RHPAM-4723: Creating a branch via BC UI can lead to XSS (#3815)

kiegroup · Jul 21, 2023 · eae69c6 · eae69c6
1 parent c616df1
commit eae69c6
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/...main/java/org/kie/workbench/common/services/backend/validation/ValidationServiceImpl.java b/...main/java/org/kie/workbench/common/services/backend/validation/ValidationServiceImpl.java
@@ -39,6 +39,8 @@
 import org.uberfire.backend.vfs.Path;
 import org.uberfire.ext.editor.commons.backend.validation.ValidationUtils;
 
+import static org.guvnor.structure.backend.InputEscapeUtils.escapeHtmlInput;
+
 /**
  * Implementation of validation Service for file names
  */
@@ -107,7 +109,7 @@ public boolean isFileNameValid(String fileName) {
     @Override
     public boolean isBranchNameValid(final String branchName) {
         final Matcher branchNameMatcher = branchNameValidator.matcher(branchName);
-        return branchNameMatcher.matches();
+        return branchNameMatcher.matches() && branchName.equals(escapeHtmlInput(branchName));
     }
 
     @Override

diff --git a/.../java/org/kie/workbench/common/services/backend/validation/ValidationServiceImplTest.java b/.../java/org/kie/workbench/common/services/backend/validation/ValidationServiceImplTest.java
@@ -138,7 +138,7 @@ public void testValidateBranchName() {
         assertTrue(validationService.isBranchNameValid("test!"));
         assertTrue(validationService.isBranchNameValid("test-"));
         assertTrue(validationService.isBranchNameValid("test_"));
-        assertTrue(validationService.isBranchNameValid("test&"));
+        assertFalse(validationService.isBranchNameValid("test&"));
         assertTrue(validationService.isBranchNameValid("test%"));
 
         assertFalse(validationService.isBranchNameValid("@test"));
@@ -223,5 +223,6 @@ public void testValidateBranchName() {
         assertTrue(validationService.isBranchNameValid("te-st"));
         assertTrue(validationService.isBranchNameValid("test-"));
 
+        assertFalse(validationService.isBranchNameValid("<img/src/onerror=alert(document.cookie)>"));
     }
 }