Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Oracle Portal 10g HTTP Response Splitting
From: majororacle () gmail com
Date: 21 Dec 2006 21:18:53 -0000

This also occurs in Portal 9.0.2 in the file calendar.jsp, calendarDialog.jsp, and fred.jsp, all of which are under the 
$ORACLE_HOME/j2ee directory in various locations.  The offending code is 
  String enc = request.getParameter("enc");
  if ((enc == null) || "".equals(enc))
    response.setContentType("text/html");
  else
   response.setContentType("text/html;charset=" + enc);

which can be commented out as follows:

//  String enc = request.getParameter("enc");
//  if ((enc == null) || "".equals(enc))
    response.setContentType("text/html");
//  else
//    response.setContentType("text/html;charset=" + enc);


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault