Skip to content

ESB-1163 patch WAPT high #358

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alexcasent wants to merge 3 commits into
base: release/7.2
Choose a base branch
from
Open

ESB-1163 patch WAPT high #358

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ca1dd7f
ESB-1150 FIX SSTI in resource TypeCode
ffalqui Jun 29, 2026
0fa23ea
ESB-1151: FIX XSS: Sanitize user input by stripping potentially unsaf…
alexcasent Jun 30, 2026
14a180e
ESB-1146 ESB-1146 Fix XEE in PageModelDOM
MEM2677 Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
<%@ taglib prefix="s" uri="/struts-tags" %>
<s:if test="#lang.default">
<s:property value="%{#attribute.getText()}" />
<s:property value="#attribute.getText()" escapeHtml="true" />
</s:if>
<s:else>
<s:if test="#attributeTracer.listElement">
<s:property value="%{#attribute.getText()}" />
<s:property value="#attribute.getText()" escapeHtml="true" />
</s:if>
<s:else>
<s:text name="EntityAttribute.monolang.defaultValue" />
</s:else>
</s:else>
</s:else>
10 changes: 5 additions & 5 deletions admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorMapAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,19 @@
<s:if test="#lang.default">
<s:if test="%{null == #attribute.getMapKey()}" >&ndash;</s:if>
<s:else>
<p><label><s:text name="label.key" /></label>:&#32;<s:property value="%{#attribute.getMapKey()}" /></p>
<p><label><s:text name="label.value" /></label>:&#32;<s:property value="%{#attribute.getMapValue()}" /></p>
<p><label><s:text name="label.key" /></label>:&#32;<s:property value="#attribute.getMapKey()" escapeHtml="true" /></p>
<p><label><s:text name="label.value" /></label>:&#32;<s:property value="#attribute.getMapValue()" escapeHtml="true" /></p>
</s:else>
</s:if>
<s:else>
<s:if test="#attributeTracer.listElement">
<s:if test="%{null == #attribute.getMapKey()}" >&ndash;</s:if>
<s:else>
<p><label><s:text name="label.key" /></label>:&#32;<s:property value="%{#attribute.getMapKey()}" /></p>
<p><label><s:text name="label.value" /></label>:&#32;<s:property value="%{#attribute.getMapValue()}" /></p>
<p><label><s:text name="label.key" /></label>:&#32;<s:property value="#attribute.getMapKey()" escapeHtml="true" /></p>
<p><label><s:text name="label.value" /></label>:&#32;<s:property value="#attribute.getMapValue()" escapeHtml="true" /></p>
</s:else>
</s:if>
<s:else>
<s:text name="EntityAttribute.monolang.defaultValue" />
</s:else>
</s:else>
</s:else>
2 changes: 1 addition & 1 deletion admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/hypertextAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
<%@ taglib prefix="s" uri="/struts-tags" %>
<s:property value="#attribute.getTextForLang(#lang.code)" escapeHtml="false" />
<s:property value="#attribute.getTextForLang(#lang.code)" escapeHtml="true" />
2 changes: 1 addition & 1 deletion admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/longtextAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
<%@ taglib prefix="s" uri="/struts-tags" %>
<s:property value="%{#attribute.getTextForLang(#lang.code)}" />
<s:property value="#attribute.getTextForLang(#lang.code)" escapeHtml="true" />
2 changes: 1 addition & 1 deletion admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/textAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
<%@ taglib prefix="s" uri="/struts-tags" %>
<s:property value="%{#attribute.getTextForLang(#lang.code)}" />
<s:property value="#attribute.getTextForLang(#lang.code)" escapeHtml="true" />
2 changes: 2 additions & 0 deletions .../src/main/java/com/agiletec/plugins/jacms/aps/system/services/content/ContentManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@
import org.entando.entando.ent.exception.EntRuntimeException;
import org.entando.entando.ent.util.EntLogging.EntLogFactory;
import org.entando.entando.ent.util.EntLogging.EntLogger;
import org.entando.entando.ent.util.LabelSanitizer;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.cache.annotation.CacheEvict;

