You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by gc...@apache.org on 2010/09/10 00:00:03 UTC
svn commit: r995588 - in
/myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages:
FredJSP.java JspUtils.java
Author: gcrawford
Date: Thu Sep 9 22:00:02 2010
New Revision: 995588
URL: http://svn.apache.org/viewvc?rev=995588&view=rev
Log:
TRINIDAD-1868 Problem with __adfv__
Modified:
myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages/FredJSP.java
myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages/JspUtils.java
Modified: myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages/FredJSP.java
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages/FredJSP.java?rev=995588&r1=995587&r2=995588&view=diff
==============================================================================
--- myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages/FredJSP.java (original)
+++ myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages/FredJSP.java Thu Sep 9 22:00:02 2010
@@ -64,7 +64,6 @@ public class FredJSP
* @param viewRoot the UIViewRoot that will subsequently displayed.
* The viewRoot itself is not saved, but values like the locale
* and viewId are saved.
- * @param savedPageFlowScope the process scope to use for the dialog
* @param minWidth the minimum width for the target page.
* @param minHeight the minimum height for the target page.
*/
@@ -93,7 +92,6 @@ public class FredJSP
return EncoderUtils.appendURLArguments(baseURL, args);
}
-
@SuppressWarnings("unchecked")
static void service(FacesContext context) throws IOException
{
@@ -109,10 +107,21 @@ public class FredJSP
// Save the return ID - and do so before generating the
// link to the frames!
- String returnId = requestParameters.get(_RETURN_ID_PARAM);
+ // We parse to a long to help avoid cross-site scripting attacks
+ Long returnId = JspUtils.longValueOfParam(requestParameters, _RETURN_ID_PARAM);
+
+ String returnIdString;
+
if (returnId != null)
- CoreRenderKit.saveDialogPostbackValues(returnId);
-
+ {
+ returnIdString = returnId.toString();
+ CoreRenderKit.saveDialogPostbackValues(returnIdString);
+ }
+ else
+ {
+ returnIdString = null;
+ }
+
CoreOutputText headStart = new CoreOutputText();
root.getChildren().add(headStart);
headStart.setEscape(false);
@@ -150,12 +159,13 @@ public class FredJSP
String queryString = _getQueryString(
context.getExternalContext().getRequestParameterValuesMap());
- // grab any sizing parameters
- String widthParam = requestParameters.get(_MIN_WIDTH_PARAM);
- boolean gotWidth = (widthParam != null);
+ // grab any sizing parameters. We convert these to their parsed parameters to avoid
+ // cross site scripting injects attacks
+ Integer width = JspUtils.integerValueOfParam(requestParameters, _MIN_WIDTH_PARAM);
+ boolean gotWidth = (width != null);
- String heightParam = requestParameters.get(_MIN_HEIGHT_PARAM);
- boolean gotHeight = (heightParam != null);
+ Integer height = JspUtils.integerValueOfParam(requestParameters, _MIN_HEIGHT_PARAM);
+ boolean gotHeight = (height != null);
String viewIdRedirect = requestParameters.get(_VIEW_ID_REDIRECT_PARAM);
if (viewIdRedirect != null)
@@ -202,14 +212,10 @@ public class FredJSP
// Bug #2464627: Allow support for forcing a minimum size
StringBuilder onload = new StringBuilder(_FRAMESET_ONLOAD_TEXT.length()
- // space for the param plus the 'W:'
- + (gotWidth
- ? widthParam.length() + 2
- : 0)
- // space for the param plus the 'H:'
- + (gotHeight
- ? heightParam.length() + 2
- : 0)
+ // space for the max param (5 digits) plus the 'W:'
+ + 7
+ // space for the max param (5 digits) plus the 'H:'
+ + 7
// space for commas, brackets,
// and closing paren
+ 5);
@@ -223,7 +229,7 @@ public class FredJSP
{
// add in the width parameter
onload.append("W:");
- onload.append(widthParam);
+ onload.append(width);
}
if (gotHeight)
{
@@ -231,7 +237,7 @@ public class FredJSP
if (gotWidth)
onload.append(",");
onload.append("H:");
- onload.append(heightParam);
+ onload.append(height);
}
// close the parameter object
onload.append("}");
@@ -246,10 +252,10 @@ public class FredJSP
if (returnId != null)
{
- StringBuilder onunload = new StringBuilder(53 + returnId.length());
+ StringBuilder onunload = new StringBuilder(53 + 20); // allow 20 digits for the returnId
onunload.append(_FRAMESET_ONUNLOAD_TEXT);
onunload.append(";window.opener.setTimeout(");
- onunload.append("'ADFDialogReturn[").append(returnId).append("]();'");
+ onunload.append("'ADFDialogReturn[").append(returnIdString).append("]();'");
onunload.append(",1)");
frameSet.setOnunload(onunload.toString());
}
Modified: myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages/JspUtils.java
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages/JspUtils.java?rev=995588&r1=995587&r2=995588&view=diff
==============================================================================
--- myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages/JspUtils.java (original)
+++ myfaces/trinidad/branches/trinidad-1.2.x/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/pages/JspUtils.java Thu Sep 9 22:00:02 2010
@@ -18,6 +18,8 @@
*/
package org.apache.myfaces.trinidadinternal.renderkit.core.pages;
+import java.util.Map;
+
import javax.faces.context.FacesContext;
import org.apache.myfaces.trinidad.component.core.nav.CoreGoButton;
@@ -61,7 +63,7 @@ class JspUtils
*/
static public String getEncoding(FacesContext context)
{
- String encoding = (String)context.getExternalContext().getRequestParameterMap().get("enc");
+ String encoding = context.getExternalContext().getRequestParameterMap().get("enc");
// verify that the encoding doesn't contain CRLF header delimiters as this could
// allow additional headers to per attached to a request on Servlet Engines
@@ -76,6 +78,64 @@ class JspUtils
return encoding;
}
+ /**
+ * Return the Integer version of the key in the requestParams map or null if the key doesn't
+ * exist or there was an error parsing the value. By converting the String to its parsed type
+ * and then only working with the parsed type, we help avoid cross site scripting attacks.
+ * @param requestParams Parameter map to loof for key in
+ * @param key Key of String to parse into integer
+ * @return The key value as an Integer or null if it doesn't exist or there was a parsing error
+ */
+ public static Integer integerValueOfParam(Map<String, String> requestParams, String key)
+ {
+ String value = requestParams.get(key);
+
+ if (value != null)
+ {
+ try
+ {
+ return Integer.valueOf(value);
+ }
+ catch (NumberFormatException e)
+ {
+ return null;
+ }
+ }
+ else
+ {
+ return null;
+ }
+ }
+
+ /**
+ * Return the Long version of the key in the requestParams map or null if the key doesn't
+ * exist or there was an error parsing the value. By converting the String to its parsed type
+ * and then only working with the parsed type, we help avoid cross site scripting attacks.
+ * @param requestParams Parameter map to loof for key in
+ * @param key Key of String to parse into integer
+ * @return The key value as a Long or null if it doesn't exist or there was a parsing error
+ */
+ public static Long longValueOfParam(Map<String, String> requestParams, String key)
+ {
+ String value = requestParams.get(key);
+
+ if (value != null)
+ {
+ try
+ {
+ return Long.valueOf(value);
+ }
+ catch (NumberFormatException e)
+ {
+ return null;
+ }
+ }
+ else
+ {
+ return null;
+ }
+ }
+
static private char _getMnemonic(String text)
{
if (text == null)