You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jspwiki.apache.org by al...@apache.org on 2026/06/15 22:01:28 UTC
(jspwiki) branch bug/JSPWIKI-1273 created (now 80ee288f6)
This is an automated email from the ASF dual-hosted git repository.
spyhunter99 pushed a change to branch bug/JSPWIKI-1273
in repository https://gitbox.apache.org/repos/asf/jspwiki.git
at 80ee288f6 Revert "Revert "JSPWIKI-1273 see jira for details""
This branch includes the following new commits:
new 80ee288f6 Revert "Revert "JSPWIKI-1273 see jira for details""
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(jspwiki) 01/01: Revert "Revert "JSPWIKI-1273 see jira for details""
Posted by al...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spyhunter99 pushed a commit to branch bug/JSPWIKI-1273
in repository https://gitbox.apache.org/repos/asf/jspwiki.git
commit 80ee288f6f47d1c264c7eb4f1a11c1fc20902e75
Author: Alex O'Ree <al...@apache.org>
AuthorDate: Mon Jun 15 18:01:06 2026 -0400
Revert "Revert "JSPWIKI-1273 see jira for details""
This reverts commit f3ecb0d7ef82bb6b65cf1ad69e10e742f9360d0f.
---
.../main/java/org/apache/wiki/plugin/Image.java | 12 +-
.../java/org/apache/wiki/plugin/ImageTest.java | 204 +++++++++++++++++++++
2 files changed, 213 insertions(+), 3 deletions(-)
diff --git a/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java b/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
index e3178af89..04c9c836c 100644
--- a/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
+++ b/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
@@ -189,7 +189,10 @@ public class Image implements Plugin {
if( link != null ) {
if( !context.getBooleanWikiProperty( MarkupParser.PROP_ALLOWHTML, false ) ) {
- if( link.startsWith( "data:" ) || link.startsWith( "javascript:" ) ) {
+ String testVal = link.toLowerCase().replaceAll("\\s+","").trim();
+ if (testVal.startsWith("data")
+ || testVal.startsWith("javascript")
+ || testVal.startsWith("vbscript")) {
link = "http://invalid_url" + link;
}
}
@@ -200,8 +203,11 @@ public class Image implements Plugin {
result.append(">");
}
- if( !context.getBooleanWikiProperty( MarkupParser.PROP_ALLOWHTML, false ) ) {
- if( src.startsWith( "data:" ) || src.startsWith( "javascript:" ) ) {
+ if(!context.getBooleanWikiProperty(MarkupParser.PROP_ALLOWHTML, false)) {
+ String testVal = src.toLowerCase().replaceAll("\\s+", "").trim();
+ if (testVal.startsWith("data")
+ || testVal.startsWith("javascript")
+ || testVal.startsWith("vbscript")) {
src = "http://invalid_url" + src;
}
}
diff --git a/jspwiki-main/src/test/java/org/apache/wiki/plugin/ImageTest.java b/jspwiki-main/src/test/java/org/apache/wiki/plugin/ImageTest.java
new file mode 100644
index 000000000..6108a22f9
--- /dev/null
+++ b/jspwiki-main/src/test/java/org/apache/wiki/plugin/ImageTest.java
@@ -0,0 +1,204 @@
+/*
+ * Copyright 2026 The Apache Software Foundation.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.wiki.plugin;
+
+import org.apache.wiki.TestEngine;
+import org.apache.wiki.render.RenderingManager;
+import org.junit.jupiter.api.Assertions;
+
+/**
+ *
+ * @author Dad
+ */
+public class ImageTest {
+
+ static TestEngine testEngine = TestEngine.build();
+
+ /**
+ * Test of execute method, of class Image.
+ */
+ @org.junit.jupiter.api.Test
+ public void mixedCase() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘JavaScript:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withSpaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘Java Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withTabSpaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withLeadingSpaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘ Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withLeading2Spaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘\tJava\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void dataurl() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘\tDATA:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void vbscripturl() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘\tVbs c ripT:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+
+
+
+ @org.junit.jupiter.api.Test
+ public void SRCmixedCase() throws Exception {
+ final String src = "[{Image src=‘JavaScript:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"));
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithSpaces() throws Exception {
+ final String src = "[{Image src=‘Java Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithTabSpaces() throws Exception {
+ final String src = "[{Image src=‘Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithLeadingSpaces() throws Exception {
+ final String src = "[{Image src=‘ Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithLeading2Spaces() throws Exception {
+ final String src = "[{Image src=‘\tJava\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void SRCdataurl() throws Exception {
+ final String src = "[{Image src=‘\tDATA:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void SRCvbscripturl() throws Exception {
+ final String src = "[{Image src=‘\tVbs c ripT:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+}