* Console:

- Fix several XSS issues (thx Aaron Portnoy of Exodus Intel)
  - Add Content-Security-Policy and X-XSS-Protection headers
  - Disable changing news feed URL from UI
  - Disable plugin install from UI
  - Disable setting unsigned update URL from UI
  - Disable /configadvanced
* DataHelper: Disallow \r in storeProps() (thx joernchen of Phenoelit)
* ExecNamingService: Disable (thx joernchen of Phenoelit)
* Startup: Add susimail.config to migrated files

apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java

@@ -159,6 +159,8 @@ public class I2PSnarkServlet extends BasicServlet {
         // this is the part after /i2psnark
         String path = req.getServletPath();
         resp.setHeader("X-Frame-Options", "SAMEORIGIN");
+        resp.setHeader("Content-Security-Policy", "default-src 'self'");
+        resp.setHeader("X-XSS-Protection", "1; mode=block");
 
         String peerParam = req.getParameter("p");
         String stParam = req.getParameter("st");
@@ -167,9 +169,10 @@ public class I2PSnarkServlet extends BasicServlet {
             peerParam.replaceAll("[a-zA-Z0-9~=-]", "").length() > 0) {  // XSS
             peerString = "";
         } else {
-            peerString = "?p=" + peerParam;
+            peerString = "?p=" + DataHelper.stripHTML(peerParam);
         }
         if (stParam != null && !stParam.equals("0")) {
+            stParam = DataHelper.stripHTML(stParam);
             if (peerString.length() > 0)
                 peerString += "&st=" + stParam;
             else

apps/i2ptunnel/jsp/edit.jsp

@@ -2,6 +2,8 @@
     // NOTE: Do the header carefully so there is no whitespace before the <?xml... line
 
     response.setHeader("X-Frame-Options", "SAMEORIGIN");
+    response.setHeader("Content-Security-Policy", "default-src 'self'");
+    response.setHeader("X-XSS-Protection", "1; mode=block");
 
 %><%@page pageEncoding="UTF-8"
 %><%@page trimDirectiveWhitespaces="true"

apps/i2ptunnel/jsp/editClient.jsp

@@ -52,10 +52,10 @@ input.default { width: 1px; height: 1px; visibility: hidden; }
                   %><h4><%=intl._("Edit proxy settings")%></h4><% 
                 } else {
                     tunnelTypeName = editBean.getTypeName(request.getParameter("type"));
-                    tunnelType = request.getParameter("type");
+                    tunnelType = net.i2p.data.DataHelper.stripHTML(request.getParameter("type"));
                   %><h4><%=intl._("New proxy settings")%></h4><% 
                 } %>
-                <input type="hidden" name="tunnel" value="<%=request.getParameter("tunnel")%>" />
+                <input type="hidden" name="tunnel" value="<%=curTunnel%>" />
                 <input type="hidden" name="nonce" value="<%=editBean.getNextNonce()%>" />
                 <input type="hidden" name="type" value="<%=tunnelType%>" />
                 <input type="submit" class="default" name="action" value="Save changes" />

apps/i2ptunnel/jsp/editServer.jsp

@@ -52,10 +52,10 @@ input.default { width: 1px; height: 1px; visibility: hidden; }
                   %><h4><%=intl._("Edit server settings")%></h4><% 
                 } else {
                     tunnelTypeName = editBean.getTypeName(request.getParameter("type"));
-                    tunnelType = request.getParameter("type");
+                    tunnelType = net.i2p.data.DataHelper.stripHTML(request.getParameter("type"));
                   %><h4><%=intl._("New server settings")%></h4><% 
                 } %>
-                <input type="hidden" name="tunnel" value="<%=request.getParameter("tunnel")%>" />
+                <input type="hidden" name="tunnel" value="<%=curTunnel%>" />
                 <input type="hidden" name="nonce" value="<%=editBean.getNextNonce()%>" />
                 <input type="hidden" name="type" value="<%=tunnelType%>" />
                 <input type="submit" class="default" name="action" value="Save changes" />

apps/i2ptunnel/jsp/index.jsp

@@ -6,6 +6,8 @@
         request.setCharacterEncoding("UTF-8");
 
     response.setHeader("X-Frame-Options", "SAMEORIGIN");
+    response.setHeader("Content-Security-Policy", "default-src 'self'");
+    response.setHeader("X-XSS-Protection", "1; mode=block");
 
 %><%@page pageEncoding="UTF-8"
 %><%@page trimDirectiveWhitespaces="true"

apps/i2ptunnel/jsp/wizard.jsp

@@ -6,6 +6,8 @@
         request.setCharacterEncoding("UTF-8");
 
     response.setHeader("X-Frame-Options", "SAMEORIGIN");
+    response.setHeader("Content-Security-Policy", "default-src 'self'");
+    response.setHeader("X-XSS-Protection", "1; mode=block");
 
