Source:
<code>public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For")); log.debug("*** servlets.ChangeUsername ***"); request.setCharacterEncoding("UTF-8"); HttpSession ses = request.getSession(true); if (Validate.validateSession(ses)) { ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), ses.getAttribute("userName").toString()); log.debug("Current username: " + ses.getAttribute("userName").toString()); Cookie tokenCookie = Validate.getToken(request.getCookies()); Object tokenParmeter = request.getParameter("csrfToken"); if (Validate.validateTokens(tokenCookie, tokenParmeter)) { log.debug("Getting Parameters"); String userName = (String) ses.getAttribute("userName"); String newUsername = (String) request.getParameter("newUsername"); String ApplicationRoot = getServletContext().getRealPath(""); log.debug("New username: " + newUsername); boolean validUsername = false; validUsername = newUsername.length() > 3 && newUsername.length() <= 32; if (validUsername) { log.debug("New username passed validation! Username Change gets the go ahead"); Setter.updateUsername(ApplicationRoot, userName, newUsername); ses.setAttribute("ChangeUsername", "false"); <START> ses.setAttribute("userName", newUsername); <END> log.debug("Username changed"); response.sendRedirect("index.jsp"); } else { log.error("Invalid Username Submitted (Too Short/Long)"); ses.setAttribute("errorMessage", "Invalid Username! Please try again."); response.sendRedirect("index.jsp"); } } else { log.error("CSRF Attack Detected"); } } else { log.error("Change Username Function Called with no valid session"); response.sendRedirect("index.jsp"); } log.debug("*** END ChangeUsername ***"); }</code><technical_language>newUsername escaped for html is put in userName session attribute, similarly is set in index.html; Encode.forHtml();</technical_language>

Target:
public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For")); log.debug("*** servlets.ChangeUsername ***"); request.setCharacterEncoding("UTF-8"); HttpSession ses = request.getSession(true); if (Validate.validateSession(ses)) { ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), ses.getAttribute("userName").toString()); log.debug("Current username: " + ses.getAttribute("userName").toString()); Cookie tokenCookie = Validate.getToken(request.getCookies()); Object tokenParmeter = request.getParameter("csrfToken"); if (Validate.validateTokens(tokenCookie, tokenParmeter)) { log.debug("Getting Parameters"); String userName = (String) ses.getAttribute("userName"); String newUsername = Encode.forHtml((String) request.getParameter("newUsername")); String ApplicationRoot = getServletContext().getRealPath(""); log.debug("New username: " + newUsername); boolean validUsername = false; validUsername = newUsername.length() > 3 && newUsername.length() <= 32; if (validUsername) { log.debug("New username passed validation! Username Change gets the go ahead"); Setter.updateUsername(ApplicationRoot, userName, newUsername); ses.setAttribute("ChangeUsername", "false"); ses.setAttribute("userName", newUsername); log.debug("Username changed"); response.sendRedirect("index.jsp"); } else { log.error("Invalid Username Submitted (Too Short/Long)"); ses.setAttribute("errorMessage", "Invalid Username! Please try again."); response.sendRedirect("index.jsp"); } } else { log.error("CSRF Attack Detected"); } } else { log.error("Change Username Function Called with no valid session"); response.sendRedirect("index.jsp"); } log.debug("*** END ChangeUsername ***"); }