You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jspwiki.apache.org by al...@apache.org on 2026/06/15 21:58:44 UTC
(jspwiki) 01/01: JSPWIKI-1273 see jira for details
This is an automated email from the ASF dual-hosted git repository.
spyhunter99 pushed a commit to branch master3
in repository https://gitbox.apache.org/repos/asf/jspwiki.git
commit 8e7d775f2a4abe0b9ede1dc8dd212a7f1ecab658
Author: Alex O'Ree <al...@apache.org>
AuthorDate: Mon Jun 15 17:58:33 2026 -0400
JSPWIKI-1273 see jira for details
---
.../main/java/org/apache/wiki/plugin/Image.java | 12 +-
.../java/org/apache/wiki/plugin/ImageTest.java | 204 +++++++++++++++++++++
2 files changed, 213 insertions(+), 3 deletions(-)
diff --git a/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java b/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
index e3178af89..04c9c836c 100644
--- a/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
+++ b/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
@@ -189,7 +189,10 @@ public class Image implements Plugin {
if( link != null ) {
if( !context.getBooleanWikiProperty( MarkupParser.PROP_ALLOWHTML, false ) ) {
- if( link.startsWith( "data:" ) || link.startsWith( "javascript:" ) ) {
+ String testVal = link.toLowerCase().replaceAll("\\s+","").trim();
+ if (testVal.startsWith("data")
+ || testVal.startsWith("javascript")
+ || testVal.startsWith("vbscript")) {
link = "http://invalid_url" + link;
}
}
@@ -200,8 +203,11 @@ public class Image implements Plugin {
result.append(">");
}
- if( !context.getBooleanWikiProperty( MarkupParser.PROP_ALLOWHTML, false ) ) {
- if( src.startsWith( "data:" ) || src.startsWith( "javascript:" ) ) {
+ if(!context.getBooleanWikiProperty(MarkupParser.PROP_ALLOWHTML, false)) {
+ String testVal = src.toLowerCase().replaceAll("\\s+", "").trim();
+ if (testVal.startsWith("data")
+ || testVal.startsWith("javascript")
+ || testVal.startsWith("vbscript")) {
src = "http://invalid_url" + src;
}
}
diff --git a/jspwiki-main/src/test/java/org/apache/wiki/plugin/ImageTest.java b/jspwiki-main/src/test/java/org/apache/wiki/plugin/ImageTest.java
new file mode 100644
index 000000000..6108a22f9
--- /dev/null
+++ b/jspwiki-main/src/test/java/org/apache/wiki/plugin/ImageTest.java
@@ -0,0 +1,204 @@
+/*
+ * Copyright 2026 The Apache Software Foundation.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.wiki.plugin;
+
+import org.apache.wiki.TestEngine;
+import org.apache.wiki.render.RenderingManager;
+import org.junit.jupiter.api.Assertions;
+
+/**
+ *
+ * @author Dad
+ */
+public class ImageTest {
+
+ static TestEngine testEngine = TestEngine.build();
+
+ /**
+ * Test of execute method, of class Image.
+ */
+ @org.junit.jupiter.api.Test
+ public void mixedCase() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘JavaScript:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withSpaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘Java Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withTabSpaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withLeadingSpaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘ Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withLeading2Spaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘\tJava\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void dataurl() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘\tDATA:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void vbscripturl() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘\tVbs c ripT:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+
+
+
+ @org.junit.jupiter.api.Test
+ public void SRCmixedCase() throws Exception {
+ final String src = "[{Image src=‘JavaScript:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"));
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithSpaces() throws Exception {
+ final String src = "[{Image src=‘Java Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithTabSpaces() throws Exception {
+ final String src = "[{Image src=‘Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithLeadingSpaces() throws Exception {
+ final String src = "[{Image src=‘ Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithLeading2Spaces() throws Exception {
+ final String src = "[{Image src=‘\tJava\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void SRCdataurl() throws Exception {
+ final String src = "[{Image src=‘\tDATA:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void SRCvbscripturl() throws Exception {
+ final String src = "[{Image src=‘\tVbs c ripT:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+}