Merge pull request #98 from mendix/backport/fix/xss

Fix for XSS vunerability in rest page footer

Author: grbinho

DIST/RestServices_mx7_4.2.3.mpk

@@ -20,7 +20,7 @@ public class RestServices {
 	/**
 	 * Version of the RestServices module
 	 */
-	public static final String VERSION = "4.2.2";
+	public static final String VERSION = "4.2.3";
 
 	/**
 	 * Amount of objects that are processed by the module at the same time.

RestServices.mpr

@@ -27,6 +27,8 @@
 import com.mendix.systemwideinterfaces.core.meta.IMetaPrimitive;
 import com.mendix.systemwideinterfaces.core.meta.IMetaPrimitive.PrimitiveType;
 
+import org.owasp.encoder.Encode;
+
 public class Utils {
 
 	public static String getShortMemberName(String memberName) {
@@ -179,7 +181,8 @@ public static String nullToEmpty(String statusText) {
 	}
 
 	public static String getRequestUrl(HttpServletRequest request) {
-		return request.getRequestURL().toString() + (Utils.isEmpty(request.getQueryString()) ? "" : "?" + request.getQueryString());
+		String queryString = Encode.forUriComponent(request.getQueryString());
+		return request.getRequestURL().toString() + (Utils.isEmpty(queryString) ? "" : "?" + queryString);
 	}
 
 	public static boolean isSystemAttribute(String key) {