HDFS-998. Quote blocks streamed through jsps.

git-svn-id: https://svn.apache.org/repos/asf/hadoop/hdfs/trunk@919668 13f79535-47bb-0310-9956-ffa450edef68

CHANGES.txt

@@ -83,6 +83,8 @@ Trunk (unreleased changes)
     HDFS-994. Allow fetching of delegation token from NameNode for hftp.
     (Jakob Homan via acmurthy) 
 
+    HDFS-998. Quote blocks streamed through jsps. (cdouglas)
+
   OPTIMIZATIONS
 
     HDFS-946. NameNode should not return full path name when lisitng a

src/java/org/apache/hadoop/hdfs/server/common/JspHelper.java

@@ -45,6 +45,7 @@ import org.apache.hadoop.hdfs.security.BlockAccessToken;
 import org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenIdentifier;
 import org.apache.hadoop.hdfs.server.datanode.DatanodeJspHelper;
 import org.apache.hadoop.hdfs.server.namenode.DatanodeDescriptor;
+import org.apache.hadoop.http.HtmlQuoting;
 import org.apache.hadoop.io.WritableUtils;
 import org.apache.hadoop.net.NetUtils;
 import org.apache.hadoop.security.AccessControlException;
@@ -146,7 +147,7 @@ public class JspHelper {
     }
     blockReader = null;
     s.close();
-    out.print(new String(buf));
+    out.print(HtmlQuoting.quoteHtmlChars(new String(buf)));
   }
 
   public static void addTableHeader(JspWriter out) throws IOException {
@@ -431,4 +432,4 @@ public class JspHelper {
   }
 
 
-}
+}