Skip to content

Commit fca2483

Browse files
mmoquiNicolasEYSSERIC
mmoqui
authored and
NicolasEYSSERIC
committed
bug #4737 : Add a whitelist of files that can be uploaded. The whitelist is based upon the file extension.
1 parent 8309eb4 commit fca2483

File tree

3 files changed

+71
-35
lines changed

3 files changed

+71
-35
lines changed

‎websites/websites-config/src/main/config/properties/org/silverpeas/webSites/settings/webSiteSettings.properties

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@
2121
# You should have received a copy of the GNU Affero General Public License
2222
# along with this program. If not, see <http://www.gnu.org/licenses/>.
2323
#
24-
Machine =
24+
Machine =
2525
Context = website
26-
uploadsPath = /Silverpeas/KMEdition/Production/
26+
uploadsPath = /Silverpeas/KMEdition/Production/
27+
# while list of file extension permitted for the file upload
28+
whiteList = html htm js odt doc pdf

‎websites/websites-war/src/main/java/com/stratelia/webactiv/webSites/control/WebSiteSessionController.java

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,13 +58,15 @@
5858
import java.io.File;
5959
import java.rmi.RemoteException;
6060
import java.util.ArrayList;
61+
import java.util.Arrays;
6162
import java.util.Collection;
6263
import java.util.Date;
6364
import java.util.Iterator;
6465
import java.util.List;
6566
import javax.ejb.EJBException;
6667
import javax.xml.bind.JAXBException;
6768
import org.apache.commons.fileupload.FileItem;
69+
import org.apache.commons.io.FilenameUtils;
6870

6971
import static com.silverpeas.pdc.model.PdcClassification.aPdcClassificationOfContent;
7072

@@ -78,6 +80,7 @@ public class WebSiteSessionController extends AbstractComponentSessionController
7880
private String siteName;
7981
public final static String TAB_PDC = "tabPdc";
8082
private static final String WEBSITE_REPO_PROPERTY = "uploadsPath";
83+
private static final String WEBSITE_WHITE_LIST = "whiteList";
8184

8285
public WebSiteSessionController(MainSessionController mainSessionCtrl,
8386
ComponentContext componentContext) {
@@ -891,6 +894,18 @@ private String getFullPath(String relativePath) throws WebSitesException {
891894
return getWebSiteRepositoryPath() + relativePath;
892895
}
893896

897+
public int addFileIntoWebSite(String webSitePath, FileItem fileItem) throws Exception {
898+
String fileName = FileUploadUtil.getFileName(fileItem);
899+
if (isInWhiteList(fileName)) {
900+
String path = getWebSiteRepositoryPath() + "/" + webSitePath;
901+
File file = new File(path, fileName);
902+
fileItem.write(file);
903+
return 0;
904+
} else {
905+
return -2;
906+
}
907+
}
908+
894909
/**
895910
* Creates a web site from the content of an archive file (a ZIP file).
896911
*
@@ -916,6 +931,14 @@ public int createWebSiteFromZipFile(SiteDetail descriptionSite, FileItem fileIte
916931
String cheminFichierZip = cheminZip + "/" + fichierZipName;
917932
unzip(cheminZip, cheminFichierZip);
918933

934+
/* check the files are thoses expected */
935+
Collection<File> files = FileFolderManager.getAllFile(cheminZip);
936+
for (File uploadedFile : files) {
937+
if (!uploadedFile.getName().equals(fichierZipName) && !isInWhiteList(uploadedFile.getName())) {
938+
return -2;
939+
}
940+
}
941+
919942
/* verif que le nom de la page principale est correcte */
920943
Collection<File> collPages = getAllWebPages2(getWebSitePathById(descriptionSite.getId()));
921944
SilverTrace.debug("webSites", "RequestRouter.EffectiveUploadSiteZip",
@@ -944,4 +967,14 @@ public int createWebSiteFromZipFile(SiteDetail descriptionSite, FileItem fileIte
944967
}
945968
return 0;
946969
}
970+
971+
public boolean isInWhiteList(String fileName) {
972+
String authorizedExtensions = getSettings().getString(WEBSITE_WHITE_LIST);
973+
if (StringUtil.isDefined(authorizedExtensions)) {
974+
List<String> whiteList = Arrays.asList(authorizedExtensions.split(" "));
975+
String extension = FilenameUtils.getExtension(fileName).toLowerCase();
976+
return whiteList.contains(extension);
977+
}
978+
return false;
979+
}
947980
}

‎websites/websites-war/src/main/java/com/stratelia/webactiv/webSites/servlets/WebSitesRequestRouter.java

Lines changed: 34 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ public String getDestination(String function, WebSiteSessionController scc,
153153
}
154154
} else if (function.startsWith("searchResult")) {
155155
String id = request.getParameter("Id"); /* id de la publication */
156+
156157
String typeRequest = request.getParameter("Type");
157158

