Omer Frenkel has submitted this change and it was merged. Change subject: core: Protect GetAttachmentServlet from response splitting attack ...................................................................... core: Protect GetAttachmentServlet from response splitting attack Current version of GetAttachmentServlet inserts given filename directly to http response header, which allows code splitting. This patch fixes it by url-encoding the given filename. Change-Id: I90dd7d95879342d70cfbb43c49d128457aebc35e Signed-off-by: Frantisek Kobzik <fkobzik(a)redhat.com&gt; Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=843410 --- M backend/manager/modules/root/src/main/java/org/ovirt/engine/core/GetAttachmentServlet.java 1 file changed, 3 insertions(+), 2 deletions(-) Approvals: Omer Frenkel: Verified; Looks good to me, approved -- To view, visit http://gerrit.ovirt.org/12671 To unsubscribe, visit http://gerrit.ovirt.org/settings Gerrit-MessageType: merged Gerrit-Change-Id: I90dd7d95879342d70cfbb43c49d128457aebc35e Gerrit-PatchSet: 3 Gerrit-Project: ovirt-engine Gerrit-Branch: master Gerrit-Owner: Frank Kobzik <fkobzik(a)redhat.com&gt; Gerrit-Reviewer: Arik Hadas <ahadas(a)redhat.com&gt; Gerrit-Reviewer: Frank Kobzik <fkobzik(a)redhat.com&gt; Gerrit-Reviewer: Omer Frenkel <ofrenkel(a)redhat.com&gt; Gerrit-Reviewer: Tomas Jelinek <tjelinek(a)redhat.com&gt; Gerrit-Reviewer: Vojtech Szocs <vszocs(a)redhat.com&gt;