поправил XSS при обработке ссылок на l.o.r

maxcom · Jun 11, 2015 · f8faf72 · f8faf72 · kloun · Jun 11, 2015
1 parent e2ee103
commit f8faf72
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 5 deletions.
diff --git a/src/main/java/ru/org/linux/util/formatter/ToHtmlFormatter.java b/src/main/java/ru/org/linux/util/formatter/ToHtmlFormatter.java
@@ -99,7 +99,6 @@ public String format(String text, boolean secure, boolean nofollow) {
   public String format(String text, boolean secure, boolean nofollow, RuTypoChanger changer) {
     String escapedText = StringUtil.escapeHtml(text);
 
-
     StringTokenizer st = new StringTokenizer(escapedText, " \n", true);
     StringBuilder sb = new StringBuilder();
 
@@ -137,7 +136,7 @@ public String memberURL(User user, boolean secure) throws URIException {
     return (new URI(scheme, null, mainUri.getHost(), mainUri.getPort(), String.format("/people/%s/profile", user.getNick()))).getEscapedURIReference();
   }
 
-  protected String formatURL(String line, boolean secure, boolean nofollow, RuTypoChanger changer) {
+  private String formatURL(String line, boolean secure, boolean nofollow, RuTypoChanger changer) {
     StringBuilder out = new StringBuilder();
     Matcher m = URL_PATTERN.matcher(line);
     int index = 0;
@@ -219,7 +218,7 @@ private void processGenericLorUrl(
   ) throws URIException {
     // ссылка внутри lorsource исправляем scheme
     String fixedUrlHref = url.fixScheme(secure);
-    String fixedUrlBody = linktext!=null?simpleFormat(linktext):url.formatUrlBody(maxLength);
+    String fixedUrlBody = linktext!=null?simpleFormat(linktext):StringUtil.escapeHtml(url.formatUrlBody(maxLength));
     out.append("<a href=\"").append(fixedUrlHref).append("\">").append(fixedUrlBody).append("</a>");
   }
 
@@ -257,13 +256,13 @@ private void processMessageUrl(
         out.append("<s>");
       }
 
-      out.append("<a href=\"").append(newUrlHref).append("\" title=\"").append(urlTitle).append("\">").append(fixedUrlBody).append("</a>");
+      out.append("<a href=\"").append(newUrlHref).append("\" title=\"").append(urlTitle).append("\">").append(StringUtil.escapeHtml(fixedUrlBody)).append("</a>");
 
       if (deleted) {
         out.append("</s>");
       }
     } catch (MessageNotFoundException ex) {
-      out.append("<a href=\"").append(url.toString()).append("\">").append(url.formatUrlBody(maxLength)).append("</a>");
+      out.append("<a href=\"").append(url.toString()).append("\">").append(StringUtil.escapeHtml(url.formatUrlBody(maxLength))).append("</a>");
     }
   }
 }
diff --git a/src/test/java/ru/org/linux/util/HTMLFormatterTest.java b/src/test/java/ru/org/linux/util/HTMLFormatterTest.java
@@ -584,4 +584,10 @@ public void testQuotes() {
 
   }
 
+  @Test
+  public void encodeLorUrl() {
+    assertEquals(
+            "<p><a href=\"http://www.linux.org.ru/forum/linux%3C%3E-org-ru/\">www.linux.org.ru/forum/linux&lt;&gt;-org-ru/</a></p>",
+            lorCodeService.parseComment("www.linux.org.ru/forum/linux%3C%3E-org-ru/", false, false));
+  }
 }