Expand Down Expand Up @@ -293,6 +294,7 @@ public String addContent(Content content) throws EntException {
private String addUpdateContent(Content content, boolean updateDate) throws EntException {
String id = null;
try {
content.setDescription(LabelSanitizer.stripMarkup(content.getDescription()));
content.setLastModified(new Date());
if (updateDate) {
content.incrementVersion(false);
Expand Down
4 changes: 4 additions & 0 deletions ...java/com/agiletec/plugins/jacms/aps/system/services/contentmodel/ContentModelManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,8 @@
import java.util.List;
import java.util.Map;
import java.util.Properties;

import org.entando.entando.ent.util.LabelSanitizer;
import org.entando.entando.plugins.jacms.aps.system.services.content.widget.RowContentListHelper;
import org.entando.entando.ent.util.EntLogging.EntLogger;
import org.entando.entando.ent.util.EntLogging.EntLogFactory;
Expand Down Expand Up @@ -113,6 +115,7 @@ public void releaseTenantAware() {
*/
@Override
public void addContentModel(ContentModel model) throws EntException {
model.setDescription(LabelSanitizer.stripMarkup(model.getDescription()));
try {
this.getContentModelDAO().addContentModel(model);
this.getCacheWrapper().addContentModel(model);
Expand Down Expand Up @@ -149,6 +152,7 @@ public void removeContentModel(ContentModel model) throws EntException {
*/
@Override
public void updateContentModel(ContentModel model) throws EntException {
model.setDescription(LabelSanitizer.stripMarkup(model.getDescription()));
try {
this.getContentModelDAO().updateContentModel(model);
this.getCacheWrapper().updateContentModel(model);
Expand Down
7 changes: 5 additions & 2 deletions ...rc/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/ResourceManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@
import org.entando.entando.ent.util.EntLogging.EntLogger;
import org.entando.entando.ent.util.EntLogging.EntLogFactory;
import org.entando.entando.ent.util.EntSafeXmlUtils;
import org.entando.entando.ent.util.LabelSanitizer;
import org.xml.sax.InputSource;

import javax.xml.bind.JAXBContext;
Expand Down Expand Up @@ -244,6 +245,7 @@ public void deleteResources(List<ResourceInterface> resources) throws EntExcepti
*/
@Override
public void addResource(ResourceInterface resource) throws EntException {
resource.setDescription(LabelSanitizer.stripMarkup(resource.getDescription()));
try {
this.generateAndSetResourceId(resource, resource.getId());
this.getResourceDAO().addResource(resource);
Expand All @@ -268,7 +270,7 @@ public void updateResource(ResourceDataBean bean) throws EntException {
ResourceInterface oldResource = this.loadResource(bean.getResourceId());
try {
if (null == bean.getInputStream()) {
oldResource.setDescription(bean.getDescr());
oldResource.setDescription(LabelSanitizer.stripMarkup(bean.getDescr()));
oldResource.setCategories(bean.getCategories());
oldResource.setMetadata(bean.getMetadata());
oldResource.setMainGroup(bean.getMainGroup());
Expand Down Expand Up @@ -299,6 +301,7 @@ public void updateResource(ResourceDataBean bean) throws EntException {
*/
@Override
public void updateResource(ResourceInterface resource) throws EntException {
resource.setDescription(LabelSanitizer.stripMarkup(resource.getDescription()));
try {
this.getResourceDAO().updateResource(resource);
this.notifyResourceChanging(resource, ResourceChangedEvent.UPDATE_OPERATION_CODE);
Expand All @@ -310,7 +313,7 @@ public void updateResource(ResourceInterface resource) throws EntException {