 %><%@page pageEncoding="UTF-8"
 %><%@page contentType="text/html" import="net.i2p.i2ptunnel.web.EditBean"
@@ -39,6 +41,7 @@
    /* Fetch and format a couple of regularly-used values */
    boolean tunnelIsClient = Boolean.valueOf(request.getParameter("isClient"));
    String tunnelType = request.getParameter("type");
+   tunnelType = net.i2p.data.DataHelper.stripHTML(tunnelType);
    /* Special case - don't display page 4 for server tunnels */
    if (curPage == 4 && !tunnelIsClient) {
      if ("Previous page".equals(request.getParameter("action"))) {
@@ -224,17 +227,17 @@
                 <label for="name" accesskey="N">
                     <%=intl._("Name")%>:(<span class="accessKey">N</span>)
                 </label>
-                <input type="text" size="30" maxlength="50" name="name" id="name" title="Tunnel Name" value="<%=(!"null".equals(request.getParameter("name")) ? request.getParameter("name") : "" ) %>" class="freetext" />
+                <input type="text" size="30" maxlength="50" name="name" id="name" title="Tunnel Name" value="<%=(!"null".equals(request.getParameter("name")) ? net.i2p.data.DataHelper.stripHTML(request.getParameter("name")) : "" ) %>" class="freetext" />
             </div>
             <div id="descriptionField" class="rowItem">
                 <label for="description" accesskey="e">
                     <%=intl._("Description")%>:(<span class="accessKey">E</span>)
                 </label>
-                <input type="text" size="60" maxlength="80" name="description"  id="description" title="Tunnel Description" value="<%=(!"null".equals(request.getParameter("description")) ? request.getParameter("description") : "" ) %>" class="freetext" />
+                <input type="text" size="60" maxlength="80" name="description"  id="description" title="Tunnel Description" value="<%=(!"null".equals(request.getParameter("description")) ? net.i2p.data.DataHelper.stripHTML(request.getParameter("description")) : "" ) %>" class="freetext" />
             </div><%
             } else {
-            %><input type="hidden" name="name" value="<%=request.getParameter("name")%>" />
+            %><input type="hidden" name="name" value="<%=net.i2p.data.DataHelper.stripHTML(request.getParameter("name"))%>" />
-            <input type="hidden" name="description" value="<%=request.getParameter("description")%>" /><%
+            <input type="hidden" name="description" value="<%=net.i2p.data.DataHelper.stripHTML(request.getParameter("description"))%>" /><%
             } /* curPage 3 */
 
