Fixing XSS in SIP plugin

src/java/org/jivesoftware/openfire/util/StringUtils.java

@@ -0,0 +1,81 @@
+package org.jivesoftware.openfire.util;
+
+/**
+ * Utility class to perform common String manipulation algorithms.
+ */
+public class StringUtils {
+
+    private static final char[] LT_ENCODE = "<".toCharArray();
+    private static final char[] GT_ENCODE = ">".toCharArray();
+
+
+    /**
+     * This method takes a string which may contain HTML tags (ie, <b>,
+     * <table>, etc) and converts the '<' and '>' characters to
+     * their HTML escape sequences. It will also replace LF  with <br>.
+     *
+     * @param in the text to be converted.
+     * @return the input string with the characters '<' and '>' replaced
+     *         with their HTML escape sequences.
+     */
+    public static String escapeHTMLTags(String in) {
+        return escapeHTMLTags(in, true);
+    }
+
+        /**
+     * This method takes a string which may contain HTML tags (ie, <b>,
+     * <table>, etc) and converts the '<' and '>' characters to
+     * their HTML escape sequences.
+     *
+     * @param in the text to be converted.
+     * @param includeLF set to true to replace \n with <br>.
+     * @return the input string with the characters '&lt;' and '&gt;' replaced
+     *         with their HTML escape sequences.
+     */
+    public static String escapeHTMLTags(String in, boolean includeLF) {
+        if (in == null) {
+            return null;
+        }
+        char ch;
+        int i = 0;
+        int last = 0;
+        char[] input = in.toCharArray();
+        int len = input.length;
+        StringBuilder out = new StringBuilder((int)(len * 1.3));
+        for (; i < len; i++) {
+            ch = input[i];
+            if (ch > '>') {
+            }
+            else if (ch == '<') {
+                if (i > last) {
+                    out.append(input, last, i - last);
+                }
+                last = i + 1;
+                out.append(LT_ENCODE);
+            }
+            else if (ch == '>') {
+                if (i > last) {
+                    out.append(input, last, i - last);
+                }
+                last = i + 1;
+                out.append(GT_ENCODE);
+            }
+            else if (ch == '\n' && includeLF == true) {
+                if (i > last) {
+                    out.append(input, last, i - last);
+                }
+                last = i + 1;
+                out.append("<br>");
+            }
+        }
+        if (last == 0) {
+            return in;
+        }
+        if (i > last) {
+            out.append(input, last, i - last);
+        }
+        return out.toString();
+    }
+
+
+}

src/web/sipark-user-summary.jsp

@@ -21,6 +21,7 @@
         %>
 <%@ page import="org.jivesoftware.openfire.sip.sipaccount.SipAccountDAO" %>
 <%@ page import="org.jivesoftware.openfire.sip.sipaccount.SipAccount" %>
+<%@ page import="org.jivesoftware.openfire.util.StringUtils" %>
 <%@ page import="java.util.Collection" %>
 
 <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
@@ -224,7 +225,7 @@
                     <%=user.getStatus().name()%>
                 </td>
                 <td width="20%">
-                    <a href="./../../user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= user.getUsername() %>
+                    <a href="./../../user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(user.getUsername()) %>
                     </a>
                 </td>
                 <td width="20%">