diff --git a/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorAttribute.jsp b/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorAttribute.jsp index 3be99dec90..4d71bdb090 100644 --- a/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorAttribute.jsp +++ b/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorAttribute.jsp @@ -1,12 +1,12 @@ <%@ taglib prefix="s" uri="/struts-tags" %> - + - + - \ No newline at end of file + diff --git a/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorMapAttribute.jsp b/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorMapAttribute.jsp index 0033664720..fb95e6bb3a 100644 --- a/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorMapAttribute.jsp +++ b/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorMapAttribute.jsp @@ -2,19 +2,19 @@ – -

:

-

:

+

:

+

:

– -

:

-

:

+

:

+

:

- \ No newline at end of file + diff --git a/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/hypertextAttribute.jsp b/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/hypertextAttribute.jsp index 394fe9f80a..549bcd3623 100644 --- a/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/hypertextAttribute.jsp +++ b/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/hypertextAttribute.jsp @@ -1,2 +1,2 @@ <%@ taglib prefix="s" uri="/struts-tags" %> - \ No newline at end of file + \ No newline at end of file diff --git a/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/longtextAttribute.jsp b/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/longtextAttribute.jsp index ee76188e58..e6617303ad 100644 --- a/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/longtextAttribute.jsp +++ b/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/longtextAttribute.jsp @@ -1,2 +1,2 @@ <%@ taglib prefix="s" uri="/struts-tags" %> - \ No newline at end of file + \ No newline at end of file diff --git a/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/textAttribute.jsp b/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/textAttribute.jsp index ee76188e58..e6617303ad 100644 --- a/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/textAttribute.jsp +++ b/admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/textAttribute.jsp @@ -1,2 +1,2 @@ <%@ taglib prefix="s" uri="/struts-tags" %> - \ No newline at end of file + \ No newline at end of file diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/content/ContentManager.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/content/ContentManager.java index b85fd127c4..af9e180cb4 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/content/ContentManager.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/content/ContentManager.java @@ -46,6 +46,7 @@ import org.entando.entando.ent.exception.EntRuntimeException; import org.entando.entando.ent.util.EntLogging.EntLogFactory; import org.entando.entando.ent.util.EntLogging.EntLogger; +import org.entando.entando.ent.util.LabelSanitizer; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.cache.annotation.CacheEvict; @@ -293,6 +294,7 @@ public String addContent(Content content) throws EntException { private String addUpdateContent(Content content, boolean updateDate) throws EntException { String id = null; try { + content.setDescription(LabelSanitizer.stripMarkup(content.getDescription())); content.setLastModified(new Date()); if (updateDate) { content.incrementVersion(false); diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/contentmodel/ContentModelManager.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/contentmodel/ContentModelManager.java index 91dddcda8b..a91ed57f0c 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/contentmodel/ContentModelManager.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/contentmodel/ContentModelManager.java @@ -33,6 +33,8 @@ import java.util.List; import java.util.Map; import java.util.Properties; + +import org.entando.entando.ent.util.LabelSanitizer; import org.entando.entando.plugins.jacms.aps.system.services.content.widget.RowContentListHelper; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; @@ -113,6 +115,7 @@ public void releaseTenantAware() { */ @Override public void addContentModel(ContentModel model) throws EntException { + model.setDescription(LabelSanitizer.stripMarkup(model.getDescription())); try { this.getContentModelDAO().addContentModel(model); this.getCacheWrapper().addContentModel(model); @@ -149,6 +152,7 @@ public void removeContentModel(ContentModel model) throws EntException { */ @Override public void updateContentModel(ContentModel model) throws EntException { + model.setDescription(LabelSanitizer.stripMarkup(model.getDescription())); try { this.getContentModelDAO().updateContentModel(model); this.getCacheWrapper().updateContentModel(model); diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/ResourceManager.