commit 53944da72584ff3f1386afbcae9a7ef848c5649a
author Antonio Sanso <asanso@apache.org> Fri Jun 26 07:31:10 2015 +0000
committer Antonio Sanso <asanso@apache.org> Fri Jun 26 07:31:10 2015 +0000
tree 20072190071942c77690f2bc2e25e26dcf7d4ba0
parent b4c57765a46726f6d72617f4a7d24c99f630ddda

SLING-4836 - Escape output in Apache Sling Feature Flags webconsole plugin 
* applied patch from  Alexandre Collignon (Thanks!)

git-svn-id: https://svn.apache.org/repos/asf/sling/trunk@1687690 13f79535-47bb-0310-9956-ffa450edef68

src/main/java/org/apache/sling/featureflags/impl/FeatureManager.java

diff --git a/src/main/java/org/apache/sling/featureflags/impl/FeatureManager.java b/src/main/java/org/apache/sling/featureflags/impl/FeatureManager.java
index c4f6b84..9fed787 100644
--- a/src/main/java/org/apache/sling/featureflags/impl/FeatureManager.java
+++ b/src/main/java/org/apache/sling/featureflags/impl/FeatureManager.java
@@ -45,6 +45,7 @@
 import org.apache.felix.scr.annotations.ReferenceCardinality;
 import org.apache.felix.scr.annotations.ReferencePolicy;
 import org.apache.felix.scr.annotations.Service;
+import org.apache.sling.api.request.ResponseUtil;
 import org.apache.sling.featureflags.Feature;
 import org.apache.sling.featureflags.Features;
 import org.osgi.framework.Constants;
@@ -155,8 +156,8 @@
                 pw.println("<tr><th>Name</th><th>Description</th><th>Enabled</th></tr>");
                 final ExecutionContextImpl ctx = getCurrentExecutionContext();
                 for (final Feature feature : features) {
-                    pw.printf("<tr><td>%s</td><td>%s</td><td>%s</td></tr>%n", feature.getName(),
-                        feature.getDescription(), ctx.isEnabled(feature));
+                    pw.printf("<tr><td>%s</td><td>%s</td><td>%s</td></tr>%n", ResponseUtil.escapeXml(feature.getName()),
+                            ResponseUtil.escapeXml(feature.getDescription()), ctx.isEnabled(feature));
                 }
                 pw.println("</table>");
             }