158159
if ("Publication".equals(typeRequest) || "Site".equals(typeRequest)) {
@@ -209,8 +210,7 @@ public String getDestination(String function, WebSiteSessionController scc,
209210
String nameSite = request.getParameter("nameSite");
210211
String id = request.getParameter("id");
211212

212-
destination =
213-
"http://" + getMachine(request) + URLManager.getApplicationURL()
213+
destination = "http://" + getMachine(request) + URLManager.getApplicationURL()
214214
+ "/wysiwyg/jsp/htmlEditor.jsp?";
215215
destination += "SpaceId=" + scc.getSpaceId();
216216

@@ -222,9 +222,10 @@ public String getDestination(String function, WebSiteSessionController scc,
222222
destination += "&ObjectId=" + id;
223223
destination += "&FileName=" + URLEncoder.encode(name, "UTF-8");
224224
destination += "&Path=" + URLEncoder.encode(path, "UTF-8");
225-
destination +=
226-
"&ReturnUrl=" + URLEncoder.encode(URLManager.getApplicationURL() + URLManager.getURL(
227-
scc.getSpaceId(), scc.getComponentId()) + "FromWysiwyg?path=" + path + "&name=" + name
225+
destination += "&ReturnUrl=" + URLEncoder.encode(URLManager.getApplicationURL()
226+
+ URLManager.getURL(
227+
scc.getSpaceId(), scc.getComponentId()) + "FromWysiwyg?path=" + path + "&name="
228+
+ name
228229
+ "&nameSite=" + nameSite + "&profile=" + flag + "&id=" + id, "UTF-8");
229230
SilverTrace.info("webSites", "WebSitesRequestRouter.getDestination().ToWysiwyg",
230231
"root.MSG_GEN_PARAM_VALUE", "destination = " + destination);
@@ -302,12 +303,12 @@ public String getDestination(String function, WebSiteSessionController scc,
302303
String listeIcones = request.getParameter("ListeIcones");
303304

304305
type = "design";
305-
complete =
306-
"&RecupParam=oui&Nom=" + nom + "&Description=" + description + "&Page=" + lapage
306+
complete = "&RecupParam=oui&Nom=" + nom + "&Description=" + description + "&Page="
307+
+ lapage
307308
+ "&ListeIcones=" + listeIcones;
308309
} else {
309-
destination =
310-
"/webSites/jsp/modifDesc.jsp?Id=" + id + "&path=" + currentPath + "&type=" + type;
310+
destination = "/webSites/jsp/modifDesc.jsp?Id=" + id + "&path=" + currentPath + "&type="
311+
+ type;
311312
}
312313

313314
destination = "/webSites/jsp/modifDesc.jsp?Id=" + id;
@@ -346,8 +347,7 @@ public String getDestination(String function, WebSiteSessionController scc,
346347
String childId = request.getParameter("ChildId");
347348
String name = request.getParameter("Name");
348349
String description = request.getParameter("Description");
349-
NodeDetail folder =
350-
new NodeDetail(childId, name, description, null, null, null, "0", "X");
350+
NodeDetail folder = new NodeDetail(childId, name, description, null, null, null, "0", "X");
351351
scc.updateFolderHeader(folder, "");
352352
action = "Search";
353353
} else if (action.equals("Delete")) {
@@ -496,8 +496,8 @@ public String getDestination(String function, WebSiteSessionController scc,
496496
String newTopicName = request.getParameter("Name");
497497
String newTopicDescription = request.getParameter("Description");
498498

499-
NodeDetail folder =
500-
new NodeDetail("X", newTopicName, newTopicDescription, null, null, null, "0", "X");
499+
NodeDetail folder = new NodeDetail("X", newTopicName, newTopicDescription, null, null, null,
500+
"0", "X");
501501
scc.addFolder(folder, "");
502502

503503
destination = "/webSites/jsp/addTopic.jsp?Action=" + action + "&Id=" + fatherId;
@@ -520,8 +520,8 @@ public String getDestination(String function, WebSiteSessionController scc,
520520
request.setAttribute("ListSites", listeSites);
521521
request.setAttribute("CurrentFolder", scc.getSessionTopic());
522522

523-
destination =
524-
"/webSites/jsp/classifyDeclassify.jsp?Action=" + action + "&TopicId=" + id + "&Path="
523+
destination = "/webSites/jsp/classifyDeclassify.jsp?Action=" + action + "&TopicId=" + id
524+
+ "&Path="
525525
+ linkedPathString;
526526
} else if (function.startsWith("manage.jsp")) {
527527
String action = request.getParameter("Action");
@@ -557,9 +557,9 @@ public String getDestination(String function, WebSiteSessionController scc,
557557
String id = scc.getNextId();
558558

559559
/* Persist siteDetail inside database, type 1 = bookmark */
560-
SiteDetail descriptionSite =
561-
new SiteDetail(id, scc.getComponentId(), nomSite, description, nomPage, 1, null,
562-
null, 0, popup);
560+
SiteDetail descriptionSite
561+
= new SiteDetail(id, scc.getComponentId(), nomSite, description, nomPage, 1, null,
562+
null, 0, popup);
563563
descriptionSite.setPositions(positions);
564564