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/ResourceManager.java index da3d4da41f..9b90d7293e 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/ResourceManager.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/ResourceManager.java @@ -40,6 +40,7 @@ import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; import org.entando.entando.ent.util.EntSafeXmlUtils; +import org.entando.entando.ent.util.LabelSanitizer; import org.xml.sax.InputSource; import javax.xml.bind.JAXBContext; @@ -244,6 +245,7 @@ public void deleteResources(List resources) throws EntExcepti */ @Override public void addResource(ResourceInterface resource) throws EntException { + resource.setDescription(LabelSanitizer.stripMarkup(resource.getDescription())); try { this.generateAndSetResourceId(resource, resource.getId()); this.getResourceDAO().addResource(resource); @@ -268,7 +270,7 @@ public void updateResource(ResourceDataBean bean) throws EntException { ResourceInterface oldResource = this.loadResource(bean.getResourceId()); try { if (null == bean.getInputStream()) { - oldResource.setDescription(bean.getDescr()); + oldResource.setDescription(LabelSanitizer.stripMarkup(bean.getDescr())); oldResource.setCategories(bean.getCategories()); oldResource.setMetadata(bean.getMetadata()); oldResource.setMainGroup(bean.getMainGroup()); @@ -299,6 +301,7 @@ public void updateResource(ResourceDataBean bean) throws EntException { */ @Override public void updateResource(ResourceInterface resource) throws EntException { + resource.setDescription(LabelSanitizer.stripMarkup(resource.getDescription())); try { this.getResourceDAO().updateResource(resource); this.notifyResourceChanging(resource, ResourceChangedEvent.UPDATE_OPERATION_CODE); @@ -310,7 +313,7 @@ public void updateResource(ResourceInterface resource) throws EntException { protected ResourceInterface createResource(ResourceDataBean bean) throws EntException { ResourceInterface resource = this.createResourceType(bean.getResourceType()); - resource.setDescription(bean.getDescr()); + resource.setDescription(LabelSanitizer.stripMarkup(bean.getDescr())); resource.setMainGroup(bean.getMainGroup()); resource.setCategories(bean.getCategories()); resource.setMasterFileName(bean.getFileName()); diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/content/helper/ContentActionHelper.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/content/helper/ContentActionHelper.java index 2710fc23f0..d8108b7eac 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/content/helper/ContentActionHelper.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/content/helper/ContentActionHelper.java @@ -23,6 +23,7 @@ import org.apache.commons.lang.StringUtils; import org.apache.struts2.ServletActionContext; import org.entando.entando.aps.system.services.actionlog.model.ActivityStreamInfo; +import org.entando.entando.ent.util.LabelSanitizer; import org.entando.entando.plugins.jacms.aps.system.services.content.helper.IContentHelper; import org.entando.entando.plugins.jacms.aps.util.CmsPageUtil; import org.entando.entando.ent.util.EntLogging.EntLogger; @@ -134,7 +135,8 @@ public void scanEntity(IApsEntity entity, ActionSupport action) { String[] args = {String.valueOf(maxLength)}; action.addFieldError(DESCR, action.getText("error.content.descr.wrongMaxLength", args)); } - if (!descr.matches("([^\"])+")) { + if (!descr.matches("[^\"<>]+")) { + content.setDescription(LabelSanitizer.stripMarkup(content.getDescription())); action.addFieldError(DESCR, action.getText("error.content.descr.wrongCharacters")); } } diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/AbstractResourceAction.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/AbstractResourceAction.java index 5507df1917..de2a2e9872 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/AbstractResourceAction.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/AbstractResourceAction.java @@ -59,6 +59,11 @@ public String getResourceTypeCode() { return _resourceTypeCode; } public void setResourceTypeCode(String resourceTypeCode) { + if (null != resourceTypeCode && null != this.getResourceManager() + && !this.getResourceManager().getResourceTypeCodes().contains(resourceTypeCode)) { + this._resourceTypeCode = null; + return; + } this._resourceTypeCode = resourceTypeCode; } diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/MultipleResourceAction.