</code> if null string input
      */
-    public static String escapeJavaScript(String str, boolean escapeSingleQuote, boolean escapeForwardSlash)
+    public static String escapeJavaScript(String str, boolean escapeSingleQuote)
     {
         if (str == null) {
             return null;
         }
 
+        // We should always escape forward slash to protect from </script> XSS hacks
+        // (see DWR-619)
+        boolean escapeForwardSlash = true;
+
         StringWriter stringWriter = new StringWriter(str.length() * 2);
         int sz;
         sz = str.length();
diff --git a/core/impl/main/java/org/directwebremoting/convert/StringConverter.java b/core/impl/main/java/org/directwebremoting/convert/StringConverter.java
index d4119433..005bad11 100644
--- a/core/impl/main/java/org/directwebremoting/convert/StringConverter.java
+++ b/core/impl/main/java/org/directwebremoting/convert/StringConverter.java
@@ -55,7 +55,7 @@ public class StringConverter extends AbstractConverter
      */
     public OutboundVariable convertOutbound(Object data, OutboundContext outctx) throws ConversionException
     {
-        String escaped = JavascriptUtil.escapeJavaScript(data.toString(), false, false);
+        String escaped = JavascriptUtil.escapeJavaScript(data.toString(), false);
         return new NonNestedOutboundVariable('\"' + escaped + '\"');
     }
 }
-- 
2.13.6