565565
String pubId = scc.createWebSite(descriptionSite);
@@ -668,8 +668,8 @@ public String getDestination(String function, WebSiteSessionController scc,
668668
int type = ancien.getType();
669669

670670
/* update description en BD */
671-
SiteDetail descriptionSite2 =
672-
new SiteDetail(id, scc.getComponentId(), nomSite, description, nomPage, type, null,
671+
SiteDetail descriptionSite2 = new SiteDetail(id, scc.getComponentId(), nomSite,
672+
description, nomPage, type, null,
673673
null, etat, popup);
674674

675675
scc.updateWebSite(descriptionSite2);
@@ -762,9 +762,9 @@ public String getDestination(String function, WebSiteSessionController scc,
762762
scc.createFolder(scc.getWebSitePathById(id));
763763

764764
// Persist siteDetail inside database type 0 = site cree
765-
SiteDetail descriptionSite =
766-
new SiteDetail(id, scc.getComponentId(), nomSite, description, nomPage, 0, null,
767-
null, 0, popup);
765+
SiteDetail descriptionSite
766+
= new SiteDetail(id, scc.getComponentId(), nomSite, description, nomPage, 0, null,
767+
null, 0, popup);
768768
descriptionSite.setPositions(positions);
769769

770770
String pubId = scc.createWebSite(descriptionSite);
@@ -859,8 +859,8 @@ public String getDestination(String function, WebSiteSessionController scc,
859859

860860
boolean searchOk = ok;
861861

862-
SiteDetail descriptionSite2 =
863-
new SiteDetail(id, scc.getComponentId(), nomSite, description, nomPage, type, null,
862+
SiteDetail descriptionSite2 = new SiteDetail(id, scc.getComponentId(), nomSite,
863+
description, nomPage, type, null,
864864
null, Integer
865865
.parseInt(etat), popup);
866866

@@ -1011,17 +1011,15 @@ public String getDestination(String function, WebSiteSessionController scc,
10111011
destination = "/webSites/jsp/design.jsp?Action=design&path=" + currentPath + "&Id=" + id;
10121012
} else if (function.equals("EffectiveUploadFile")) {
10131013
List<FileItem> items = FileUploadUtil.parseRequest(request);
1014-
1014+
boolean status = true;
10151015
String thePath = FileUploadUtil.getParameter(items, "path");
10161016
scc.checkPath(thePath);
10171017
FileItem item = FileUploadUtil.getFile(items);
10181018
if (item != null) {
1019-
String fileName = FileUploadUtil.getFileName(item);
1020-
File file = new File(thePath, fileName);
1021-
item.write(file);
1019+
status = (scc.addFileIntoWebSite(thePath, item) == 0);
10221020
}
10231021

1024-
request.setAttribute("UploadOk", Boolean.TRUE);
1022+
request.setAttribute("UploadOk", status);
10251023

10261024
destination = "/webSites/jsp/uploadFile.jsp?path=" + thePath;
10271025
} else if (function.startsWith("descUpload.jsp")) {
@@ -1048,9 +1046,9 @@ public String getDestination(String function, WebSiteSessionController scc,
10481046
String id = scc.getNextId();
10491047

10501048
// Persist uploaded website inside database, type=2
1051-
SiteDetail descriptionSite =
1052-
new SiteDetail(id, scc.getComponentId(), nomSite, description, nomPage, 2, null,
1053-
null, 0, popup);
1049+
SiteDetail descriptionSite
1050+
= new SiteDetail(id, scc.getComponentId(), nomSite, description, nomPage, 2, null,
1051+
null, 0, popup);
10541052

10551053
descriptionSite.setPositions(positions);
10561054
int result = scc.createWebSiteFromZipFile(descriptionSite, fileItem);
@@ -1462,6 +1460,7 @@ private String parseCodeSupprHref(WebSiteSessionController scc, String code,
14621460
String apres;
14631461
int index;
14641462
String href = "<A href=\""; /* longueur de chaine = 9 */
1463+
14651464
String finChemin;
14661465
String fichier;
14671466
String deb;
@@ -1477,9 +1476,11 @@ private String parseCodeSupprHref(WebSiteSessionController scc, String code,
14771476
apres = theCode.substring(index + 9);
14781477

14791478
if (apres.substring(0, 7).equals("http://")) { /* lien externe */
1479+
14801480
theReturn = avant
14811481
+ parseCodeSupprHref(scc, apres, settings, currentPath);
14821482
} else if (apres.substring(0, 6).equals("ftp://")) { /* lien externe */
1483+
14831484
theReturn = avant
14841485
+ parseCodeSupprHref(scc, apres, settings, currentPath);
14851486
} else if (apres.substring(0, 3).equals("rr:")) { /* deja en relatif */

0 commit comments

Comments
 (0)