protected ResourceInterface createResource(ResourceDataBean bean) throws EntException {
ResourceInterface resource = this.createResourceType(bean.getResourceType());
resource.setDescription(bean.getDescr());
resource.setDescription(LabelSanitizer.stripMarkup(bean.getDescr()));
resource.setMainGroup(bean.getMainGroup());
resource.setCategories(bean.getCategories());
resource.setMasterFileName(bean.getFileName());
Expand Down
4 changes: 3 additions & 1 deletion ...src/main/java/com/agiletec/plugins/jacms/apsadmin/content/helper/ContentActionHelper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
import org.apache.commons.lang.StringUtils;
import org.apache.struts2.ServletActionContext;
import org.entando.entando.aps.system.services.actionlog.model.ActivityStreamInfo;
import org.entando.entando.ent.util.LabelSanitizer;
import org.entando.entando.plugins.jacms.aps.system.services.content.helper.IContentHelper;
import org.entando.entando.plugins.jacms.aps.util.CmsPageUtil;
import org.entando.entando.ent.util.EntLogging.EntLogger;
Expand Down Expand Up @@ -134,7 +135,8 @@ public void scanEntity(IApsEntity entity, ActionSupport action) {
String[] args = {String.valueOf(maxLength)};
action.addFieldError(DESCR, action.getText("error.content.descr.wrongMaxLength", args));
}
if (!descr.matches("([^\"])+")) {
if (!descr.matches("[^\"<>]+")) {
content.setDescription(LabelSanitizer.stripMarkup(content.getDescription()));
action.addFieldError(DESCR, action.getText("error.content.descr.wrongCharacters"));
}
}
Expand Down
5 changes: 5 additions & 0 deletions ...in/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/AbstractResourceAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,11 @@ public String getResourceTypeCode() {
return _resourceTypeCode;
}
public void setResourceTypeCode(String resourceTypeCode) {
if (null != resourceTypeCode && null != this.getResourceManager()
&& !this.getResourceManager().getResourceTypeCodes().contains(resourceTypeCode)) {
this._resourceTypeCode = null;
return;
}
this._resourceTypeCode = resourceTypeCode;
}

Expand Down
5 changes: 5 additions & 0 deletions ...in/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/MultipleResourceAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,11 @@ public class MultipleResourceAction extends ResourceAction {
public void validate() {
logger.debug("MultipleResourceAction validate");
savedId.clear();
if (!this.getResourceManager().getResourceTypeCodes().contains(this.getResourceTypeCode())) {
logger.warn("Rejected unknown resourceTypeCode value");
this.addFieldError("resourceTypeCode", this.getText("error.resource.file.genericError"));
return;
}
if (ApsAdminSystemConstants.EDIT == this.getStrutsAction()) {
this.fetchFileDescriptions();
addFieldErrors(validateFileDescriptions());
Expand Down
2 changes: 1 addition & 1 deletion cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/contentDetails.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,7 +328,7 @@
</s:if>
<s:else>
<div class="text-muted">
<s:property value="#attribute.getText()" />
<s:property value="#attribute.getText()" escapeHtml="true" />
</div>
</s:else>
</s:else>
Expand Down
6 changes: 3 additions & 3 deletions ...plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/imageAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
<img
class="img-thumbnail"
src="<s:property value="#defaultResource.getImagePath('1')"/>"
alt="<s:property value="#defaultResource.descr"/>" />
alt="<s:property value="#defaultResource.descr" escapeHtml="true"/>" />
<span class="sr-only">
<abbr
title="<s:text name="label.img.text.long" />">
Expand All @@ -27,7 +27,7 @@
</s:if>
<s:else>
<s:if test="#currentResource != null">
<img class="img-thumbnail" src="<s:property value="#currentResource.getImagePath('1')"/>" alt="<s:property value="#currentResource.descr"/>" />
<img class="img-thumbnail" src="<s:property value="#currentResource.getImagePath('1')"/>" alt="<s:property value="#currentResource.descr" escapeHtml="true"/>" />
<span class="sr-only">
<abbr title="<s:text name="label.img.text.long" />"> <s:text name="label.img.text.short" /></abbr>:&#32;
</span>
Expand All @@ -36,7 +36,7 @@
<img
class="img-thumbnail"
src="<s:property value="#defaultResource.getImagePath('1')"/>"
alt="<s:property value="#defaultResource.descr"/>" />
alt="<s:property value="#defaultResource.descr" escapeHtml="true"/>" />
<span class="sr-only">
<abbr
title="<s:text name="label.img.text.long" />">
Expand Down
6 changes: 3 additions & 3 deletions cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/linkAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,14 +37,14 @@
<s:set var="linkDestination" value="%{getText('note.contentLinkTo') + ': ' + #attribute.symbolicLink.contentDest + ' - ' + #linkedContent.descr + ', ' + getText('note.contentOnPageLinkTo') + ': ' + #linkedPage.titles[currentLang.code]}" />
</s:elseif>
<%-- link icon --%>
<a href="<s:property value="#attribute.symbolicLink.contentDest" />" class="<s:property value="#statusIconVar" />" title="<s:property value="#linkDestination" />"><span class="sr-only"><s:property value="#linkDestination" /></span></a>
<a href="<s:property value="#attribute.symbolicLink.contentDest" />" class="<s:property value="#statusIconVar" />" title="<s:property value="#linkDestination" escapeHtml="true" />"><span class="sr-only"><s:property value="#linkDestination" escapeHtml="true" /></span></a>
<%-- text of the link --%>
<s:if test="%{#attribute.getTextForLang(#lang.code)==null}">
<span class="text-muted">&#32;<s:property value="#attribute.getText()" /></span>
<span class="text-muted">&#32;<s:property value="#attribute.getText()" escapeHtml="true" /></span>
</s:if>
<s:else>
&#32;<s:include value="/WEB-INF/apsadmin/jsp/entity/view/textAttribute.jsp" />
</s:else>
</s:if><%-- valid link --%>
</s:if>
<s:else><s:text name="label.none" /></s:else>
<s:else><s:text name="label.none" /></s:else>
4 changes: 2 additions & 2 deletions ...rc/test/java/com/agiletec/plugins/jacms/apsadmin/resource/TestMultipleResourceAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,8 +92,8 @@ void testSaveNewResourceStrutsValidation() throws Throwable {
assertEquals(Action.INPUT, result);
ActionSupport action = this.getAction();
Map<String, List<String>> actionFieldErrors = action.getFieldErrors();
assertEquals(6, actionFieldErrors.size());
assertEquals(1, actionFieldErrors.get("resourceTypeCode").size());
assertEquals(2, actionFieldErrors.size());
assertEquals(2, actionFieldErrors.get("resourceTypeCode").size());
assertEquals(1, actionFieldErrors.get("mainGroup").size());
}

