[myfaces-tobago] branch tobago-4.x updated: refactor(security): fix GitHub code scanning issue (#3431)

[lo...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lofwyr pushed a commit to branch tobago-4.x
in repository https://gitbox.apache.org/repos/asf/myfaces-tobago.git


The following commit(s) were added to refs/heads/tobago-4.x by this push:
     new 50e66572e5 refactor(security): fix GitHub code scanning issue (#3431)
50e66572e5 is described below

commit 50e66572e52d3aae6c4b6a48a27d1433c84f2b06
Author: Udo Schnurpfeil <lo...@apache.org>
AuthorDate: Fri Nov 18 14:30:07 2022 +0100

    refactor(security): fix GitHub code scanning issue (#3431)
    
    * fix: Polynomial regular expression used on uncontrolled data
---
 .../tobago/internal/component/AbstractUIPage.java  | 45 +++++++++++++++++++---
 1 file changed, 40 insertions(+), 5 deletions(-)

diff --git a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/component/AbstractUIPage.java b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/component/AbstractUIPage.java
index e4065338bc..8c0239c4f4 100644
--- a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/component/AbstractUIPage.java
+++ b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/component/AbstractUIPage.java
@@ -95,19 +95,20 @@ public abstract class AbstractUIPage extends AbstractUIFormBase implements Clien
       LOG.warn("No sourceId found!");
     }
 
-    // TODO: remove this if block if proven this never happens anymore
-    if (command == null
-        && sourceId != null && sourceId.matches(".*:\\d+:.*")) {
+    if (command == null && sourceId != null) {
       // If currentActionId component was inside a sheet the id contains the
       // rowIndex and is therefore not found here.
       // We do not need the row here because we want just to find the
       // related form, so removing the rowIndex will help here.
-      sourceId = sourceId.replaceAll(":\\d+:", ":");
+      sourceId = cutIteratorFromId(sourceId);
       try {
         command = viewRoot.findComponent(sourceId);
-        //LOG.info("command = \"" + command + "\"", new Exception());
       } catch (final Exception e) {
         // ignore
+        if (LOG.isTraceEnabled()) {
+          LOG.trace("sourceId='{}'", sourceId);
+          LOG.trace("Exception in findComponent", e);
+        }
       }
     }
 
@@ -133,6 +134,40 @@ public abstract class AbstractUIPage extends AbstractUIFormBase implements Clien
     }
   }
 
+  // TODO: Remove this method if proven this never happens anymore
+  // TODO: This workaround is stil needed for Mojarra
+  // TODO: Otherwise actions in tree/sheet will not be detected
+  protected String cutIteratorFromId(final String sourceId) {
+
+    final char[] chars = sourceId.toCharArray();
+    final int n = chars.length;
+    final char colon = ':';
+    final StringBuilder builder = new StringBuilder(n);
+    char lastInBuilder = ' '; // any non-colon
+    for (char c : chars) {
+      if (c == colon) { // colon
+        if (lastInBuilder != colon) {
+          builder.append(c);
+          lastInBuilder = c;
+        }
+      } else if ('0' <= c && c <= '9') { // number
+
+      } else { // any other
+        builder.append(c);
+        lastInBuilder = c;
+      }
+    }
+
+    if (builder.length() == n) {
+      return sourceId;
+    } else if (lastInBuilder == colon) {
+      builder.deleteCharAt(builder.length() - 1);
+      return builder.toString();
+    } else {
+      return builder.toString();
+    }
+  }
+
   public abstract String getApplicationIcon();
 
   public abstract String getLabel();