You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@archiva.apache.org by ma...@apache.org on 2019/02/27 17:32:42 UTC
[archiva] 02/06: Add url validation for certain fields
This is an automated email from the ASF dual-hosted git repository.
martin_s pushed a commit to branch archiva-2.x
in repository https://gitbox.apache.org/repos/asf/archiva.git
commit a36035b49ba7d6514d6c386b51e1ad2512371b3d
Author: Martin Stockhammer <ma...@apache.org>
AuthorDate: Fri Feb 22 21:10:19 2019 +0100
Add url validation for certain fields
---
.../admin/DefaultArchivaAdministration.java | 24 ++++++++++++--
.../admin/ArchivaAdministrationTest.java | 37 ++++++++++++++++++++++
2 files changed, 58 insertions(+), 3 deletions(-)
diff --git a/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/main/java/org/apache/archiva/admin/repository/admin/DefaultArchivaAdministration.java b/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/main/java/org/apache/archiva/admin/repository/admin/DefaultArchivaAdministration.java
index 54d26fb..8f065c1 100644
--- a/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/main/java/org/apache/archiva/admin/repository/admin/DefaultArchivaAdministration.java
+++ b/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/main/java/org/apache/archiva/admin/repository/admin/DefaultArchivaAdministration.java
@@ -36,9 +36,14 @@ import org.apache.http.impl.conn.PoolingClientConnectionManager;
import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
import org.apache.maven.wagon.providers.http.HttpWagon;
import org.springframework.stereotype.Service;
+import org.springframework.util.ResourceUtils;
import javax.annotation.PostConstruct;
import javax.annotation.PreDestroy;
+import java.io.UnsupportedEncodingException;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.net.URLEncoder;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
@@ -321,16 +326,29 @@ public class DefaultArchivaAdministration
return getModelMapper().map( organisationInformation, OrganisationInformation.class );
}
+ private void checkUrl(String url, String propertyName) throws RepositoryAdminException {
+ if ( StringUtils.isNotEmpty( url ) )
+ {
+ if ( !ResourceUtils.isUrl( url ) )
+ {
+ throw new RepositoryAdminException( "Bad URL in " + propertyName + ": " + url );
+ }
+ }
+
+ }
+
@Override
public void setOrganisationInformation( OrganisationInformation organisationInformation )
throws RepositoryAdminException
{
- Configuration configuration = getArchivaConfiguration().getConfiguration();
+ checkUrl(organisationInformation.getUrl(), "url");
+ checkUrl( organisationInformation.getLogoLocation(), "logoLocation" );
+ Configuration configuration = getArchivaConfiguration( ).getConfiguration( );
if ( organisationInformation != null )
{
org.apache.archiva.configuration.OrganisationInformation organisationInformationModel =
- getModelMapper().map( organisationInformation,
- org.apache.archiva.configuration.OrganisationInformation.class );
+ getModelMapper( ).map( organisationInformation,
+ org.apache.archiva.configuration.OrganisationInformation.class );
configuration.setOrganisationInfo( organisationInformationModel );
}
else
diff --git a/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/test/java/org/apache/archiva/admin/repository/admin/ArchivaAdministrationTest.java b/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/test/java/org/apache/archiva/admin/repository/admin/ArchivaAdministrationTest.java
index 2c46004..6e3fbd6 100644
--- a/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/test/java/org/apache/archiva/admin/repository/admin/ArchivaAdministrationTest.java
+++ b/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/test/java/org/apache/archiva/admin/repository/admin/ArchivaAdministrationTest.java
@@ -217,6 +217,43 @@ public class ArchivaAdministrationTest
}
@Test
+ public void badOrganisationInfoLogoLocation( )
+ {
+ try
+ {
+ OrganisationInformation newOrganisationInformation = new OrganisationInformation( );
+ newOrganisationInformation.setLogoLocation( "'/><svg/onload=alert(/logoLocation_xss/)>" );
+ newOrganisationInformation.setName( "foo org" );
+ newOrganisationInformation.setUrl( "http://foo.com" );
+ archivaAdministration.setOrganisationInformation( newOrganisationInformation );
+ fail( "RepositoryAdminException expected. Bad URL content should not be allowed for logo location." );
+ }
+ catch ( RepositoryAdminException e )
+ {
+ // OK
+ }
+ }
+
+ @Test
+ public void badOrganisationInfoUrl( )
+ {
+ try
+ {
+ OrganisationInformation newOrganisationInformation = new OrganisationInformation( );
+ newOrganisationInformation.setUrl( "'/><svg/onload=alert(/url_xss/)>" );
+ newOrganisationInformation.setName( "foo org" );
+ newOrganisationInformation.setLogoLocation( "http://foo.com/bar.png" );
+ archivaAdministration.setOrganisationInformation( newOrganisationInformation );
+ fail( "RepositoryAdminException expected. Bad URL content should not be allowed for logo location." );
+ }
+ catch ( RepositoryAdminException e )
+ {
+ // OK
+ }
+
+ }
+
+ @Test
public void uiConfiguration()
throws Exception
{