You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ra...@apache.org on 2020/01/22 15:18:30 UTC
[sling-org-apache-sling-xss] branch master updated: SLING-9019 -
The XSSFilter will mark URLs containing both escaped characters and HTML
entities as invalid
This is an automated email from the ASF dual-hosted git repository.
radu pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
The following commit(s) were added to refs/heads/master by this push:
new f8f046b SLING-9019 - The XSSFilter will mark URLs containing both escaped characters and HTML entities as invalid
f8f046b is described below
commit f8f046b274e77a303ed902e5515176eac1627750
Author: Radu Cotescu <ra...@apache.org>
AuthorDate: Wed Jan 22 15:54:41 2020 +0100
SLING-9019 - The XSSFilter will mark URLs containing both escaped characters and HTML entities as invalid
* switched from unescaping all XML entities + unicode encoded characters to only unescaping unicode
encoded characters
---
src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java | 13 +++++++------
src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java | 4 ++++
2 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java b/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
index ad9e5cd..c46bab2 100644
--- a/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
+++ b/src/main/java/org/apache/sling/xss/impl/XSSFilterImpl.java
@@ -26,8 +26,8 @@ import java.util.Hashtable;
import java.util.List;
import java.util.regex.Pattern;
-import org.apache.commons.lang3.StringEscapeUtils;
import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.text.translate.NumericEntityUnescaper;
import org.apache.sling.api.resource.LoginException;
import org.apache.sling.api.resource.Resource;
import org.apache.sling.api.resource.ResourceResolver;
@@ -201,15 +201,16 @@ public class XSSFilterImpl implements XSSFilter {
try {
String decodedURL = URLDecoder.decode(url, StandardCharsets.UTF_8.name());
/*
- StringEscapeUtils is deprecated starting with version 3.6 of commons-lang3, however the indicated replacement comes from
+ NumericEntityEscaper is deprecated starting with version 3.6 of commons-lang3, however the indicated replacement comes from
commons-text, which is not an OSGi bundle
*/
- String xmlDecodedURL = StringEscapeUtils.unescapeXml(decodedURL);
- if (xmlDecodedURL.equals(url) || xmlDecodedURL.equals(decodedURL)) {
+ NumericEntityUnescaper unicodeUnescaper = new NumericEntityUnescaper();
+ String unicodeUnescapedUrl = unicodeUnescaper.translate(decodedURL);
+ if (unicodeUnescapedUrl.equals(url) || unicodeUnescapedUrl.equals(decodedURL)) {
return runHrefValidation(url);
}
- return runHrefValidation(xmlDecodedURL);
- } catch (Throwable e) {
+ return runHrefValidation(unicodeUnescapedUrl);
+ } catch (Exception e) {
logger.warn("Unable to validate url.", e);
logger.debug("URL input: {}", url);
}
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
index e480b66..ffb1701 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
@@ -221,6 +221,10 @@ public class XSSAPIImplTest {
// Href Expected Result
//
{
+ "http://localhost/?q=a+b&r=1",
+ "http://localhost/?q=a+b&r=1"
+ },
+ {
"/libs/wcm/core/content/sites/createlaunchwizard.html/content/launches/2019/10/11/l3/content/we-retail/language-masters/en/products/equipment?create_nested_launch=true&redirect=/sites.html/content/we-retail/language-masters/en/products/equipment#/content/launches/2019/10/11/l3/content/we-retail/language-masters/en/products/equipment/biking,/content/launches/2019/10/11/l3/content/we-retail/language-masters/en/products/equipment/hiking/buffalo-plaid-shorts,/content/laun [...]
"/libs/wcm/core/content/sites/createlaunchwizard.html/content/launches/2019/10/11/l3/content/we-retail/language-masters/en/products/equipment?create_nested_launch=true&redirect=/sites.html/content/we-retail/language-masters/en/products/equipment#/content/launches/2019/10/11/l3/content/we-retail/language-masters/en/products/equipment/biking,/content/launches/2019/10/11/l3/content/we-retail/language-masters/en/products/equipment/hiking/buffalo-plaid-shorts,/content/laun [...]
},