Expand Down
20 changes: 20 additions & 0 deletions engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@
import org.apache.commons.beanutils.BeanComparator;
import org.entando.entando.ent.util.EntLogging.EntLogger;
import org.entando.entando.ent.util.EntLogging.EntLogFactory;
import org.entando.entando.ent.util.LabelSanitizer;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;

Expand Down Expand Up @@ -254,6 +255,7 @@ public void addEntityPrototype(IApsEntity entityType) throws EntException {
if (null == entityType) {
throw new EntException("Invalid entity type to add");
}
this.sanitizeEntityTypeLabels(entityType);
Map<String, IApsEntity> newEntityTypes = this.getEntityTypes();
newEntityTypes.put(entityType.getTypeCode(), entityType);
this.updateEntityPrototypes(newEntityTypes);
Expand All @@ -271,6 +273,7 @@ public void updateEntityPrototype(IApsEntity entityType) throws EntException {
if (null == entityType) {
throw new EntException("Invalid entity type to update");
}
this.sanitizeEntityTypeLabels(entityType);
Map<String, IApsEntity> entityTypes = this.getEntityTypes();
IApsEntity oldEntityType = entityTypes.get(entityType.getTypeCode());
if (null == oldEntityType) {
Expand All @@ -282,6 +285,23 @@ public void updateEntityPrototype(IApsEntity entityType) throws EntException {
this.notifyEntityTypesChanging(oldEntityType, entityType, EntityTypesChangingEvent.UPDATE_OPERATION_CODE);
}

/**
* Strips markup from the user-supplied label fields of an entity type (its description
* and the name/description of each attribute) before it is persisted
*/
private void sanitizeEntityTypeLabels(IApsEntity entityType) {
entityType.setTypeCode(LabelSanitizer.stripMarkup(entityType.getTypeCode()));
entityType.setTypeDescription(LabelSanitizer.stripMarkup(entityType.getTypeDescription()));
List<AttributeInterface> attributes = entityType.getAttributeList();
if (null != attributes) {
for (AttributeInterface attribute : attributes) {
attribute.setName(LabelSanitizer.stripMarkup(attribute.getName()));
attribute.setDescription(LabelSanitizer.stripMarkup(attribute.getDescription()));
LabelSanitizer.stripMarkup(attribute.getNames());
}
}
}