                /* End page 3 */ %>
@@ -252,10 +255,10 @@
                 <label for="proxyList" accesskey="x">
                     <%=intl._("Outproxies")%>(<span class="accessKey">x</span>):
                 </label>
-                <input type="text" size="30" id="proxyList" name="proxyList" title="List of Outproxy I2P destinations" value="<%=(!"null".equals(request.getParameter("proxyList")) ? request.getParameter("proxyList") : "" ) %>" class="freetext" />
+                <input type="text" size="30" id="proxyList" name="proxyList" title="List of Outproxy I2P destinations" value="<%=(!"null".equals(request.getParameter("proxyList")) ? net.i2p.data.DataHelper.stripHTML(request.getParameter("proxyList")) : "" ) %>" class="freetext" />
             </div><%
                 } else {
-            %><input type="hidden" name="proxyList" value="<%=request.getParameter("proxyList")%>" /><%
+            %><input type="hidden" name="proxyList" value="<%=net.i2p.data.DataHelper.stripHTML(request.getParameter("proxyList"))%>" /><%
                 } /* curPage 4 */
               } else if ("client".equals(tunnelType) || "ircclient".equals(tunnelType) || "streamrclient".equals(tunnelType)) {
                 if (curPage == 4) {
@@ -267,7 +270,7 @@
                 <label for="targetDestination" accesskey="T">
                     <%=intl._("Tunnel Destination")%>(<span class="accessKey">T</span>):
                 </label>
-                <input type="text" size="30" id="targetDestination" name="targetDestination" title="Destination of the Tunnel" value="<%=(!"null".equals(request.getParameter("targetDestination")) ? request.getParameter("targetDestination") : "" ) %>" class="freetext" />
+                <input type="text" size="30" id="targetDestination" name="targetDestination" title="Destination of the Tunnel" value="<%=(!"null".equals(request.getParameter("targetDestination")) ? net.i2p.data.DataHelper.stripHTML(request.getParameter("targetDestination")) : "" ) %>" class="freetext" />
                 <span class="comment">(<%=intl._("name, name:port, or destination")%>
                      <% if ("streamrclient".equals(tunnelType)) { /* deferred resolution unimplemented in streamr client */ %>
                          - <%=intl._("b32 not recommended")%>
@@ -275,7 +278,7 @@
                 </span>
             </div><%
                 } else {
-            %><input type="hidden" name="targetDestination" value="<%=request.getParameter("targetDestination")%>" /><%
+            %><input type="hidden" name="targetDestination" value="<%=net.i2p.data.DataHelper.stripHTML(request.getParameter("targetDestination"))%>" /><%
                 } /* curPage 4 */
               }
             } /* tunnelIsClient */
@@ -294,10 +297,10 @@
                 <label for="targetHost" accesskey="H">
                     <%=intl._("Host")%>(<span class="accessKey">H</span>):
                 </label>
-                <input type="text" size="20" id="targetHost" name="targetHost" title="Target Hostname or IP" value="<%=(!"null".equals(request.getParameter("targetHost")) ? request.getParameter("targetHost") : "127.0.0.1" ) %>" class="freetext" />
+                <input type="text" size="20" id="targetHost" name="targetHost" title="Target Hostname or IP" value="<%=(!"null".equals(request.getParameter("targetHost")) ? net.i2p.data.DataHelper.stripHTML(request.getParameter("targetHost")) : "127.0.0.1" ) %>" class="freetext" />
             </div><%
               } else {
-            %><input type="hidden" name="targetHost" value="<%=request.getParameter("targetHost")%>" /><%
+            %><input type="hidden" name="targetHost" value="<%=net.i2p.data.DataHelper.stripHTML(request.getParameter("targetHost"))%>" /><%
               } /* curPage 5 */
             } /* streamrclient or !streamrserver */ %>
             <%
@@ -310,10 +313,10 @@
                 <label for="targetPort" accesskey="P">
                     <%=intl._("Port")%>(<span class="accessKey">P</span>):
                 </label>
-                <input type="text" size="6" maxlength="5" id="targetPort" name="targetPort" title="Target Port Number" value="<%=(!"null".equals(request.getParameter("targetPort")) ? request.getParameter("targetPort") : "" ) %>" class="freetext" />
+                <input type="text" size="6" maxlength="5" id="targetPort" name="targetPort" title="Target Port Number" value="<%=(!"null".equals(request.getParameter("targetPort")) ? net.i2p.data.DataHelper.stripHTML(request.getParameter("targetPort")) : "" ) %>" class="freetext" />
             </div><%
               } else {
-            %><input type="hidden" name="targetPort" value="<%=request.getParameter("targetPort")%>" /><%
+            %><input type="hidden" name="targetPort" value="<%=net.i2p.data.DataHelper.stripHTML(request.getParameter("targetPort"))%>" /><%
               } /* curPage 5 */
             } /* !tunnelIsClient */ %>
             <%
@@ -327,10 +330,10 @@
                 <label for="port" accesskey="P">
                     <span class="accessKey">P</span>ort:
                 </label>
-                <input type="text" size="6" maxlength="5" id="port" name="port" title="Access Port Number" value="<%=(!"null".equals(request.getParameter("port")) ? request.getParameter("port") : "" ) %>" class="freetext" />
+                <input type="text" size="6" maxlength="5" id="port" name="port" title="Access Port Number" value="<%=(!"null".equals(request.getParameter("port")) ? net.i2p.data.DataHelper.stripHTML(request.getParameter("port")) : "" ) %>" class="freetext" />
             </div><%
               } else {
-            %><input type="hidden" name="port" value="<%=request.getParameter("port")%>" /><%
+            %><input type="hidden" name="port" value="<%=net.i2p.data.DataHelper.stripHTML(request.getParameter("port"))%>" /><%
               } /* curPage 5 */
             } /* tunnelIsClient or httpbidirserver */ %>
             <%
@@ -366,7 +369,7 @@
                 </select>
             </div><%
               } else {
-            %><input type="hidden" name="reachableBy" value="<%=request.getParameter("reachableBy")%>" /><%
+            %><input type="hidden" name="reachableBy" value="<%=net.i2p.data.DataHelper.stripHTML(request.getParameter("reachableBy"))%>" /><%
               } /* curPage 5 */
             } /* (tunnelIsClient && !streamrclient) ||  httpbidirserver || streamrserver */
 
@@ -388,7 +391,7 @@
             </div><%
             } else {
               if ("1".equals(request.getParameter("startOnLoad"))) {
-            %><input type="hidden" name="startOnLoad" value="<%=request.getParameter("startOnLoad")%>" /><%
+            %><input type="hidden" name="startOnLoad" value="<%=net.i2p.data.DataHelper.stripHTML(request.getParameter("startOnLoad"))%>" /><%
               }
             } /* curPage 6 */
 
