diff --git a/apps/jetty/java/src/net/i2p/servlet/filters/XSSRequestWrapper.java b/apps/jetty/java/src/net/i2p/servlet/filters/XSSRequestWrapper.java index c15c94b849bc616dfee2cd31f940799d40700beb..93228079bdf8252e1208abaaa11da2b1d1ac6633 100644 --- a/apps/jetty/java/src/net/i2p/servlet/filters/XSSRequestWrapper.java +++ b/apps/jetty/java/src/net/i2p/servlet/filters/XSSRequestWrapper.java @@ -7,6 +7,9 @@ import javax.servlet.http.HttpServletRequestWrapper; //import org.owasp.esapi.ESAPI; +import net.i2p.I2PAppContext; +import net.i2p.util.Log; + public class XSSRequestWrapper extends HttpServletRequestWrapper { // Adapted from https://owasp-esapi-java.googlecode.com/svn/trunk/configuration/esapi/ESAPI.properties private static Pattern parameterValuePattern = Pattern.compile("^[a-zA-Z0-9.,:\\-\\/+=@_ \r\n]*$"); @@ -36,14 +39,23 @@ public class XSSRequestWrapper extends HttpServletRequestWrapper { @Override public String getParameter(String parameter) { String value = super.getParameter(parameter); - - return stripXSS(value, parameterValuePattern); + String rv = stripXSS(value, parameterValuePattern); + if (value != null && rv == null) { + Log log = I2PAppContext.getGlobalContext().logManager().getLog(XSSRequestWrapper.class); + log.logAlways(Log.WARN, "URL \"" + getServletPath() + "\" Stripped param \"" + parameter + "\" : \"" + value + '"'); + } + return rv; } @Override public String getHeader(String name) { String value = super.getHeader(name); - return stripXSS(value, headerValuePattern); + String rv = stripXSS(value, headerValuePattern); + if (value != null && rv == null) { + Log log = I2PAppContext.getGlobalContext().logManager().getLog(XSSRequestWrapper.class); + log.logAlways(Log.WARN, "URL \"" + getServletPath() + "\" Stripped header \"" + name + "\" : \"" + value + '"'); + } + return rv; } private String stripXSS(String value, Pattern whitelistPattern) { diff --git a/router/java/src/net/i2p/router/RouterVersion.java b/router/java/src/net/i2p/router/RouterVersion.java index 601535dbe67ba1041e3cbf512b3420489cd8bf41..a85b0c8aa2faad9a57c47d199b308409e19bf19d 100644 --- a/router/java/src/net/i2p/router/RouterVersion.java +++ b/router/java/src/net/i2p/router/RouterVersion.java @@ -18,7 +18,7 @@ public class RouterVersion { /** deprecated */ public final static String ID = "Monotone"; public final static String VERSION = CoreVersion.VERSION; - public final static long BUILD = 21; + public final static long BUILD = 22; /** for example "-test" */ public final static String EXTRA = "-rc";