protected void verifyReloadingNeeded(IApsEntity oldEntityType, IApsEntity newEntityType) {
if (this.getStatus(newEntityType.getTypeCode()) == STATUS_NEED_TO_RELOAD_REFERENCES) {
return;
Expand Down
4 changes: 4 additions & 0 deletions engine/src/main/java/com/agiletec/aps/system/services/category/CategoryManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
import org.entando.entando.aps.system.services.tenants.RefreshableBeanTenantAware;
import org.entando.entando.ent.util.EntLogging.EntLogger;
import org.entando.entando.ent.util.EntLogging.EntLogFactory;
import org.entando.entando.ent.util.LabelSanitizer;
import org.springframework.beans.factory.BeanFactoryUtils;
import org.springframework.beans.factory.ListableBeanFactory;

Expand Down Expand Up @@ -82,6 +83,8 @@ private void initCache() throws EntException {
*/
@Override
public void addCategory(Category category) throws EntException {
category.setCode(LabelSanitizer.stripMarkup(category.getCode()));
LabelSanitizer.stripMarkup(category.getTitles());
try {
this.getCategoryDAO().addCategory(category);
this.getCacheWrapper().addCategory(category);
Expand Down Expand Up @@ -121,6 +124,7 @@ public void deleteCategory(String code) throws EntException {
*/
@Override
public void updateCategory(Category category) throws EntException {
LabelSanitizer.stripMarkup(category.getTitles());
try {
this.getCategoryDAO().updateCategory(category);
this.getCacheWrapper().updateCategory(category);
Expand Down
3 changes: 3 additions & 0 deletions engine/src/main/java/com/agiletec/aps/system/services/group/GroupManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import org.apache.commons.beanutils.BeanComparator;
import org.entando.entando.ent.util.EntLogging.EntLogger;
import org.entando.entando.ent.util.EntLogging.EntLogFactory;
import org.entando.entando.ent.util.LabelSanitizer;

/**
* Servizio gestore dei gruppi.
Expand Down Expand Up @@ -87,6 +88,7 @@ public void releaseTenantAware() {
@Override
public void addGroup(Group group) throws EntException {
try {
group.setDescr(LabelSanitizer.stripMarkup(group.getDescr()));
this.getGroupDAO().addGroup(group);
this.getCacheWrapper().addGroup(group);
} catch (Throwable t) {
Expand Down Expand Up @@ -121,6 +123,7 @@ public void removeGroup(Group group) throws EntException {
@Override
public void updateGroup(Group group) throws EntException {
try {
group.setDescr(LabelSanitizer.stripMarkup(group.getDescr()));
this.getGroupDAO().updateGroup(group);
this.getCacheWrapper().updateGroup(group);
} catch (Throwable t) {
Expand Down
3 changes: 3 additions & 0 deletions engine/src/main/java/com/agiletec/aps/system/services/page/PageManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@
import org.entando.entando.ent.exception.EntException;
import org.entando.entando.ent.util.EntLogging.EntLogFactory;
import org.entando.entando.ent.util.EntLogging.EntLogger;
import org.entando.entando.ent.util.LabelSanitizer;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;

Expand Down Expand Up @@ -131,6 +132,7 @@ public synchronized void deletePage(String pageCode) throws EntException {
*/
@Override
public synchronized void addPage(IPage page) throws EntException {
LabelSanitizer.stripMarkup(page.getTitles());
try {
IPage parent = this.getDraftPage(page.getParentCode());
if (null == parent) {
Expand Down Expand Up @@ -165,6 +167,7 @@ public synchronized void addPage(IPage page) throws EntException {
*/
@Override
public synchronized void updatePage(IPage page) throws EntException {
LabelSanitizer.stripMarkup(page.getTitles());
try {
this.getPageDAO().updatePage(page);
this.getCacheWrapper().updateDraftPage(page);
Expand Down
4 changes: 4 additions & 0 deletions engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelDOM.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,10 @@ private Element buildSketchXML(Frame frame) {
private void decodeDOM(String xmlText) throws EntException {
SAXBuilder builder = new SAXBuilder();
builder.setValidation(false);
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
builder.setFeature("http://xml.org/sax/features/external-general-entities", false);
builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
StringReader reader = new StringReader(xmlText);
try {
_doc = builder.build(reader);
Expand Down
Loading
Loading