# Backport patch for upstream Eclipse BZ: 329582 (XSS attack)
--- plugins/org.eclipse.help.webapp/advanced/content.jsp.orig	2010-04-21 14:00:16.000000000 -0400
+++ plugins/org.eclipse.help.webapp/advanced/content.jsp	2010-12-10 09:41:14.642196217 -0500
@@ -45,7 +45,7 @@
 
 </head>
     <frameset id="contentFrameset" rows="<%=frameData.getContentAreaFrameSizes()%>" frameborder=0" framespacing="0" border="0" spacing="0">
-	<frame name="ContentToolbarFrame" title="<%=ServletResources.getString("topicViewToolbar", request)%>" src='<%="contentToolbar.jsp"+data.getQuery()%>'  marginwidth="0" marginheight="0" scrolling="no" frameborder="0" >
+	<frame name="ContentToolbarFrame" title="<%=ServletResources.getString("topicViewToolbar", request)%>" src='<%="contentToolbar.jsp"+UrlUtil.htmlEncode(data.getQuery())%>'  marginwidth="0" marginheight="0" scrolling="no" frameborder="0" >
 	<frame ACCESSKEY="K" name="ContentViewFrame" title="<%=ServletResources.getString("topicView", request)%>" src='<%=UrlUtil.htmlEncode(data.getContentURL())%>'  marginwidth="10"<%=(data.isIE() && "6.0".compareTo(data.getIEVersion()) <=0)?"scrolling=\"yes\"":""%> marginheight="0" frameborder="0" >
 	<%
 	    AbstractFrame[] frames = frameData.getFrames(AbstractFrame.BELOW_CONTENT);
--- plugins/org.eclipse.help.webapp/basic/index.jsp.orig	2010-04-21 14:00:17.000000000 -0400
+++ plugins/org.eclipse.help.webapp/basic/index.jsp	2010-12-10 09:42:58.516317455 -0500
@@ -29,8 +29,8 @@
 <%
 	}
 %>
-	<frame name="TabsFrame" title="<%=ServletResources.getString("helpToolbarFrame", request)%>" src='<%="basic/tabs.jsp"+data.getQuery()%>' marginwidth="5" marginheight="5" scrolling="no">
-	<frame name="HelpFrame" title="<%=ServletResources.getString("ignore", "HelpFrame", request)%>" src='<%="basic/help.jsp"+data.getQuery()%>' frameborder="no" marginwidth="0" marginheight="0" scrolling="no">
+	<frame name="TabsFrame" title="<%=ServletResources.getString("helpToolbarFrame", request)%>" src='<%="basic/tabs.jsp"+UrlUtil.htmlEncode(data.getQuery())%>' marginwidth="5" marginheight="5" scrolling="no">
+	<frame name="HelpFrame" title="<%=ServletResources.getString("ignore", "HelpFrame", request)%>" src='<%="basic/help.jsp"+UrlUtil.htmlEncode(data.getQuery())%>' frameborder="no" marginwidth="0" marginheight="0" scrolling="no">
 <%
 	if(!("0".equals(data.getFooterHeight()))){
 %>