Merge pull request #97 from mendix/fix/xss

Fixed reported XSS vulnerability where url parameters were not encoded in html footer.

Author: grbinho

DIST/RestServices_mx7_5.0.1.mpk

@@ -20,7 +20,7 @@ public class RestServices {
 	/**
 	 * Version of the RestServices module
 	 */
-	public static final String VERSION = "5.0.0";
+	public static final String VERSION = "5.0.1";
 
 	/**
 	 * Amount of objects that are processed by the module at the same time.

RestServices.mpr

@@ -27,6 +27,8 @@
 import com.mendix.systemwideinterfaces.core.meta.IMetaPrimitive;
 import com.mendix.systemwideinterfaces.core.meta.IMetaPrimitive.PrimitiveType;
 
+import org.owasp.encoder.Encode;
+
 public class Utils {
 
 	public static String getShortMemberName(String memberName) {
@@ -177,9 +179,10 @@ public static String removeLeadingAndTrailingSlash(String relativeUrl) {
 	public static String nullToEmpty(String statusText) {
 		return statusText == null ? "" : statusText;
 	}
-
+	
 	public static String getRequestUrl(HttpServletRequest request) {
-		return request.getRequestURL().toString() + (Utils.isEmpty(request.getQueryString()) ? "" : "?" + request.getQueryString());
+		String queryString = Encode.forUriComponent(request.getQueryString());
+		return request.getRequestURL().toString() + (Utils.isEmpty(queryString) ? "" : "?" + queryString);
 	}
 
 	public static boolean isSystemAttribute(String key) {