@@ -436,30 +439,30 @@
                 } %>
                 </td></tr>
                 <tr><td><%=intl._("Tunnel name and description")%></td><td>
-                    <%=request.getParameter("name")%><br />
+                    <%=net.i2p.data.DataHelper.stripHTML(request.getParameter("name"))%><br />
-                    <%=request.getParameter("description")%>
+                    <%=net.i2p.data.DataHelper.stripHTML(request.getParameter("description"))%>
                 </td></tr><%
                 if (tunnelIsClient) { %>
                 <tr><td><%=intl._("Tunnel destination")%></td><td><%
                   if ("httpclient".equals(tunnelType) || "connectclient".equals(tunnelType) || "sockstunnel".equals(tunnelType) || "socksirctunnel".equals(tunnelType)) { %>
-                    <%=request.getParameter("proxyList")%><%
+                    <%=net.i2p.data.DataHelper.stripHTML(request.getParameter("proxyList"))%><%
                   } else if ("client".equals(tunnelType) || "ircclient".equals(tunnelType) || "streamrclient".equals(tunnelType)) { %>
-                    <%=request.getParameter("targetDestination")%><%
+                    <%=net.i2p.data.DataHelper.stripHTML(request.getParameter("targetDestination"))%><%
                   } %>
                 </td></tr><%
                 } %>
                 <tr><td><%=intl._("Binding address and port")%></td><td><%
                 if ((tunnelIsClient && "streamrclient".equals(tunnelType)) || (!tunnelIsClient && !"streamrserver".equals(tunnelType))) { %>
-                    <%=request.getParameter("targetHost")%><br /><%
+                    <%=net.i2p.data.DataHelper.stripHTML(request.getParameter("targetHost"))%><br /><%
                 }
                 if (!tunnelIsClient) { %>
-                    <%=request.getParameter("targetPort")%><br /><%
+                    <%=net.i2p.data.DataHelper.stripHTML(request.getParameter("targetPort"))%><br /><%
                 }
                 if (tunnelIsClient || "httpbidirserver".equals(tunnelType)) { %>
-                    <br /><%=request.getParameter("port")%><%
+                    <br /><%=net.i2p.data.DataHelper.stripHTML(request.getParameter("port"))%><%
                 }
                 if ((tunnelIsClient && !"streamrclient".equals(tunnelType)) || "httpbidirserver".equals(tunnelType) || "streamrserver".equals(tunnelType)) { %>
-                    <br /><%=request.getParameter("reachableBy")%><%
+                    <br /><%=net.i2p.data.DataHelper.stripHTML(request.getParameter("reachableBy"))%><%
                 } %>
                 </td></tr>
                 <tr><td><%=intl._("Tunnel auto-start")%></td><td><%

apps/routerconsole/java/src/net/i2p/router/web/CSSHelper.java

@@ -57,7 +57,7 @@ public class CSSHelper extends HelperBase {
      */
     public void setLang(String lang) {
         // Protected with nonce in css.jsi
-        if (lang != null && lang.length() > 0) {
+        if (lang != null && lang.length() > 0 && lang.length() <= 6) {
             Map m = new HashMap(2);
             int under = lang.indexOf('_');
             if (under < 0) {
@@ -105,9 +105,9 @@ public class CSSHelper extends HelperBase {
         try {
             if (Integer.parseInt(r) < MIN_REFRESH)
                 r = "" + MIN_REFRESH;
+            _context.router().saveConfig(PROP_REFRESH, r);
         } catch (Exception e) {
         }
-        _context.router().saveConfig(PROP_REFRESH, r);
     }
 
     /** @return refresh time in seconds, as a string */
@@ -117,6 +117,7 @@ public class CSSHelper extends HelperBase {
             if (Integer.parseInt(r) < MIN_REFRESH)
                 r = "" + MIN_REFRESH;
         } catch (Exception e) {
+            r = "" + MIN_REFRESH;
         }
         return r;
     }

apps/routerconsole/java/src/net/i2p/router/web/ConfigAdvancedHandler.java

@@ -21,7 +21,8 @@ public class ConfigAdvancedHandler extends FormHandler {
     @Override
     protected void processForm() {
         if (_shouldSave) {
-            saveChanges();
+            //saveChanges();
+            addFormError("Save disabled, edit the router.config file to make changes") ;
         } else {
             // noop
         }

