From 081f1865a87d1569c28ac389f6a63e4bd045a29b Mon Sep 17 00:00:00 2001
From: zzz <zzz@mail.i2p>
Date: Wed, 13 May 2015 12:04:28 +0000
Subject: [PATCH] Console: Fix URLs caught in XSS filter on /confighome (ticket
 #1569) Fix name and URL escaping Truncate long URLs in display

---
 .../net/i2p/router/web/ConfigHomeHandler.java | 11 ++++++----
 .../src/net/i2p/router/web/HomeHelper.java    | 22 ++++++++++++-------
 2 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/apps/routerconsole/java/src/net/i2p/router/web/ConfigHomeHandler.java b/apps/routerconsole/java/src/net/i2p/router/web/ConfigHomeHandler.java
index 16bccdfafd..5e426988e7 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/ConfigHomeHandler.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/ConfigHomeHandler.java
@@ -58,18 +58,21 @@ public class ConfigHomeHandler extends FormHandler {
             else
                 apps = HomeHelper.buildApps(_context, config);
             if (adding) {
-                String name = getJettyString("name");
+                String name = getJettyString("nofilter_name");
                 if (name == null || name.length() <= 0) {
                     addFormError(_("No name entered"));
                     return;
                 }
-                String url = getJettyString("url");
+                String url = getJettyString("nofilter_url");
                 if (url == null || url.length() <= 0) {
                     addFormError(_("No URL entered"));
                     return;
                 }
-                name = DataHelper.escapeHTML(name).replace(",", "&#44;");   // HomeHelper.S
-                url = DataHelper.escapeHTML(url).replace(",", "&#44;");
+                // these would get double-escaped so we can't do it this way...
+                //name = DataHelper.escapeHTML(name).replace(",", "&#44;");
+                //url = DataHelper.escapeHTML(url).replace(",", "&#44;");
+                name = name.replace(",", ".");
+                url = url.replace(",", "."); // fail
                 HomeHelper.App app = null;
                 if ("1".equals(group))
                     app = new HomeHelper.App(name, "", url, "/themes/console/images/eepsite.png");
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/HomeHelper.java b/apps/routerconsole/java/src/net/i2p/router/web/HomeHelper.java
index 1569ebc9bb..114441e5c1 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/HomeHelper.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/HomeHelper.java
@@ -7,6 +7,7 @@ import java.util.List;
 import java.util.Set;
 import java.util.TreeSet;
 
+import net.i2p.data.DataHelper;
 import net.i2p.router.RouterContext;
 import net.i2p.util.PortMapper;
 
@@ -209,17 +210,22 @@ public class HomeHelper extends HelperBase {
                 buf.append("<img height=\"16\" alt=\"\" src=\"").append(app.icon).append("\">");
             }
             buf.append("</td><td align=\"left\">")
-               .append(app.name)
-               .append("</td><td align=\"left\"><a href=\"")
-               .append(app.url.replace("&", "&amp;"))
-               .append("\">")
-               .append(app.url.replace("&", "&amp;"))
-               .append("</a></td></tr>\n");
+               .append(DataHelper.escapeHTML(app.name))
+               .append("</td><td align=\"left\"><a href=\"");
+            String url = DataHelper.escapeHTML(app.url);
+            buf.append(url)
+               .append("\">");
+            // truncate before escaping
+            if (app.url.length() > 50)
+                buf.append(DataHelper.escapeHTML(app.url.substring(0, 48))).append("&hellip;");
+            else
+                buf.append(url);
+            buf.append("</a></td></tr>\n");
         }
         buf.append("<tr><td colspan=\"2\" align=\"center\"><b>")
            .append(_("Add")).append(":</b>" +
-                   "</td><td align=\"left\"><input type=\"text\" name=\"name\"></td>" +
-                   "<td align=\"left\"><input type=\"text\" size=\"40\" name=\"url\"></td></tr>");
+                   "</td><td align=\"left\"><input type=\"text\" name=\"nofilter_name\"></td>" +
+                   "<td align=\"left\"><input type=\"text\" size=\"40\" name=\"nofilter_url\"></td></tr>");
         buf.append("</table>\n");
         return buf.toString();
     }