You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@velocity.apache.org by "Geir Magnusson Jr." <ge...@adeptra.com> on 2002/06/01 00:11:28 UTC
Re: escaping xml characters
On 5/31/02 5:47 PM, "Jeff Schnitzer" <je...@infohazard.org> wrote:
> IMHO, *no* solution which requires explicit effort by template designers
> is appropriate. In order to be safe, XML escaping must be implicit.
Didn't you suggest explicitness in your first post?
"I propose a velocity config key (runtime.escapexml?) that defaults to
false (for backwards compatibility). I also propose an additional
snippet of syntax, like $:blah, which inverts the xml escaping. I'm not
particular about the character or syntax, but it needs to be possible.
"
Oh - that was just the thing to turn it off...
>
> Allowing XML characters in the result of expression evaluation is the
> security risk equivalent of a buffer overflow for web pages. With any
> user-set fields, a malicious user could fairly easily write javascript
> that arbitrarily affects browser behavior (such as forwarding autologin
> cookies to another site).
>
> At a random guess, something like 70% of people using Velocity are
> building web pages. Unless they are explicitly escaping *every single*
> expression, they are probably all vulnerable to cross-site-scripting
> attacks like this. At another random guess, at least half of the
> remaining Velocity users are generating XML-like data, in which random
> XML characters will cause problems as well.
"cross-document-parsing" ? :)
You are vulnerable to this if you take form data from people and don't check
it, right?
Someone is going to argue that you might want to check the data on the way
in...
>
> Thus I would argue that at least 85% of Velocity users have a real need
> for automatic, effortless escaping of XML characters. Any solution that
> allows for the possibility of template designers to "forget" to escape
> an expression is a potential security risk (or at least bug). I'm
> willing to bet that most template designers don't really grok CSS
> vulnerability anyways, so think of the hacker's playground being
> created...
If you are going to take the side of security on this one (a side I
empathize with) *and* suggest it has to be foolproof to ensure those of us
doing output design that don't understand all the vulnerablities (like me)
don't make a mistake, then I think you can't also demand the $:woogie
bypass (or whatever the syntax.)
>
> Anakia/DVSL users are probably suffering without automatic XML escaping
> too; strings returned from DOM nodes will have real '<', etc in them,
> not '<'.
>
> It is my observation that for building XML-like data (85% of Velocity
> use?), requiring raw unescaped XML text is a rarity - and dangerous in
> most other cases. The default behavior of the Struts and JSTL tags
> reinforces this opinion.
>
> Please - since Velocity is heavily used to generate XML (and especially
> web pages), this needs to be a basic feature of the core, and template
> designers shouldn't have to worry about it.
>
> I'll be happy to submit the patch myself. I'm going to have to do it
> anyways - I hate running forks of development trees, but this is pretty
> much a showstopper for me. It's critically important that my autologin
> cookies remain private.
First, patches always welcome.
Second, I've been thinking about this one all day. A few thoughts :
1) It's really not very hard to do with an event handler, but then you don't
get your escape trick ($:foo)
You *could* solve it with a custom context that maps
$<token>- to $<token> (ex. $foo- -> $foo
(so you put something into the context as "foo" and if you put a reference
$foo- or $foo, you get the same value)
and with an event handler, you can look for the trailing '-' as the signal
to *not* to escape...
2) It's also not hard with a custom context, one that does the conversion
going out. The problem there is that you get nailed with
$foo.bar()
So for that, you can solve that with a custom uberspector, wrapping all
method calls to ensure that anything returned has a custom toString(). Of
course, you then don't have the escape trigger character...
Just thinking...
--
Geir Magnusson Jr.
Research & Development, Adeptra Inc.
geirm@adeptra.com
+1-203-247-1713
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: super template
Posted by Huy Do <hu...@tramada.com.au>.
You should look at how Turbine does it http://jakarta.apache.org/turbine.
They have split it up into Page, Layout, Screens etc. If I understand you
correctly, this is what you are trying to achieve.
Huy
> -----Original Message-----
> From: Charles N. Harvey III [mailto:charlieh@alloy.com]
> Sent: Thursday, 6 June 2002 7:41 AM
> To: Velocity Users List
> Subject: super template
>
>
> Ok, not really a "super template", but a template that calls all others.
>
> The usual scenario is this:
>
> <html>
> <body>
> #include( pageTop.html )
> #parse ( navigation.vm )
>
> <p>stuff...
> ...
> ...
> ...
> </p>
>
> #include ( pageBottom.html )
> </body>
> </html>
>
>
> But I have to have those calls on every page of my site. So if I want to
> add
> another #include statement I have to change a lot of pages. What would be
> the
> best scenario is that every request gets the super template - page.vm:
>
> <html>
> <body>
> #include( pageTop.html )
> #parse ( navigation.vm )
>
> #parse ( /path/to/particular/body.vm )
>
> #include ( pageBottom.html )
> </body>
> </html>
>
>
> And body.vm is:
> <p>stuff...
> ...
> ...
> ...
> </p>
>
>
> I could swear hearing something about this being done by somebody. Any
> ideas?
> Because then I can make changes to page.vm and every page on the
> site feels
> the effect.
>
> Thanks for your insight(s).
>
> Charlie
>
>
> --
> To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: super template
Posted by "Charles N. Harvey III" <ch...@alloy.com>.
How 'bout if my getTemplate() always calls the same template - page.vm.
And I put the request string in the context.
