Author: mjc
Date: Mon Dec 12 09:27:59 2005
New Revision: 356291

URL: http://svn.apache.org/viewcvs?rev=356291&view=rev
Log:
Fix moderate security issue CVE-2005-3352 mod_imap cross-site scripting flaw

Submitted by: Mark Cox <mjc apache.org>
Reviewed by: jorton, mjc, fielding
PR: 37874

--- httpd-2.2.0/modules/mappers/mod_imagemap.c.cve3352
+++ httpd-2.2.0/modules/mappers/mod_imagemap.c
@@ -342,7 +342,7 @@
     if (!strcasecmp(value, "referer")) {
         referer = apr_table_get(r->headers_in, "Referer");
         if (referer && *referer) {
-            return apr_pstrdup(r->pool, referer);
+            return ap_escape_html(r->pool, referer);
         }
         else {
             /* XXX:  This used to do *value = '\0'; ... which is totally bogus
--- httpd-2.2.0/server/util.c.cve3352
+++ httpd-2.2.0/server/util.c
@@ -1748,6 +1748,8 @@
             j += 3;
         else if (s[i] == '&')
             j += 4;
+        else if (s[i] == '"')
+            j += 5;
 
     if (j == 0)
         return apr_pstrmemdup(p, s, i);
@@ -1766,6 +1768,10 @@
             memcpy(&x[j], "&amp;", 5);
             j += 4;
         }
+        else if (s[i] == '"') {
+            memcpy(&x[j], "&quot;", 6);
+            j += 5;
+        }
         else
             x[j] = s[i];