apps/routerconsole/java/src/net/i2p/router/web/ConfigClientsHandler.java

@@ -54,7 +54,8 @@ public class ConfigClientsHandler extends FormHandler {
             return;
         }
         if (_action.equals(_("Install Plugin"))) {
-            installPlugin();
+            //installPlugin();
+            addFormError("Plugin installation disabled");
             return;
         }
         if (_action.equals(_("Update All Installed Plugins"))) {

apps/routerconsole/java/src/net/i2p/router/web/ConfigUpdateHandler.java

@@ -173,10 +173,11 @@ public class ConfigUpdateHandler extends FormHandler {
                 _newsThroughProxy = false;
             String oldURL = ConfigUpdateHelper.getNewsURL(_context);
             if ( (oldURL == null) || (!_newsURL.equals(oldURL)) ) {
-                changes.put(PROP_NEWS_URL, _newsURL);
+                //changes.put(PROP_NEWS_URL, _newsURL);
                 // this invalidates the news
-                changes.put(NewsHelper.PROP_LAST_CHECKED, "0");
+                //changes.put(NewsHelper.PROP_LAST_CHECKED, "0");
-                addFormNotice(_("Updating news URL to {0}", _newsURL));
+                //addFormNotice(_("Updating news URL to {0}", _newsURL));
+                addFormError("Changing news URL disabled");
             }
         }
         
@@ -240,8 +241,9 @@ public class ConfigUpdateHandler extends FormHandler {
         if ( (_zipURL != null) && (_zipURL.length() > 0) ) {
             String oldURL = _context.router().getConfigSetting(PROP_ZIP_URL);
             if ( (oldURL == null) || (!_zipURL.equals(oldURL)) ) {
-                changes.put(PROP_ZIP_URL, _zipURL);
+                //changes.put(PROP_ZIP_URL, _zipURL);
-                addFormNotice(_("Updating unsigned update URL to {0}", _zipURL));
+                //addFormNotice(_("Updating unsigned update URL to {0}", _zipURL));
+                addFormError("Changing unsigned update URL disabled");
             }
         }
         

apps/routerconsole/java/src/net/i2p/router/web/FormHandler.java

@@ -5,6 +5,7 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
+import net.i2p.data.DataHelper;
 import net.i2p.router.RouterContext;
 import net.i2p.util.Log;
 
@@ -50,8 +51,8 @@ public abstract class FormHandler {
         }
     }
 
-    public void setNonce(String val) { _nonce = val; }
+    public void setNonce(String val) { _nonce = DataHelper.stripHTML(val); }
-    public void setAction(String val) { _action = val; }
+    public void setAction(String val) { _action = DataHelper.stripHTML(val); }
 
     /**
      * For many forms, it's easiest just to put all the parameters here.

apps/routerconsole/java/src/net/i2p/router/web/SummaryHelper.java

@@ -818,19 +818,19 @@ public class SummaryHelper extends HelperBase {
     /* below here is stuff we need to get from summarynoframe.jsp to SummaryBarRenderer */
 
     private String _action;
-    public void setAction(String s) { _action = s; }
+    public void setAction(String s) { _action = DataHelper.stripHTML(s); }
     public String getAction() { return _action; }
 
     private String _consoleNonce;
-    public void setConsoleNonce(String s) { _consoleNonce = s; }
+    public void setConsoleNonce(String s) { _consoleNonce = DataHelper.stripHTML(s); }
     public String getConsoleNonce() { return _consoleNonce; }
 
     private String _updateNonce;
-    public void setUpdateNonce(String s) { _updateNonce = s; }
+    public void setUpdateNonce(String s) { _updateNonce = DataHelper.stripHTML(s); }
     public String getUpdateNonce() { return _updateNonce; }
 
     private String _requestURI;
-    public void setRequestURI(String s) { _requestURI = s; }
+    public void setRequestURI(String s) { _requestURI = DataHelper.stripHTML(s); }
 
     /**
      * @return non-null; "/home" if (strangely) not set by jsp

apps/routerconsole/jsp/configadvanced.jsp

@@ -24,13 +24,19 @@
 <%@include file="formhandler.jsi" %>
  <div class="configure">
  <div class="wideload">
+<!--
  <form action="" method="POST">
  <input type="hidden" name="nonce" value="<%=pageNonce%>" >
  <input type="hidden" name="action" value="blah" >
+-->
  <h3><%=intl._("Advanced I2P Configuration")%></h3>
- <textarea rows="32" cols="60" name="config" wrap="off" spellcheck="false"><jsp:getProperty name="advancedhelper" property="settings" /></textarea><br><hr>
+ <textarea rows="32" cols="60" name="config" wrap="off" spellcheck="false" readonly="readonly"><jsp:getProperty name="advancedhelper" property="settings" /></textarea><br><hr>
+<!--
       <div class="formaction">
         <input type="reset" class="cancel" value="<%=intl._("Cancel")%>" >
         <input type="submit" name="shouldsave" class="accept" value="<%=intl._("Save changes")%>" >
  <br><b><%=intl._("NOTE")%>:</b> <%=intl._("Some changes may require a restart to take effect.")%>
- </div></form></div></div></div></body></html>
+ </div></form>
+-->
+To make changes, edit the router.config file.
+</div></div></div></body></html>