String pageToGet = "/home/news/wednesday.vm";
context.put("middleofpage", pageToGet);
And in my page.vm I have
----------------------------------
#include ( top.html )
#parse ( navigation.vm )
#parse ( $middleofpage )
#include ( footer.html )
----------------------------------
Will that parse correctly at runtime? I am getting around to writing a
quick servlet to check this out, just thought I'd ask for opinions.
Charlie
> -----Original Message-----
> From: Charles N. Harvey III [mailto:charlieh@alloy.com]
> Sent: Wednesday, June 05, 2002 5:41 PM
> To: Velocity Users List
> Subject: super template
>
>
> Ok, not really a "super template", but a template that calls all others.
>
> The usual scenario is this:
>
> <html>
> <body>
> #include( pageTop.html )
> #parse ( navigation.vm )
>
> <p>stuff...
> ...
> ...
> ...
> </p>
>
> #include ( pageBottom.html )
> </body>
> </html>
>
>
> But I have to have those calls on every page of my site. So if I want to
> add
> another #include statement I have to change a lot of pages. What would be
> the
> best scenario is that every request gets the super template - page.vm:
>
> <html>
> <body>
> #include( pageTop.html )
> #parse ( navigation.vm )
>
> #parse ( /path/to/particular/body.vm )
>
> #include ( pageBottom.html )
> </body>
> </html>
>
>
> And body.vm is:
> <p>stuff...
> ...
> ...
> ...
> </p>
>
>
> I could swear hearing something about this being done by somebody. Any
> ideas?
> Because then I can make changes to page.vm and every page on the
> site feels
> the effect.
>
> Thanks for your insight(s).
>
> Charlie
>
>
> --
> To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: super template
Posted by "Charles N. Harvey III" <ch...@alloy.com>.
Tim, Anthony, Huy:
Thanks. These were all great answers and I am well on my way.
I really can't say enough about this list - it really rocks.
Charlie
> -----Original Message-----
> From: Tim Colson [mailto:tcolson@cisco.com]
> Sent: Monday, June 10, 2002 6:22 PM
> To: 'Velocity Users List'
> Subject: RE: super template
>
>
> Charles -
>
> > Ok, not really a "super template", but a template that calls all
> others.
> > The usual scenario is this:
>
> Snip - descripes a "layout" page that is applied/wrapped around the main
> body content.
>
> > I could swear hearing something about this being done by
> > somebody. Any ideas?
>
> Righto - it has been done by several folks in different ways. ;-)
>
> My rather simple-minded solution was to subclass the VelocityViewServlet
> and perform what I call a "two-pass render".
>
> http://www.mail-archive.com/velocity-dev@jakarta.apache.org/msg05936.htm
> l
>
> Hope that helps,
> Tim
>
>
>
> --
> To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: super template
Posted by Tim Colson <tc...@cisco.com>.
Charles -
> Ok, not really a "super template", but a template that calls all
others.
> The usual scenario is this:
Snip - descripes a "layout" page that is applied/wrapped around the main
body content.
> I could swear hearing something about this being done by
> somebody. Any ideas?
Righto - it has been done by several folks in different ways. ;-)
My rather simple-minded solution was to subclass the VelocityViewServlet
and perform what I call a "two-pass render".
http://www.mail-archive.com/velocity-dev@jakarta.apache.org/msg05936.htm
l
Hope that helps,
Tim
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: super template
Posted by Anthony Eden <ae...@signaturedomains.com>.
JPublish ( http://www.jpublish.org/ ) provides this functionality.
Sincerely,
Anthony Eden
> -----Original Message-----
> From: Charles N. Harvey III [mailto:charlieh@alloy.com]
> Sent: Wednesday, June 05, 2002 5:41 PM
> To: Velocity Users List
> Subject: super template
>
>
> Ok, not really a "super template", but a template that calls all others.
>
> The usual scenario is this:
>
> <html>
> <body>
> #include( pageTop.html )
> #parse ( navigation.vm )
>
> <p>stuff...
> ...
> ...
> ...
> </p>
>
> #include ( pageBottom.html )
> </body>
> </html>
>
>
> But I have to have those calls on every page of my site. So if I want to
> add
> another #include statement I have to change a lot of pages. What would be
> the
> best scenario is that every request gets the super template - page.vm:
>
> <html>
> <body>
> #include( pageTop.html )
> #parse ( navigation.vm )
>
> #parse ( /path/to/particular/body.vm )
>
> #include ( pageBottom.html )
> </body>
> </html>
>
>
> And body.vm is:
> <p>stuff...
> ...
> ...
> ...
> </p>
>
>
> I could swear hearing something about this being done by somebody. Any
> ideas?
> Because then I can make changes to page.vm and every page on the site feels
> the effect.
>
> Thanks for your insight(s).
>
> Charlie
>
>
> --
> To unsubscribe, e-mail: <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
super template
Posted by "Charles N. Harvey III" <ch...@alloy.com>.
Ok, not really a "super template", but a template that calls all others.
The usual scenario is this:
<html>
<body>
#include( pageTop.html )
#parse ( navigation.vm )
<p>stuff...
...
...
...
</p>
#include ( pageBottom.html )
</body>
</html>
But I have to have those calls on every page of my site. So if I want to
add
another #include statement I have to change a lot of pages. What would be
the
best scenario is that every request gets the super template - page.vm:
<html>
<body>
#include( pageTop.html )
#parse ( navigation.vm )
#parse ( /path/to/particular/body.vm )
#include ( pageBottom.html )
</body>
</html>
And body.vm is:
<p>stuff...
...
...
...
</p>
I could swear hearing something about this being done by somebody. Any
ideas?
Because then I can make changes to page.vm and every page on the site feels
the effect.
Thanks for your insight(s).
Charlie
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>