You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jspwiki.apache.org by al...@apache.org on 2026/08/23 13:32:38 UTC
(jspwiki) branch bug/JSPWIKI-1283 created (now 60f298103)
This is an automated email from the ASF dual-hosted git repository.
spyhunter99 pushed a change to branch bug/JSPWIKI-1283
in repository https://gitbox.apache.org/repos/asf/jspwiki.git
at 60f298103 JSPWIKI-1283 see jira for details
This branch includes the following new commits:
new 60f298103 JSPWIKI-1283 see jira for details
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(jspwiki) 01/01: JSPWIKI-1283 see jira for details
Posted by al...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spyhunter99 pushed a commit to branch bug/JSPWIKI-1283
in repository https://gitbox.apache.org/repos/asf/jspwiki.git
commit 60f29810336f133d9e286b56acd2e4eefb171ae5
Author: Alex O'Ree <al...@apache.org>
AuthorDate: Sun Aug 23 09:32:24 2026 -0400
JSPWIKI-1283 see jira for details
---
.../src/main/java/org/apache/wiki/parser/MarkupParser.java | 7 ++++++-
.../src/test/java/org/apache/wiki/parser/MarkupParserTest.java | 9 +++++++++
2 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/jspwiki-main/src/main/java/org/apache/wiki/parser/MarkupParser.java b/jspwiki-main/src/main/java/org/apache/wiki/parser/MarkupParser.java
index e9237b9e0..8115207e1 100644
--- a/jspwiki-main/src/main/java/org/apache/wiki/parser/MarkupParser.java
+++ b/jspwiki-main/src/main/java/org/apache/wiki/parser/MarkupParser.java
@@ -326,12 +326,17 @@ public abstract class MarkupParser {
/**
* Writes HTML for error message. Does not add it to the document, you have to do it yourself.
+ * <p>
+ * The error string is HTML-escaped here, because the wiki rendering pipeline serializes the
+ * document with output escaping disabled, so any markup in the message would otherwise be
+ * emitted verbatim into the page (e.g. attacker-controlled plugin parameters echoed back in
+ * exception messages).
*
* @param error The error string.
* @return An Element containing the error.
*/
public static Element makeError( final String error ) {
- return new Element( "span" ).setAttribute( "class", "error" ).addContent( error );
+ return new Element( "span" ).setAttribute( "class", "error" ).addContent( TextUtil.replaceEntities( error ) );
}
/**
diff --git a/jspwiki-main/src/test/java/org/apache/wiki/parser/MarkupParserTest.java b/jspwiki-main/src/test/java/org/apache/wiki/parser/MarkupParserTest.java
index a60123fa2..9d846570b 100644
--- a/jspwiki-main/src/test/java/org/apache/wiki/parser/MarkupParserTest.java
+++ b/jspwiki-main/src/test/java/org/apache/wiki/parser/MarkupParserTest.java
@@ -43,4 +43,13 @@ public class MarkupParserTest
Assertions.assertEquals( "Clean (link)", MarkupParser.cleanLink("Clean (link)") );
}
+ @Test
+ public void testMakeErrorEscapesHtml()
+ {
+ // Error messages are rendered with output escaping disabled, so makeError must
+ // neutralize markup carried in e.g. plugin exception messages.
+ final String text = MarkupParser.makeError( "Faulty pattern <img src=x onerror=alert(1)>" ).getText();
+ Assertions.assertEquals( "Faulty pattern <img src=x onerror=alert(1)>", text );
+ }
+
}