apps/routerconsole/jsp/configclients.jsp

@@ -117,6 +117,7 @@ input.default { width: 1px; height: 1px; visibility: hidden; }
  <input type="submit" name="action" class="accept" value="<%=intl._("Save Plugin Configuration")%>" />
 </div></form></div>
 
+<!--
 <h3><a name="plugin"></a><%=intl._("Plugin Installation")%></h3><p>
  <%=intl._("Look for available plugins on {0}.", "<a href=\"http://plugins.i2p\">plugins.i2p</a>")%>
  <%=intl._("To install a plugin, enter the download URL:")%>
@@ -132,5 +133,6 @@ input.default { width: 1px; height: 1px; visibility: hidden; }
 </div><hr><div class="formaction">
  <input type="submit" name="action" class="reload" value="<%=intl._("Update All Installed Plugins")%>" />
  </div></form></div>
+-->
 <% } %>
 </div></div></body></html>

apps/routerconsole/jsp/configupdate.jsp

@@ -41,7 +41,7 @@
             <% } %></td></tr>
         <tr><td colspan="2"><br></td></tr>
         <tr><td class="mediumtags" align="right"><b><%=intl._("News URL")%>:</b></td>
-          <td><input type="text" size="60" name="newsURL" value="<jsp:getProperty name="updatehelper" property="newsURL" />"></td>
+          <td><input type="text" size="60" name="newsURL" readonly="readonly" value="<jsp:getProperty name="updatehelper" property="newsURL" />"></td>
         </tr><tr><td class="mediumtags" align="right"><b><%=intl._("Refresh frequency")%>:</b>
           <td><jsp:getProperty name="updatehelper" property="refreshFrequencySelectBox" /></td></tr>
     <% if (updatehelper.canInstall()) { %>
@@ -65,10 +65,12 @@
         </tr><tr><td class="mediumtags" align="right"><b><%=intl._("Trusted keys")%>:</b></td>
           <td><textarea cols="60" rows="6" name="trustedKeys" wrap="off" spellcheck="false"><jsp:getProperty name="updatehelper" property="trustedKeys" /></textarea></td></tr>
       <% }   // if isAdvanced %>
+<!--
         <tr><td id="unsignedbuild" class="mediumtags" align="right"><b><%=intl._("Update with unsigned development builds?")%></b></td>
           <td><jsp:getProperty name="updatehelper" property="updateUnsigned" /></td>
         </tr><tr><td class="mediumtags" align="right"><b><%=intl._("Unsigned Build URL")%>:</b></td>
           <td><input type="text" size="60" name="zipURL" value="<jsp:getProperty name="updatehelper" property="zipURL" />"></td></tr>
+-->
     <% } else { %>
         <tr><td class="mediumtags" align="center" colspan="2"><b><%=intl._("Updates will be dispatched via your package manager.")%></b></td></tr>
     <% }   // if canInstall %>

apps/routerconsole/jsp/css.jsi

@@ -30,8 +30,11 @@
 <link rel="icon" href="<%=intl.getTheme(request.getHeader("User-Agent"))%>images/favicon.ico">
 <%
    // clickjacking
-   if (intl.shouldSendXFrame())
+   if (intl.shouldSendXFrame()) {
       response.setHeader("X-Frame-Options", "SAMEORIGIN");
+      response.setHeader("Content-Security-Policy", "default-src 'self'");
+      response.setHeader("X-XSS-Protection", "1; mode=block");
+   }
 
    String conNonceParam = request.getParameter("consoleNonce");
    if (intl.getNonce().equals(conNonceParam)) {

apps/routerconsole/jsp/summaryframe.jsp

@@ -22,12 +22,13 @@
                            "Shutdown immediately".equals(action) || "Restart immediately".equals(action);
     if (!shutdownSoon) {
         if (d == null || "".equals(d)) {
-            d = intl.getRefresh();
+            // set below
         } else {
             d = net.i2p.data.DataHelper.stripHTML(d);  // XSS
             intl.setRefresh(d);
             intl.setDisableRefresh(d);
         }
+        d = intl.getRefresh();
         // we probably don't get here if d == "0" since caught in summary.jsi, but just
         // to be sure...
         if (!intl.getDisableRefresh()) {
@@ -46,7 +47,7 @@
             long delay = 60;
             try { delay = Long.parseLong(d); } catch (NumberFormatException nfe) {}
             if (delay*1000 < timeleft + 5000)
-                out.print("<meta http-equiv=\"refresh\" content=\"" + d + ";url=/summaryframe.jsp\" >\n");
+                out.print("<meta http-equiv=\"refresh\" content=\"" + delay + ";url=/summaryframe.jsp\" >\n");
             else
                 shutdownSoon = true;
         }

