Skip to content
This repository has been archived by the owner on Apr 25, 2024. It is now read-only.

Commit

Permalink
better testing of characters
Browse files Browse the repository at this point in the history
Signed-off-by: Olivier Lamy <olamy@apache.org>
  • Loading branch information
olamy committed Mar 14, 2023
1 parent 4d93c1f commit d62e81c
Showing 1 changed file with 19 additions and 10 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -262,6 +262,15 @@ private boolean hasValidChars(String checkString) {
if (checkString.contains("/..")) {
return false;
}
if (checkString.contains("<")) {
return false;
}
if (checkString.contains(">")) {
return false;
}
if (checkString.contains("&")) {
return false;
}
return true;
}

Expand All @@ -280,11 +289,11 @@ public Boolean save( String repositoryId, String groupId, String artifactId, Str
boolean generatePom )
throws ArchivaRestServiceException
{
repositoryId = StringEscapeUtils.escapeJavaScript( StringUtils.trim( repositoryId ) );
groupId = StringEscapeUtils.escapeJavaScript( StringUtils.trim( groupId ) );
artifactId = StringEscapeUtils.escapeJavaScript( StringUtils.trim( artifactId ) );
version = StringEscapeUtils.escapeJavaScript( StringUtils.trim( version ) );
packaging = StringEscapeUtils.escapeJavaScript( StringUtils.trim( packaging ) );
repositoryId = StringEscapeUtils.escapeHtml( StringUtils.trim( repositoryId ) );
groupId = StringEscapeUtils.escapeHtml( StringUtils.trim( groupId ) );
artifactId = StringEscapeUtils.escapeHtml( StringUtils.trim( artifactId ) );
version = StringEscapeUtils.escapeHtml( StringUtils.trim( version ) );
packaging = StringEscapeUtils.escapeHtml( StringUtils.trim( packaging ) );

checkParamChars("repositoryId", repositoryId);
checkParamChars("groupId", groupId);
Expand Down Expand Up @@ -378,11 +387,11 @@ protected void savePomFile( String repositoryId, FileMetadata fileMetadata, Stri

ManagedRepository repoConfig = managedRepositoryAdmin.getManagedRepository( repositoryId );

repositoryId = StringEscapeUtils.escapeJavaScript( StringUtils.trim( repositoryId ) );
groupId = StringEscapeUtils.escapeJavaScript( StringUtils.trim( groupId ) );
artifactId = StringEscapeUtils.escapeJavaScript( StringUtils.trim( artifactId ) );
version = StringEscapeUtils.escapeJavaScript( StringUtils.trim( version ) );
packaging = StringEscapeUtils.escapeJavaScript( StringUtils.trim( packaging ) );
repositoryId = StringEscapeUtils.escapeHtml( StringUtils.trim( repositoryId ) );
groupId = StringEscapeUtils.escapeHtml( StringUtils.trim( groupId ) );
artifactId = StringEscapeUtils.escapeHtml( StringUtils.trim( artifactId ) );
version = StringEscapeUtils.escapeHtml( StringUtils.trim( version ) );
packaging = StringEscapeUtils.escapeHtml( StringUtils.trim( packaging ) );

ArtifactReference artifactReference = new ArtifactReference();
artifactReference.setArtifactId( artifactId );
Expand Down

0 comments on commit d62e81c

Please sign in to comment.