svn commit: r956760 - /geronimo/server/branches/2.2/plugins/console/console-filter/src/main/java/org/apache/geronimo/console/filter/XSSHandler.java

[rw...@apache.org]

Author: rwonly
Date: Tue Jun 22 01:37:37 2010
New Revision: 956760

URL: http://svn.apache.org/viewvc?rev=956760&view=rev
Log:
GERONIMO-5384 Geronimo console doesn't seem to handle % in sql statements right.

Modified:
    geronimo/server/branches/2.2/plugins/console/console-filter/src/main/java/org/apache/geronimo/console/filter/XSSHandler.java

Modified: geronimo/server/branches/2.2/plugins/console/console-filter/src/main/java/org/apache/geronimo/console/filter/XSSHandler.java
URL: http://svn.apache.org/viewvc/geronimo/server/branches/2.2/plugins/console/console-filter/src/main/java/org/apache/geronimo/console/filter/XSSHandler.java?rev=956760&r1=956759&r2=956760&view=diff
==============================================================================
--- geronimo/server/branches/2.2/plugins/console/console-filter/src/main/java/org/apache/geronimo/console/filter/XSSHandler.java (original)
+++ geronimo/server/branches/2.2/plugins/console/console-filter/src/main/java/org/apache/geronimo/console/filter/XSSHandler.java Tue Jun 22 01:37:37 2010
@@ -78,7 +78,7 @@ public class XSSHandler {
                 // these parameter value(s) which can allow < and " usage
                 String[] vals = hreq.getParameterValues(name);
                 for (String value : vals) {
-                    if (isInvalidParam(value)) {
+                    if (isInvalidParamLmt(value)) {
                         // should be safe to log the uri, as we've already run isInvalidURI() on it
                         log.warn("Blocking request due to known XSS content in parameter=" + name + " for uri=" + hreq.getRequestURI());
                         return true;
@@ -88,7 +88,7 @@ public class XSSHandler {
             else {
                 String[] vals = hreq.getParameterValues(name);
                 for (String value : vals) {
-                    if (isInvalidString(value)) {
+                    if (isInvalidParam(value)) {
                         // should be safe to log the uri, as we've already run isInvalidURI() on it
                         log.warn("Blocking request due to potential XSS content in parameter=" + name + " for uri=" + hreq.getRequestURI());
                         return true;
@@ -120,9 +120,25 @@ public class XSSHandler {
         }
         return false;
     }
+    
+    /**
+     * This is a copy of isInvalidString expect the elimination of URLDecoder.
+     * Searches the given string for any < or " instances
+     * @param value
+     * @return true if we find < or " anywhere in the string, otherwise false
+     */
+    private boolean isInvalidParam(String value) {
+        if (value != null) {
+            String s = value.toLowerCase();
+            if ((s.indexOf('<') != -1) || (s.indexOf('"') != -1)) {
+                return true;
+            }
+        }
+        return false;
+    }
 
     /**
-     * More limited version of the isInvalidString() method, in which we only
+     * More limited version of the isInvalidParam() method, in which we only
      * check for: <script, <img, <iframe, <div and style= tags in the string.
      * @param value
      * @return true if we find:
@@ -130,32 +146,26 @@ public class XSSHandler {
      *      2) style= anywhere in the string
      *      else false
      */
-    private boolean isInvalidParam(String value) {
+    private boolean isInvalidParamLmt(String value) {
         if (value != null) {
-            try {
-                String s = URLDecoder.decode(value, "UTF-8").toLowerCase();
-                int offset = s.indexOf('<');
-                while (offset != -1) {
-                    // increment past the "<"
-                    offset++;
-                    // if we found a start tag in the param, lets dig deeper...
-                    if (containsScript(s, offset) || containsImg(s, offset) ||
-                        containsIframe(s, offset) || containsDiv(s, offset)) {
-                        // we found a hit
-                        return true;
-                    }
-                    else {
-                        // look for another set of tags in the string
-                        offset = s.indexOf('<', offset);
-                    }
+            String s = value.toLowerCase();
+            int offset = s.indexOf('<');
+            while (offset != -1) {
+                // increment past the "<"
+                offset++;
+                // if we found a start tag in the param, lets dig deeper...
+                if (containsScript(s, offset) || containsImg(s, offset) ||
+                    containsIframe(s, offset) || containsDiv(s, offset)) {
+                    // we found a hit
+                    return true;
+                }
+                else {
+                    // look for another set of tags in the string
+                    offset = s.indexOf('<', offset);
                 }
-                // also need to check for style= usage
-                return(containsStyle(s));
-            }
-            catch (UnsupportedEncodingException uee) {
-                // should never happen
-                log.error("URLDecoder.decode(UTF8) failed.", uee);
             }
+            // also need to check for style= usage
+            return(containsStyle(s));
         }
         return false;
     }