You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2016/08/04 08:43:16 UTC
svn commit: r1755147 - in /sling/trunk/bundles/extensions/xss/src:
main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
Author: rombert
Date: Thu Aug 4 08:43:16 2016
New Revision: 1755147
URL: http://svn.apache.org/viewvc?rev=1755147&view=rev
Log:
SLING-5946 - XSSAPI#encodeForJSString is not restrictive enough
Submitted-By: Vlad Bailescu
Modified:
sling/trunk/bundles/extensions/xss/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
sling/trunk/bundles/extensions/xss/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
Modified: sling/trunk/bundles/extensions/xss/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
URL: http://svn.apache.org/viewvc/sling/trunk/bundles/extensions/xss/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java?rev=1755147&r1=1755146&r2=1755147&view=diff
==============================================================================
--- sling/trunk/bundles/extensions/xss/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java (original)
+++ sling/trunk/bundles/extensions/xss/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java Thu Aug 4 08:43:16 2016
@@ -429,7 +429,7 @@ public class XSSAPIImpl implements XSSAP
*/
@Override
public String encodeForJSString(String source) {
- return source == null ? null : Encode.forJavaScriptSource(source);
+ return source == null ? null : Encode.forJavaScript(source).replace("\\-", "\\u002D");
}
/**
Modified: sling/trunk/bundles/extensions/xss/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
URL: http://svn.apache.org/viewvc/sling/trunk/bundles/extensions/xss/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java?rev=1755147&r1=1755146&r2=1755147&view=diff
==============================================================================
--- sling/trunk/bundles/extensions/xss/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java (original)
+++ sling/trunk/bundles/extensions/xss/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java Thu Aug 4 08:43:16 2016
@@ -400,10 +400,13 @@ public class XSSAPIImplTest {
{null, null},
{"simple", "simple"},
- {"break\"out", "break\\\"out"},
- {"break'out", "break\\'out"},
- {"'alert(document.cookie)", "\\'alert(document.cookie)"},
- {"2014-04-22T10:11:24.002+01:00", "2014-04-22T10:11:24.002+01:00"}
+ {"break\"out", "break\\x22out"},
+ {"break'out", "break\\x27out"},
+
+ {"</script>", "<\\/script>"},
+
+ {"'alert(document.cookie)", "\\x27alert(document.cookie)"},
+ {"2014-04-22T10:11:24.002+01:00", "2014\\u002D04\\u002D22T10:11:24.002+01:00"}
};
for (String[] aTestData : testData) {
@@ -430,7 +433,7 @@ public class XSSAPIImplTest {
{"\"literal string\"", "\"literal string\""},
{"'literal string'", "'literal string'"},
{"\"bad literal'", RUBBISH},
- {"'literal'); junk'", "'literal\\'); junk'"},
+ {"'literal'); junk'", "'literal\\x27); junk'"},
{"1200", "1200"},
{"3.14", "3.14"},