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/MultipleResourceAction.java index d78d3cbcea..a0ff8c22d6 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/MultipleResourceAction.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/MultipleResourceAction.java @@ -47,6 +47,11 @@ public class MultipleResourceAction extends ResourceAction { public void validate() { logger.debug("MultipleResourceAction validate"); savedId.clear(); + if (!this.getResourceManager().getResourceTypeCodes().contains(this.getResourceTypeCode())) { + logger.warn("Rejected unknown resourceTypeCode value"); + this.addFieldError("resourceTypeCode", this.getText("error.resource.file.genericError")); + return; + } if (ApsAdminSystemConstants.EDIT == this.getStrutsAction()) { this.fetchFileDescriptions(); addFieldErrors(validateFileDescriptions()); diff --git a/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/contentDetails.jsp b/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/contentDetails.jsp index 4a66793978..ba3692bf19 100644 --- a/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/contentDetails.jsp +++ b/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/contentDetails.jsp @@ -328,7 +328,7 @@
- +
diff --git a/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/imageAttribute.jsp b/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/imageAttribute.jsp index 8066909fd7..4edb859e5f 100644 --- a/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/imageAttribute.jsp +++ b/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/imageAttribute.jsp @@ -9,7 +9,7 @@ " - alt="" /> + alt="" /> "> @@ -27,7 +27,7 @@ - " alt="" /> + " alt="" /> "> : @@ -36,7 +36,7 @@ " - alt="" /> + alt="" /> "> diff --git a/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/linkAttribute.jsp b/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/linkAttribute.jsp index 7d4fe37032..6afe64c0ec 100644 --- a/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/linkAttribute.jsp +++ b/cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/linkAttribute.jsp @@ -37,14 +37,14 @@ <%-- link icon --%> - " class="" title=""> + " class="" title=""> <%-- text of the link --%> - + <%-- valid link --%> - \ No newline at end of file + diff --git a/cms-plugin/src/test/java/com/agiletec/plugins/jacms/apsadmin/resource/TestMultipleResourceAction.java b/cms-plugin/src/test/java/com/agiletec/plugins/jacms/apsadmin/resource/TestMultipleResourceAction.java index 4b2e01875d..498989d4cf 100644 --- a/cms-plugin/src/test/java/com/agiletec/plugins/jacms/apsadmin/resource/TestMultipleResourceAction.java +++ b/cms-plugin/src/test/java/com/agiletec/plugins/jacms/apsadmin/resource/TestMultipleResourceAction.java @@ -92,8 +92,8 @@ void testSaveNewResourceStrutsValidation() throws Throwable { assertEquals(Action.INPUT, result); ActionSupport action = this.getAction(); Map> actionFieldErrors = action.getFieldErrors(); - assertEquals(6, actionFieldErrors.size()); - assertEquals(1, actionFieldErrors.get("resourceTypeCode").size()); + assertEquals(2, actionFieldErrors.size()); + assertEquals(2, actionFieldErrors.get("resourceTypeCode").size()); assertEquals(1, actionFieldErrors.get("mainGroup").size()); } diff --git a/engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java b/engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java index bd56e904e0..970cba53fd 100644 --- a/engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java @@ -59,6 +59,7 @@ import org.apache.commons.beanutils.BeanComparator; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; +import org.entando.entando.ent.util.LabelSanitizer; import org.xml.sax.InputSource; import org.xml.sax.SAXException; @@ -254,6 +255,7 @@ public void addEntityPrototype(IApsEntity entityType) throws EntException { if (null == entityType) { throw new EntException("Invalid entity type to add"); } + this.sanitizeEntityTypeLabels(entityType); Map newEntityTypes = this.getEntityTypes(); newEntityTypes.put(entityType.getTypeCode(), entityType); this.updateEntityPrototypes(newEntityTypes); @@ -271,6 +273,7 @@ public void updateEntityPrototype(IApsEntity entityType) throws EntException { if (null == entityType) { throw new EntException("Invalid entity type to update"); } + this.sanitizeEntityTypeLabels(entityType); Map entityTypes = this.getEntityTypes(); IApsEntity oldEntityType = entityTypes.get(entityType.getTypeCode()); if (null == oldEntityType) { @@ -282,6 +285,23 @@ public void updateEntityPrototype(IApsEntity entityType) throws EntException { this.notifyEntityTypesChanging(oldEntityType, entityType, EntityTypesChangingEvent.UPDATE_OPERATION_CODE); } + /** + * Strips markup from the user-supplied label fields of an entity type (its description + * and the name/description of each attribute) before it is persisted + */ + private void sanitizeEntityTypeLabels(IApsEntity entityType) { + entityType.setTypeCode(LabelSanitizer.stripMarkup(entityType.getTypeCode())); + entityType.setTypeDescription(LabelSanitizer.stripMarkup(entityType.getTypeDescription())); + List attributes = entityType.getAttributeList(); + if (null != attributes) { + for (AttributeInterface attribute : attributes) { + attribute.setName(LabelSanitizer.stripMarkup(attribute.getName())); + attribute.setDescription(LabelSanitizer.stripMarkup(attribute.getDescription())); + LabelSanitizer.stripMarkup(attribute.getNames()); + } + } + } + protected void verifyReloadingNeeded(IApsEntity oldEntityType, IApsEntity newEntityType) { if (this.getStatus(newEntityType.getTypeCode()) == STATUS_NEED_TO_RELOAD_REFERENCES) { return; diff --git a/engine/src/main/java/com/agiletec/aps/system/services/category/CategoryManager.java b/engine/src/main/java/com/agiletec/aps/system/services/category/CategoryManager.java index 393bf7ddbd..0967cee118 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/category/CategoryManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/category/CategoryManager.java @@ -23,6 +23,7 @@ import org.entando.entando.aps.system.services.tenants.RefreshableBeanTenantAware; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; +import org.entando.entando.ent.util.LabelSanitizer; import org.springframework.beans.factory.BeanFactoryUtils; import org.springframework.beans.factory.ListableBeanFactory; @@ -82,6 +83,8 @@ private void initCache() throws EntException { */ @Override public void addCategory(Category category) throws EntException { + category.setCode(LabelSanitizer.stripMarkup(category.getCode())); + LabelSanitizer.stripMarkup(category.getTitles()); try { this.getCategoryDAO().addCategory(category); this.getCacheWrapper().addCategory(category); @@ -121,6 +124,7 @@ public void deleteCategory(String code) throws EntException { */ @Override public void updateCategory(Category category) throws EntException { + LabelSanitizer.stripMarkup(category.getTitles()); try { this.getCategoryDAO().updateCategory(category); this.getCacheWrapper().updateCategory(category); diff --git a/engine/src/main/java/com/agiletec/aps/system/services/group/GroupManager.java b/engine/src/main/java/com/agiletec/aps/system/services/group/GroupManager.java index e77b7aa0d6..565e763929 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/group/GroupManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/group/GroupManager.java @@ -27,6 +27,7 @@ import org.apache.commons.beanutils.BeanComparator; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; +import org.entando.entando.ent.util.LabelSanitizer; /** * Servizio gestore dei gruppi. @@ -87,6 +88,7 @@ public void releaseTenantAware() { @Override public void addGroup(Group group) throws EntException { try { + group.setDescr(LabelSanitizer.stripMarkup(group.getDescr())); this.getGroupDAO().addGroup(group); this.getCacheWrapper().addGroup(group); } catch (Throwable t) { @@ -121,6 +123,7 @@ public void removeGroup(Group group) throws EntException { @Override public void updateGroup(Group group) throws EntException { try { + group.setDescr(LabelSanitizer.stripMarkup(group.getDescr())); this.getGroupDAO().updateGroup(group); this.getCacheWrapper().updateGroup(group); } catch (Throwable t) { diff --git a/engine/src/main/java/com/agiletec/aps/system/services/page/PageManager.java b/engine/src/main/java/com/agiletec/aps/system/services/page/PageManager.java index b1b0337c7d..b934f21318 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/page/PageManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/page/PageManager.java @@ -45,6 +45,7 @@ import org.entando.entando.ent.exception.EntException; import org.entando.entando.ent.util.EntLogging.EntLogFactory; import org.entando.entando.ent.util.EntLogging.EntLogger; +import org.entando.entando.ent.util.LabelSanitizer; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; @@ -131,6 +132,7 @@ public synchronized void deletePage(String pageCode) throws EntException { */ @Override public synchronized void addPage(IPage page) throws EntException { + LabelSanitizer.stripMarkup(page.getTitles()); try { IPage parent = this.getDraftPage(page.getParentCode()); if (null == parent) { @@ -165,6 +167,7 @@ public synchronized void addPage(IPage page) throws EntException { */ @Override public synchronized void updatePage(IPage page) throws EntException { + LabelSanitizer.stripMarkup(page.getTitles()); try { this.getPageDAO().updatePage(page); this.getCacheWrapper().updateDraftPage(page); diff --git a/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelDOM.java b/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelDOM.java index 87915ab977..fc67972f4f 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelDOM.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelDOM.java @@ -109,6 +109,10 @@ private Element buildSketchXML(Frame frame) { private void decodeDOM(String xmlText) throws EntException { SAXBuilder builder = new SAXBuilder(); builder.setValidation(false); + builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + builder.setFeature("http://xml.org/sax/features/external-general-entities", false); + builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); StringReader reader = new StringReader(xmlText); try { _doc = builder.build(reader); diff --git a/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelManager.java b/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelManager.java index d61333449d..ba99896b5c 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelManager.java @@ -23,6 +23,7 @@ import org.entando.entando.aps.system.services.guifragment.GuiFragmentUtilizer; import org.entando.entando.ent.util.EntLogging.EntLogFactory; import org.entando.entando.ent.util.EntLogging.EntLogger; +import org.entando.entando.ent.util.LabelSanitizer; import java.util.*; import java.util.regex.*; @@ -87,6 +88,8 @@ public void addPageModel(PageModel pageModel) throws EntException { logger.debug("Null page template can be add"); return; } + pageModel.setCode(LabelSanitizer.stripMarkup(pageModel.getCode())); + pageModel.setDescription(LabelSanitizer.stripMarkup(pageModel.getDescription())); try { this.getPageModelDAO().addModel(pageModel); this.getCacheWrapper().addPageModel(pageModel); @@ -103,6 +106,8 @@ public void updatePageModel(PageModel pageModel) throws EntException { logger.debug("Null page template can be update"); return; } + pageModel.setCode(LabelSanitizer.stripMarkup(pageModel.getCode())); + pageModel.setDescription(LabelSanitizer.stripMarkup(pageModel.getDescription())); try { PageModel pageModelToUpdate = this.getCacheWrapper().getPageModel(pageModel.getCode()); if (null == pageModelToUpdate) { diff --git a/engine/src/main/java/com/agiletec/aps/system/services/role/RoleManager.java b/engine/src/main/java/com/agiletec/aps/system/services/role/RoleManager.java index 614d622fd9..8a3c0a592f 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/role/RoleManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/role/RoleManager.java @@ -25,6 +25,7 @@ import com.agiletec.aps.system.services.role.cache.IRoleCacheWrapper; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; +import org.entando.entando.ent.util.LabelSanitizer; /** * Servizio di gestione dei ruoli. @@ -110,6 +111,7 @@ public void removeRole(Role role) throws EntException { */ @Override public void updateRole(Role role) throws EntException { + role.setDescription(LabelSanitizer.stripMarkup(role.getDescription())); try { this.getRoleDAO().updateRole(role); this.getRoleCacheWrapper().updateRole(role); @@ -127,6 +129,7 @@ public void updateRole(Role role) throws EntException { */ @Override public void addRole(Role role) throws EntException { + role.setDescription(LabelSanitizer.stripMarkup(role.getDescription())); try { this.getRoleDAO().addRole(role); this.getRoleCacheWrapper().addRole(role); diff --git a/engine/src/main/java/org/entando/entando/aps/system/services/guifragment/GuiFragmentManager.java b/engine/src/main/java/org/entando/entando/aps/system/services/guifragment/GuiFragmentManager.java index d8ed2609c8..88c6895997 100644 --- a/engine/src/main/java/org/entando/entando/aps/system/services/guifragment/GuiFragmentManager.java +++ b/engine/src/main/java/org/entando/entando/aps/system/services/guifragment/GuiFragmentManager.java @@ -32,6 +32,7 @@ import org.entando.entando.aps.system.services.guifragment.event.GuiFragmentChangedEvent; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; +import org.entando.entando.ent.util.LabelSanitizer; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.cache.annotation.CacheEvict; @@ -128,6 +129,7 @@ protected