apps/routerconsole/jsp/viewstat.jsp

@@ -84,9 +84,11 @@ if ( !rendered && ((rs != null) || fakeBw) ) {
  *  a huge load for a page full of graphs if there's a problem
  */
 if (!rendered) {
-    if (stat != null)
+    if (stat != null) {
+        stat = net.i2p.data.DataHelper.stripHTML(stat);
         response.sendError(403, "The stat " + stat + " is not available, it must be enabled for graphing on the stats configuration page.");
-    else
+    } else {
         response.sendError(403, "No stat specified");
+    }
 }
 %>

apps/susidns/src/java/src/i2p/susi/dns/BaseBean.java

@@ -142,7 +142,7 @@ public class BaseBean
      * @since 0.9.13 moved from subclasses
      */
     public void setAction(String action) {
-        this.action = action;
+        this.action = DataHelper.stripHTML(action);
     }
 
     /**
@@ -158,7 +158,7 @@ public class BaseBean
      * @since 0.9.13 moved from subclasses
      */
     public void setSerial(String serial) {
-        this.serial = serial;
+        this.serial = DataHelper.stripHTML(serial);
     }
 
     /**

apps/susidns/src/java/src/i2p/susi/dns/NamingServiceBean.java

@@ -30,6 +30,7 @@ import java.util.Properties;
 
 import net.i2p.client.naming.NamingService;
 import net.i2p.data.DataFormatException;
+import net.i2p.data.DataHelper;
 import net.i2p.data.Destination;
 
 /**
@@ -322,7 +323,7 @@ public class NamingServiceBean extends AddressbookBean
 	}
 
 	public void setH(String h) {
-		this.detail = h;
+		this.detail = DataHelper.stripHTML(h);
 	}
 
 	public AddressBean getLookup() {

apps/susidns/src/java/src/i2p/susi/dns/SubscriptionsBean.java

@@ -160,7 +160,7 @@ public class SubscriptionsBean extends BaseBean
 
 	public void setContent(String content) {
 		// will come from form with \r\n line endings
-		this.content = content;
+		this.content = DataHelper.stripHTML(content);
 	}
 
 	public String getContent()

apps/susidns/src/jsp/addressbook.jsp

@@ -28,6 +28,8 @@
         request.setCharacterEncoding("UTF-8");
 
     response.setHeader("X-Frame-Options", "SAMEORIGIN");
+    response.setHeader("Content-Security-Policy", "default-src 'self'");
+    response.setHeader("X-XSS-Protection", "1; mode=block");
 
 %>
 <%@page pageEncoding="UTF-8"%>

apps/susidns/src/jsp/config.jsp

@@ -28,6 +28,8 @@
         request.setCharacterEncoding("UTF-8");
 
     response.setHeader("X-Frame-Options", "SAMEORIGIN");
+    response.setHeader("Content-Security-Policy", "default-src 'self'");
+    response.setHeader("X-XSS-Protection", "1; mode=block");
 
 %>
 <%@page pageEncoding="UTF-8"%>

apps/susidns/src/jsp/details.jsp

@@ -25,6 +25,8 @@
         request.setCharacterEncoding("UTF-8");
 
     response.setHeader("X-Frame-Options", "SAMEORIGIN");
+    response.setHeader("Content-Security-Policy", "default-src 'self'");
+    response.setHeader("X-XSS-Protection", "1; mode=block");
 
 %>
 <%@page pageEncoding="UTF-8"%>
@@ -73,6 +75,7 @@
     if (detail == null) {
         %><p>No host specified</p><%
     } else {
+        detail = net.i2p.data.DataHelper.stripHTML(detail);
         i2p.susi.dns.AddressBean addr = book.getLookup();
         if (addr == null) {
             %><p>Not found: <%=detail%></p><%

apps/susidns/src/jsp/index.jsp

@@ -28,6 +28,8 @@
         request.setCharacterEncoding("UTF-8");
 
     response.setHeader("X-Frame-Options", "SAMEORIGIN");
+    response.setHeader("Content-Security-Policy", "default-src 'self'");
+    response.setHeader("X-XSS-Protection", "1; mode=block");
 
