You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by re...@apache.org on 2016/02/26 13:51:35 UTC
svn commit: r1732470 - in /jackrabbit/branches/2.0: ./
jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/util/
jackrabbit-jcr-commons/src/test/java/org/apache/jackrabbit/util/
jackrabbit-jcr-server/src/main/java/org/apache/jackrabbit/server/io/
Author: reschke
Date: Fri Feb 26 12:51:35 2016
New Revision: 1732470
URL: http://svn.apache.org/viewvc?rev=1732470&view=rev
Log:
JCR-3950: fix XSS vulnerability in DirListingExportHandler (ported to 2.0)
Modified:
jackrabbit/branches/2.0/ (props changed)
jackrabbit/branches/2.0/jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/util/Text.java
jackrabbit/branches/2.0/jackrabbit-jcr-commons/src/test/java/org/apache/jackrabbit/util/TextTest.java
jackrabbit/branches/2.0/jackrabbit-jcr-server/src/main/java/org/apache/jackrabbit/server/io/DirListingExportHandler.java
Propchange: jackrabbit/branches/2.0/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Fri Feb 26 12:51:35 2016
@@ -4,4 +4,4 @@
/jackrabbit/sandbox/JCR-1456:774917-886178
/jackrabbit/sandbox/JCR-2170:812417-816332
/jackrabbit/sandbox/tripod-JCR-2209:795441-795863
-/jackrabbit/trunk:891595,891629,892253,892263,894150-894151,896408,896513,896532,896857,896870,896876,896908,896940,896942-896943,896969,896977,897071,897836,897842,897858,897935,897983,897992-897993,897996,898002,898042,898267,898325,898540,898677,898699,898701,898715,898872,899102,899181,899391,899393-899394,899583,899594,899643,900305,900310,900314,900453,900702,900736,900762-900763,900767,900782,901095,901122,901139,901144,901170,901176,901191,901193,901196,901216,901228,901285,902058,902062,926324,928888,936668,955222,955229,955307,955852,965539,995406,995411-995412,996810,999298-999299,999965,1000912,1000947,1001707,1002065-1002066,1002084,1002101-1002102,1002168,1002170,1002589,1002608,1002657,1002729,1003423,1003470,1003542,1003773,1004182,1004184,1004223-1004224,1004652,1005057,1005112,1032621,1036117,1036336-1036337,1038201,1039064,1040090,1087304,1089436,1100242,1101046,1102601,1104027,1165609,1173196,1506594,1680757
+/jackrabbit/trunk:891595,891629,892253,892263,894150-894151,896408,896513,896532,896857,896870,896876,896908,896940,896942-896943,896969,896977,897071,897836,897842,897858,897935,897983,897992-897993,897996,898002,898042,898267,898325,898540,898677,898699,898701,898715,898872,899102,899181,899391,899393-899394,899583,899594,899643,900305,900310,900314,900453,900702,900736,900762-900763,900767,900782,901095,901122,901139,901144,901170,901176,901191,901193,901196,901216,901228,901285,902058,902062,926324,928888,936668,955222,955229,955307,955852,965539,995406,995411-995412,996810,999298-999299,999965,1000912,1000947,1001707,1002065-1002066,1002084,1002101-1002102,1002168,1002170,1002589,1002608,1002657,1002729,1003423,1003470,1003542,1003773,1004182,1004184,1004223-1004224,1004652,1005057,1005112,1032621,1036117,1036336-1036337,1038201,1039064,1040090,1087304,1089436,1100242,1101046,1102601,1104027,1165609,1173196,1506594,1680757,1732436
Modified: jackrabbit/branches/2.0/jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/util/Text.java
URL: http://svn.apache.org/viewvc/jackrabbit/branches/2.0/jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/util/Text.java?rev=1732470&r1=1732469&r2=1732470&view=diff
==============================================================================
--- jackrabbit/branches/2.0/jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/util/Text.java (original)
+++ jackrabbit/branches/2.0/jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/util/Text.java Fri Feb 26 12:51:35 2016
@@ -210,13 +210,28 @@ public class Text {
}
/**
- * Replaces illegal XML characters in the given string by their corresponding
- * predefined entity references.
