BugTraq
Re: Oracle Portal 10g HTTP Response Splitting Dec 21 2006 09:18PM
majororacle gmail com
This also occurs in Portal 9.0.2 in the file calendar.jsp, calendarDialog.jsp, and fred.jsp, all of which are under the $ORACLE_HOME/j2ee directory in various locations. The offending code is
String enc = request.getParameter("enc");
if ((enc == null) || "".equals(enc))
response.setContentType("text/html");
else
response.setContentType("text/html;charset=" + enc);

which can be commented out as follows:

// String enc = request.getParameter("enc");
// if ((enc == null) || "".equals(enc))
response.setContentType("text/html");
// else
// response.setContentType("text/html;charset=" + enc);

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus