You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@roller.apache.org by GitBox <gi...@apache.org> on 2021/03/22 02:21:13 UTC
[GitHub] [roller] mbien opened a new pull request #84: Use weblog.getHandle() instead of client provided String.
mbien opened a new pull request #84:
URL: https://github.com/apache/roller/pull/84
Although the handle variable is used for the reply, prior to that, getWeblogByHandle(handle) is called. This should throw an exception and return 500 if the weblog does not exist and/or is invalid, without posting any json back.
Changing "handle" to weblog.getHandle() would probably make the code scanner happy and make it also clearer that the weblog instance is valid at this point in the code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [roller] mbien merged pull request #84: Improve input validation
Posted by GitBox <gi...@apache.org>.
mbien merged pull request #84:
URL: https://github.com/apache/roller/pull/84
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@roller.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [roller] mbien commented on pull request #84: Improve input validation
Posted by GitBox <gi...@apache.org>.
mbien commented on pull request #84:
URL: https://github.com/apache/roller/pull/84#issuecomment-873671658
thank you for the review @snoopdave
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@roller.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [roller] snoopdave commented on pull request #84: Improve input validation
Posted by GitBox <gi...@apache.org>.
snoopdave commented on pull request #84:
URL: https://github.com/apache/roller/pull/84#issuecomment-873665571
Lot's of good changes here. I went through commit-by-commit and did not see any problems.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@roller.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [roller] mbien commented on pull request #84: Improve input validation
Posted by GitBox <gi...@apache.org>.
mbien commented on pull request #84:
URL: https://github.com/apache/roller/pull/84#issuecomment-853064754
force pushed
* switched from owasp encoder to commons StringEscapeUtils.escape* - no need to add another library for this simple usecase
* validation is currently fairly strict (too strict?) and enforces alphanumeric Strings for blog handles, params and similar tokens
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [roller] mbien commented on a change in pull request #84: Improve input validation
Posted by GitBox <gi...@apache.org>.
mbien commented on a change in pull request #84:
URL: https://github.com/apache/roller/pull/84#discussion_r646140410
##########
File path: app/src/main/java/org/apache/roller/weblogger/webservices/tagdata/TagDataServlet.java
##########
@@ -70,36 +72,56 @@ public void doGet(
HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
- String[] pathInfo = new String[0];
- boolean siteWide;
- String handle;
- String prefix;
- String format = "json";
- int page = 0;
-
// TODO: last modified or ETag support, caching, etc.
+ String[] pathInfo = new String[0];
+
if (request.getPathInfo() != null) {
pathInfo = Utilities.stringToStringArray(request.getPathInfo(),"/");
}
+
+ boolean siteWide;
+ String handle;
+
if (pathInfo.length == 0) {
siteWide = true;
// we'll use the front-page weblog to form URLs
handle = WebloggerRuntimeConfig.getProperty("site.frontpage.weblog.handle");
- } else if (pathInfo.length == 2 && "weblog".equals(pathInfo[0])) {
+ } else if (pathInfo.length == 2 && "weblog".equals(pathInfo[0]) && StringUtils.isAlphanumeric(pathInfo[1])) {
siteWide = false;
handle = pathInfo[1];
} else {
response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Malformed URL");
return;
}
- prefix = request.getParameter("prefix");
+
+ String prefix = request.getParameter("prefix");
+
+ if(prefix != null && !StringUtils.isAlphanumeric(prefix)) {
+ response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Malformed URL");
+ return;
+ }
+
+ String format = "json"; // default
+
if (request.getParameter("format") != null) {
+
format = request.getParameter("format");
+ if(!format.equals("json") || !format.equals("xml")) {
+ response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Malformed URL");
+ return;
Review comment:
todo: this should be && not ||
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org