 %>
 <%@page pageEncoding="UTF-8"%>

apps/susidns/src/jsp/subscriptions.jsp

@@ -28,6 +28,8 @@
         request.setCharacterEncoding("UTF-8");
 
     response.setHeader("X-Frame-Options", "SAMEORIGIN");
+    response.setHeader("Content-Security-Policy", "default-src 'self'");
+    response.setHeader("X-XSS-Protection", "1; mode=block");
 
 %>
 <%@page pageEncoding="UTF-8"%>

apps/susimail/src/src/i2p/susi/webmail/WebMail.java

@@ -1562,6 +1562,8 @@ public class WebMail extends HttpServlet
 		httpRequest.setCharacterEncoding("UTF-8");
 		response.setCharacterEncoding("UTF-8");
                 response.setHeader("X-Frame-Options", "SAMEORIGIN");
+                response.setHeader("Content-Security-Policy", "default-src 'self'");
+                response.setHeader("X-XSS-Protection", "1; mode=block");
 		RequestWrapper request = new RequestWrapper( httpRequest );
 		
 		SessionObject sessionObject = null;

core/java/src/net/i2p/client/naming/ExecNamingService.java

@@ -57,6 +57,8 @@ public class ExecNamingService extends DummyNamingService {
      */
     public ExecNamingService(I2PAppContext context) {
         super(context);
+        // disable for now
+        throw new UnsupportedOperationException();
     }
     
     @Override

core/java/src/net/i2p/data/DataHelper.java

@@ -478,12 +478,14 @@ public class DataHelper {
                 String val = (String) entry.getValue();
                 if (name.contains("#") ||
                     name.contains("=") ||
+                    name.contains("\r") ||
                     name.contains("\n") ||
                     name.startsWith(";") ||
                     val.contains("#") ||
+                    val.contains("\r") ||
                     val.contains("\n")) {
                     if (iae == null)
-                        iae = new IllegalArgumentException("Invalid character (one of \"#;=\\n\") in key or value: \"" +
+                        iae = new IllegalArgumentException("Invalid character (one of \"#;=\\r\\n\") in key or value: \"" +
                                                            name + "\" = \"" + val + '\"');
                     continue;
                 }
@@ -1622,6 +1624,7 @@ public class DataHelper {
         if (orig == null) return "";
         String t1 = orig.replace('<', ' ');
         String rv = t1.replace('>', ' ');
+        rv = rv.replace("\"", "%22");
         return rv;
     }
 

history.txt

@@ -1,3 +1,15 @@
+2014-07-26 zzz
+ * Console:
+   - Fix several XSS issues (thx Aaron Portnoy of Exodus Intel)
+   - Add Content-Security-Policy and X-XSS-Protection headers
+   - Disable changing news feed URL from UI
+   - Disable plugin install from UI
+   - Disable setting unsigned update URL from UI
+   - Disable /configadvanced
+ * DataHelper: Disallow \r in storeProps() (thx joernchen of Phenoelit)
+ * ExecNamingService: Disable (thx joernchen of Phenoelit)
+ * Startup: Add susimail.config to migrated files
+
 2014-07-23 kytv
  * Updates to geoip.txt and geoipv6.dat.gz based on Maxmind GeoLite Country
    database from 2014-07-02.

router/java/src/net/i2p/router/RouterVersion.java

@@ -18,10 +18,10 @@ public class RouterVersion {
     /** deprecated */
     public final static String ID = "Monotone";
     public final static String VERSION = CoreVersion.VERSION;
-    public final static long BUILD = 19;
+    public final static long BUILD = 20;
 
     /** for example "-test" */
-    public final static String EXTRA = "";
+    public final static String EXTRA = "-rc";
     public final static String FULL_VERSION = VERSION + "-" + BUILD + EXTRA;
     public static void main(String args[]) {
         System.out.println("I2P Router version: " + FULL_VERSION);

router/java/src/net/i2p/router/startup/WorkingDir.java

@@ -272,10 +272,10 @@ public class WorkingDir {
         // but distros might put one in
         "addressbook,eepsite," +
         // base install - files
-        // We don't currently have a default router.config, logger.config, or webapps.config in the base distribution,
+        // We don't currently have a default router.config, logger.config, susimail.config, or webapps.config in the base distribution,
         // but distros might put one in
         "blocklist.txt,hosts.txt,i2psnark.config,i2ptunnel.config,jetty-i2psnark.xml," +
-        "logger.config,router.config,systray.config,webapps.config";
+        "logger.config,router.config,susimail.config,systray.config,webapps.config";
 
     private static boolean migrate(String list, File olddir, File todir) {
         boolean rv = true;