+ * Replaces XML characters in the given string that might need escaping
+ * as XML text or attribute
*
* @param text text to be escaped
* @return a string
*/
public static String encodeIllegalXMLCharacters(String text) {
+ return encodeMarkupCharacters(text, false);
+ }
+
+ /**
+ * Replaces HTML characters in the given string that might need escaping
+ * as HTML text or attribute
+ *
+ * @param text text to be escaped
+ * @return a string
+ */
+ public static String encodeIllegalHTMLCharacters(String text) {
+ return encodeMarkupCharacters(text, true);
+ }
+
+ private static String encodeMarkupCharacters(String text, boolean isHtml) {
if (text == null) {
throw new IllegalArgumentException("null argument");
}
@@ -251,7 +266,7 @@ public class Text {
} else if (ch == '"') {
buf.append(""");
} else if (ch == '\'') {
- buf.append("'");
+ buf.append(isHtml ? "'" : "'");
}
}
if (buf == null) {
Modified: jackrabbit/branches/2.0/jackrabbit-jcr-commons/src/test/java/org/apache/jackrabbit/util/TextTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/branches/2.0/jackrabbit-jcr-commons/src/test/java/org/apache/jackrabbit/util/TextTest.java?rev=1732470&r1=1732469&r2=1732470&view=diff
==============================================================================
--- jackrabbit/branches/2.0/jackrabbit-jcr-commons/src/test/java/org/apache/jackrabbit/util/TextTest.java (original)
+++ jackrabbit/branches/2.0/jackrabbit-jcr-commons/src/test/java/org/apache/jackrabbit/util/TextTest.java Fri Feb 26 12:51:35 2016
@@ -189,4 +189,11 @@ public class TextTest extends TestCase {
assertEquals("local'name", Text.escapeIllegalJcrChars("local'name"));
assertEquals("local\"name", Text.escapeIllegalJcrChars("local\"name"));
}
+ public void testEscapeXML() {
+ assertEquals("&<>'"", Text.encodeIllegalXMLCharacters("&<>'\""));
+ }
+
+ public void testEscapeHTML() {
+ assertEquals("&<>'"", Text.encodeIllegalHTMLCharacters("&<>'\""));
+ }
}
Modified: jackrabbit/branches/2.0/jackrabbit-jcr-server/src/main/java/org/apache/jackrabbit/server/io/DirListingExportHandler.java
URL: http://svn.apache.org/viewvc/jackrabbit/branches/2.0/jackrabbit-jcr-server/src/main/java/org/apache/jackrabbit/server/io/DirListingExportHandler.java?rev=1732470&r1=1732469&r2=1732470&view=diff
==============================================================================
--- jackrabbit/branches/2.0/jackrabbit-jcr-server/src/main/java/org/apache/jackrabbit/server/io/DirListingExportHandler.java (original)
+++ jackrabbit/branches/2.0/jackrabbit-jcr-server/src/main/java/org/apache/jackrabbit/server/io/DirListingExportHandler.java Fri Feb 26 12:51:35 2016
@@ -145,14 +145,14 @@ public class DirListingExportHandler imp
String repURL = rep.getDescriptor(Repository.REP_VENDOR_URL_DESC);
String repVersion = rep.getDescriptor(Repository.REP_VERSION_DESC);
writer.print("<html><head><title>");
- writer.print(repName);
+ writer.print(Text.encodeIllegalHTMLCharacters(repName));
writer.print(" ");
- writer.print(repVersion);
+ writer.print(Text.encodeIllegalHTMLCharacters(repVersion));
writer.print(" ");
- writer.print(item.getPath());
+ writer.print(Text.encodeIllegalHTMLCharacters(item.getPath()));
writer.print("</title></head>");
writer.print("<body><h2>");
- writer.print(item.getPath());
+ writer.print(Text.encodeIllegalHTMLCharacters(item.getPath()));
writer.print("</h2><ul>");
writer.print("<li><a href=\"..\">..</a></li>");
if (item.isNode()) {
@@ -161,21 +161,21 @@ public class DirListingExportHandler imp
Node child = iter.nextNode();
String label = Text.getName(child.getPath());
writer.print("<li><a href=\"");
- writer.print(Text.escape(label));
+ writer.print(Text.encodeIllegalHTMLCharacters(Text.escape(label)));
if (child.isNode()) {
writer.print("/");
}
writer.print("\">");
- writer.print(Text.encodeIllegalXMLCharacters(label));
+ writer.print(Text.encodeIllegalHTMLCharacters(label));
writer.print("</a></li>");
}
}
writer.print("</ul><hr size=\"1\"><em>Powered by <a href=\"");
- writer.print(repURL);
+ writer.print(Text.encodeIllegalHTMLCharacters(repURL));
writer.print("\">");
- writer.print(repName);
+ writer.print(Text.encodeIllegalHTMLCharacters(repName));
writer.print("</a> version ");
- writer.print(repVersion);
+ writer.print(Text.encodeIllegalHTMLCharacters(repVersion));
writer.print("</em></body></html>");
} catch (RepositoryException e) {
// should not occur
@@ -209,14 +209,14 @@ public class DirListingExportHandler imp
String repURL = rep.getDescriptor(Repository.REP_VENDOR_URL_DESC);
String repVersion = rep.getDescriptor(Repository.REP_VERSION_DESC);
writer.print("<html><head><title>");
- writer.print(repName);
+ writer.print(Text.encodeIllegalHTMLCharacters(repName));
writer.print(" ");
- writer.print(repVersion);
+ writer.print(Text.encodeIllegalHTMLCharacters(repVersion));
writer.print(" ");
- writer.print(resource.getResourcePath());
+ writer.print(Text.encodeIllegalHTMLCharacters(resource.getResourcePath()));
writer.print("</title></head>");
writer.print("<body><h2>");
- writer.print(resource.getResourcePath());
+ writer.print(Text.encodeIllegalHTMLCharacters(resource.getResourcePath()));
writer.print("</h2><ul>");
writer.print("<li><a href=\"..\">..</a></li>");
DavResourceIterator iter = resource.getMembers();
@@ -224,17 +224,17 @@ public class DirListingExportHandler imp
DavResource child = iter.nextResource();
String label = Text.getName(child.getResourcePath());
writer.print("<li><a href=\"");
- writer.print(child.getHref());
+ writer.print(Text.encodeIllegalHTMLCharacters(child.getHref()));
writer.print("\">");
- writer.print(Text.encodeIllegalXMLCharacters(label));
+ writer.print(Text.encodeIllegalHTMLCharacters(label));
writer.print("</a></li>");
}
writer.print("</ul><hr size=\"1\"><em>Powered by <a href=\"");
- writer.print(repURL);
+ writer.print(Text.encodeIllegalHTMLCharacters(repURL));
writer.print("\">");
- writer.print(repName);
+ writer.print(Text.encodeIllegalHTMLCharacters(repName));
writer.print("</a> version ");
- writer.print(repVersion);
+ writer.print(Text.encodeIllegalHTMLCharacters(repVersion));
writer.print("</em></body></html>");
} catch (RepositoryException e) {
// should not occur