FieldSearchFilter[] addFilter(FieldSearchFilter[] filters, FieldSearch @CacheEvict(value = ICacheInfoManager.DEFAULT_CACHE_NAME, key = "'GuiFragment_'.concat(#guiFragment.code)") public void addGuiFragment(GuiFragment guiFragment) throws EntException { try { + guiFragment.setCode(LabelSanitizer.stripMarkup(guiFragment.getCode())); this.getGuiFragmentDAO().insertGuiFragment(guiFragment); this.notifyGuiFragmentChangedEvent(guiFragment, GuiFragmentChangedEvent.INSERT_OPERATION_CODE); this.evictGroups(); @@ -141,6 +143,7 @@ public void addGuiFragment(GuiFragment guiFragment) throws EntException { @CacheEvict(value = ICacheInfoManager.DEFAULT_CACHE_NAME, key = "'GuiFragment_'.concat(#guiFragment.code)") public void updateGuiFragment(GuiFragment guiFragment) throws EntException { try { + guiFragment.setCode(LabelSanitizer.stripMarkup(guiFragment.getCode())); this.getGuiFragmentDAO().updateGuiFragment(guiFragment); this.notifyGuiFragmentChangedEvent(guiFragment, GuiFragmentChangedEvent.UPDATE_OPERATION_CODE); this.evictGroups(); diff --git a/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeManager.java b/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeManager.java index 13b7aa5451..4229570b2a 100644 --- a/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeManager.java +++ b/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeManager.java @@ -30,6 +30,7 @@ import org.entando.entando.ent.exception.EntException; import org.entando.entando.ent.util.EntLogging.EntLogFactory; import org.entando.entando.ent.util.EntLogging.EntLogger; +import org.entando.entando.ent.util.LabelSanitizer; import java.util.ArrayList; import java.util.Collections; @@ -120,6 +121,7 @@ public void addWidgetType(WidgetType widgetType) throws EntException { if (null != widgetType.getTypeParameters() && null != widgetType.getConfig()) { throw new EntException("ERROR : Params not null and config not null"); } + LabelSanitizer.stripMarkup(widgetType.getTitles()); this.getWidgetTypeDAO().addWidgetType(widgetType); this.getCacheWrapper().addWidgetType(widgetType); this.notifyWidgetTypeChanging(widgetType.getCode(), WidgetTypeChangedEvent.INSERT_OPERATION_CODE); @@ -220,6 +222,7 @@ public void updateWidgetType(String widgetTypeCode, ApsProperties titles, ApsPro } else { readonlyPageWidgetConfigLocalVar = readonlyPageWidgetConfig; } + LabelSanitizer.stripMarkup(titles); this.getWidgetTypeDAO().updateWidgetType(widgetTypeCode, titles, defaultConfig, mainGroup, configUi, bundleId, readonlyPageWidgetConfigLocalVar, widgetCategory, icon); type.setTitles(titles); type.setConfig(defaultConfig); diff --git a/engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java b/engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java new file mode 100644 index 0000000000..4cdc254e39 --- /dev/null +++ b/engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java @@ -0,0 +1,58 @@ +/* + * Copyright 2015-Present Entando Inc. (http://www.entando.com) All rights reserved. + * + * This library is free software; you can redistribute it and/or modify it under + * the terms of the GNU Lesser General Public License as published by the Free + * Software Foundation; either version 2.1 of the License, or (at your option) + * any later version. + * + * This library is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more + * details. + */ +package org.entando.entando.ent.util; + +import java.util.ArrayList; +import com.agiletec.aps.util.ApsProperties; + +/** + * Neutralizes stored XSS in short free-text label fields (titles, names, + * descriptions) by removing the characters that allow HTML element injection. + */ +public final class LabelSanitizer { + + private LabelSanitizer() { + } + + /** + * The single quote is intentionally preserved, being legitimate and common in + * titles/descriptions; all known attribute sinks for these fields are double-quoted. + * Null-safe and idempotent. + */ + public static String stripMarkup(String value) { + return (value == null) ? null + : value.replace("<", "") + .replace(">", "") + .replace("\"", "") + .replace("<", "") + .replace(">", "") + .replace(""", ""); + } + + /** + * Applies {@link #stripMarkup(String)} to every String value of the given properties + * in place (e.g. the per-language titles/names maps). + */ + public static void stripMarkup(ApsProperties properties) { + if (null == properties) { + return; + } + for (Object key : new ArrayList<>(properties.keySet())) { + Object value = properties.get(key); + if (value instanceof String) { + properties.put(key, stripMarkup((String)value)); + } + } + } +}