diff --git a/DynmapCore/src/main/java/org/dynmap/Client.java b/DynmapCore/src/main/java/org/dynmap/Client.java index b9d2d95e..3241be40 100644 --- a/DynmapCore/src/main/java/org/dynmap/Client.java +++ b/DynmapCore/src/main/java/org/dynmap/Client.java @@ -325,6 +325,9 @@ public class Client { case '>': str.append(">"); break; + case '\'': + str.append("'"); + break; default: str.append(c); break; diff --git a/DynmapCore/src/main/java/org/dynmap/markers/impl/AreaMarkerImpl.java b/DynmapCore/src/main/java/org/dynmap/markers/impl/AreaMarkerImpl.java index 265451af..53d327d0 100644 --- a/DynmapCore/src/main/java/org/dynmap/markers/impl/AreaMarkerImpl.java +++ b/DynmapCore/src/main/java/org/dynmap/markers/impl/AreaMarkerImpl.java @@ -120,8 +120,8 @@ class AreaMarkerImpl implements AreaMarker, EnterExitMarker { * @param node - configuration node */ boolean loadPersistentData(ConfigurationNode node) { - label = node.getString("label", markerid); markup = node.getBoolean("markup", false); + label = MarkerAPIImpl.escapeForHTMLIfNeeded(node.getString("label", markerid), markup); ytop = node.getDouble("ytop", 64.0); ybottom = node.getDouble("ybottom", 64.0); List xx = node.getList("x"); diff --git a/DynmapCore/src/main/java/org/dynmap/markers/impl/CircleMarkerImpl.java b/DynmapCore/src/main/java/org/dynmap/markers/impl/CircleMarkerImpl.java index ce2b4a7e..afe534a0 100644 --- a/DynmapCore/src/main/java/org/dynmap/markers/impl/CircleMarkerImpl.java +++ b/DynmapCore/src/main/java/org/dynmap/markers/impl/CircleMarkerImpl.java @@ -102,8 +102,8 @@ class CircleMarkerImpl implements CircleMarker, EnterExitMarker { * @param node - configuration node */ boolean loadPersistentData(ConfigurationNode node) { - label = node.getString("label", markerid); markup = node.getBoolean("markup", false); + label = MarkerAPIImpl.escapeForHTMLIfNeeded(node.getString("label", markerid), markup); world = node.getString("world", "world"); normalized_world = DynmapWorld.normalizeWorldName(world); x = node.getDouble("x", 0); diff --git a/DynmapCore/src/main/java/org/dynmap/markers/impl/MarkerAPIImpl.java b/DynmapCore/src/main/java/org/dynmap/markers/impl/MarkerAPIImpl.java index c4d1e34d..65de8208 100644 --- a/DynmapCore/src/main/java/org/dynmap/markers/impl/MarkerAPIImpl.java +++ b/DynmapCore/src/main/java/org/dynmap/markers/impl/MarkerAPIImpl.java @@ -3558,4 +3558,22 @@ public class MarkerAPIImpl implements MarkerAPI, Event.Listener { ms.addEnteredMarkers(entered, worldid, x, y, z); } } + /** + * Check if loaded string needs to be escaped (if non-markup) + */ + public static String escapeForHTMLIfNeeded(String txt, boolean markup) { + if (markup) return txt; // Not needed for markup + // If escaped properly, these characters aren't present (all but ampersand of HTML active characrers + if (txt != null) { + if ((txt.indexOf('<') >= 0) || (txt.indexOf('>') >= 0) || (txt.indexOf('\'') >= 0) || (txt.indexOf('"') >= 0)) { + return Client.encodeForHTML(txt); + } + // If ampersand without semicolon after (simplistic check for ampersand without being escape sequence) + int idx = txt.lastIndexOf('&'); + if ((idx >= 0) && (txt.indexOf(';', idx) < 0)) { + return Client.encodeForHTML(txt); + } + } + return txt; + } } diff --git a/DynmapCore/src/main/java/org/dynmap/markers/impl/MarkerImpl.java b/DynmapCore/src/main/java/org/dynmap/markers/impl/MarkerImpl.java index 17bed676..c469d37a 100644 --- a/DynmapCore/src/main/java/org/dynmap/markers/impl/MarkerImpl.java +++ b/DynmapCore/src/main/java/org/dynmap/markers/impl/MarkerImpl.java @@ -76,8 +76,8 @@ class MarkerImpl implements Marker { * @param node - configuration node */ boolean loadPersistentData(ConfigurationNode node) { - label = node.getString("label", markerid); markup = node.getBoolean("markup", false); + label = MarkerAPIImpl.escapeForHTMLIfNeeded(node.getString("label", markerid), markup); x = node.getDouble("x", 0); y = node.getDouble("y", 64); z = node.getDouble("z", 0); diff --git a/DynmapCore/src/main/java/org/dynmap/markers/impl/PolyLineMarkerImpl.java b/DynmapCore/src/main/java/org/dynmap/markers/impl/PolyLineMarkerImpl.java index 07ca4010..f49856e8 100644 --- a/DynmapCore/src/main/java/org/dynmap/markers/impl/PolyLineMarkerImpl.java +++ b/DynmapCore/src/main/java/org/dynmap/markers/impl/PolyLineMarkerImpl.java @@ -87,8 +87,8 @@ class PolyLineMarkerImpl implements PolyLineMarker { * @param node - configuration node */ boolean loadPersistentData(ConfigurationNode node) { - label = node.getString("label", markerid); markup = node.getBoolean("markup", false); + label = MarkerAPIImpl.escapeForHTMLIfNeeded(node.getString("label", markerid), markup); List xx = node.getList("x"); List yy = node.getList("y"); List zz = node.getList("z");