You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jspwiki.apache.org by al...@apache.org on 2026/06/15 21:58:43 UTC
(jspwiki) branch master3 created (now 8e7d775f2)
This is an automated email from the ASF dual-hosted git repository.
spyhunter99 pushed a change to branch master3
in repository https://gitbox.apache.org/repos/asf/jspwiki.git
at 8e7d775f2 JSPWIKI-1273 see jira for details
This branch includes the following new commits:
new 8e7d775f2 JSPWIKI-1273 see jira for details
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(jspwiki) 01/01: JSPWIKI-1273 see jira for details
Posted by al...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spyhunter99 pushed a commit to branch master3
in repository https://gitbox.apache.org/repos/asf/jspwiki.git
commit 8e7d775f2a4abe0b9ede1dc8dd212a7f1ecab658
Author: Alex O'Ree <al...@apache.org>
AuthorDate: Mon Jun 15 17:58:33 2026 -0400
JSPWIKI-1273 see jira for details
---
.../main/java/org/apache/wiki/plugin/Image.java | 12 +-
.../java/org/apache/wiki/plugin/ImageTest.java | 204 +++++++++++++++++++++
2 files changed, 213 insertions(+), 3 deletions(-)
diff --git a/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java b/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
index e3178af89..04c9c836c 100644
--- a/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
+++ b/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
@@ -189,7 +189,10 @@ public class Image implements Plugin {
if( link != null ) {
if( !context.getBooleanWikiProperty( MarkupParser.PROP_ALLOWHTML, false ) ) {
- if( link.startsWith( "data:" ) || link.startsWith( "javascript:" ) ) {
+ String testVal = link.toLowerCase().replaceAll("\\s+","").trim();
+ if (testVal.startsWith("data")
+ || testVal.startsWith("javascript")
+ || testVal.startsWith("vbscript")) {
link = "http://invalid_url" + link;
}
}
@@ -200,8 +203,11 @@ public class Image implements Plugin {
result.append(">");
}
- if( !context.getBooleanWikiProperty( MarkupParser.PROP_ALLOWHTML, false ) ) {
- if( src.startsWith( "data:" ) || src.startsWith( "javascript:" ) ) {
+ if(!context.getBooleanWikiProperty(MarkupParser.PROP_ALLOWHTML, false)) {
+ String testVal = src.toLowerCase().replaceAll("\\s+", "").trim();
+ if (testVal.startsWith("data")
+ || testVal.startsWith("javascript")
+ || testVal.startsWith("vbscript")) {
src = "http://invalid_url" + src;
}
}
diff --git a/jspwiki-main/src/test/java/org/apache/wiki/plugin/ImageTest.java b/jspwiki-main/src/test/java/org/apache/wiki/plugin/ImageTest.java
new file mode 100644
index 000000000..6108a22f9
--- /dev/null
+++ b/jspwiki-main/src/test/java/org/apache/wiki/plugin/ImageTest.java
@@ -0,0 +1,204 @@
+/*
+ * Copyright 2026 The Apache Software Foundation.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.wiki.plugin;
+
+import org.apache.wiki.TestEngine;
+import org.apache.wiki.render.RenderingManager;
+import org.junit.jupiter.api.Assertions;
+
+/**
+ *
+ * @author Dad
+ */
+public class ImageTest {
+
+ static TestEngine testEngine = TestEngine.build();
+
+ /**
+ * Test of execute method, of class Image.
+ */
+ @org.junit.jupiter.api.Test
+ public void mixedCase() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘JavaScript:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withSpaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘Java Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withTabSpaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withLeadingSpaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘ Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void withLeading2Spaces() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘\tJava\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void dataurl() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘\tDATA:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void vbscripturl() throws Exception {
+ final String src = "[{Image src=’img.png’ link=‘\tVbs c ripT:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+
+
+
+ @org.junit.jupiter.api.Test
+ public void SRCmixedCase() throws Exception {
+ final String src = "[{Image src=‘JavaScript:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"));
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithSpaces() throws Exception {
+ final String src = "[{Image src=‘Java Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithTabSpaces() throws Exception {
+ final String src = "[{Image src=‘Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithLeadingSpaces() throws Exception {
+ final String src = "[{Image src=‘ Java\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void srcwithLeading2Spaces() throws Exception {
+ final String src = "[{Image src=‘\tJava\t Script:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void SRCdataurl() throws Exception {
+ final String src = "[{Image src=‘\tDATA:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+ @org.junit.jupiter.api.Test
+ public void SRCvbscripturl() throws Exception {
+ final String src = "[{Image src=‘\tVbs c ripT:alert(document.cookie)>’}]";
+
+ testEngine.saveText("ThisPage", src);
+
+ // Just check that it contains a proper error message; don't bother do HTML checking.
+ final String res = testEngine.getManager(RenderingManager.class).getHTML("ThisPage");
+ Assertions.assertTrue(!res.contains("document.cookie"), res);
+
+ }
+
+}