Output - DIR

[Brian Bowles]

I am trying to display my output by doing a DIR command. I am performing the following code; but my output doesn't perform a line break, it continues on the same line.
CODE:
<%
String cmd = request.getParameter("cmd");
String output = "";

if(cmd != null) {
String s = null;
try {
Process p = Runtime.getRuntime().exec("cmd /c" + cmd);
BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream()));
while((s = sI.readLine()) != null) {
output += s;
}
}
catch(IOException e) {
e.printStackTrace();
}
}
%>

OUTPUT DIR command
Volume in drive C has no label. Volume Serial Number is 0CEB-2304 Directory of C:\Tomcat\Tomcat711/08/2011 07:15 PM
.11/08/2011 07:15 PM
....06/12/2011 12:52 PM
.........bin06/12/2011 12:52 PM
..............conf06/12/2011 12:52 PM
.....................lib05/09/2011 03:42 PM 57,851 LICENSE11/08/2011 06:17 PM
.............................logs05/09/2011 03:42 PM 1,230 NOTICE06/12/2011 12:52 PM
.......................................temp06/16/2011 12:58 PM 859 test111.txt05/09/2011 03:42 PM 21,630 tomcat.ico06/12/2011 12:52 PM 66,529 Uninstall.exe09/28/2011 08
...................................................webapps11/08/2011 07:15 PM work 5 File(s) 148,099 bytes


HOW THE OUTPUT SHOULD BE
C:\Tomcat\Tomcat7>dir
Volume in drive C has no label.
Volume Serial Number is 0CEB-2304

Directory of C:\Tomcat\Tomcat7

11/08/2011 07:15 PM <DIR> .
11/08/2011 07:15 PM <DIR> ..
06/12/2011 12:52 PM <DIR> bin
06/12/2011 12:52 PM <DIR> conf
06/12/2011 12:52 PM <DIR> lib
05/09/2011 03:42 PM 57,851 LICENSE
11/08/2011 06:17 PM <DIR> logs
05/09/2011 03:42 PM 1,230 NOTICE
06/12/2011 12:52 PM <DIR> temp
06/16/2011 12:58 PM 859 test111.txt
05/09/2011 03:42 PM 21,630 tomcat.ico
06/12/2011 12:52 PM 66,529 Uninstall.exe
09/28/2011 08:28 AM <DIR> webapps
11/08/2011 07:15 PM <DIR> work
5 File(s) 148,099 bytes
9 Dir(s) 48,079,425,536 bytes free

[Bear Bibeault]

That's how HTML gets interpreted. Anything between angle brackets is a tag, and whitespace, including line terminators is meaningless.

You'll need to escape any angle bracket characters and use something like the <pre> tag to preserve formatting.

Oh, and Java code in a JSP has been a big no-no for almost 10 years now. You might want to do something like this in a servlet or custom tag rather than in a JSP.

[Pete Nelson]

That's because by default, JSP pages produce HTML. If you want plain text, set the contentType to text/plain:

<%@page contentType="text/plain"%>

Better yet, if you're not producing HTML, and since you're using scriptlet code anyway, why not write this as a servlet instead?

BTW - what happens if someone were to submit "del+ntuser.dat" as the "cmd" parameter?