anchor.diff:      String url = "/opennms/rest/heatmap/";
   
       if (request.getParameterMap().containsKey("mode")) {
  -        mode = request.getParameter("mode");
  +        mode = WebSecurityUtils.sanitizeString(request.getParameter("mode"));
       }
   
       if (request.getParameterMap().containsKey("heatmap")) {
  -        heatmap = request.getParameter("heatmap");
  +        heatmap = WebSecurityUtils.sanitizeString(request.getParameter("heatmap"));
       }
   
       if ("services".equals(heatmap)) {
  
positive.code:     url += mode + "/" + heatmap + "/";
  
      if ("nodesByForeignSource".equals(heatmap)) {
          foreignSource = request.getParameter("foreignSource");
          url += foreignSource;
          title += " (Nodes by ForeignSource '" + foreignSource + "')";
      }
  
      if ("nodesByCategory".equals(heatmap)) {
          category = request.getParameter("category");
          url += category;
          title += " (Nodes by Category '" + category + "')";
      }
  
      if ("nodesByMonitoredService".equals(heatmap)) {
          monitoredService = request.getParameter("monitoredService");
          url += monitoredService;
          title += " (Nodes by Service '" +monitoredService + "')";
      }
  
negative.code: <%@ page import="org.opennms.core.utils.WebSecurityUtils" %><%--
  /*******************************************************************************
   * This file is part of OpenNMS(R).
   *
  