Skip to content

Commit a6d94ab

Browse files
committed
RETRA-41 - Specialni znaky v nazvu projektu
RETRA-48 - Chyba při renderování textu worklogu RETRA-56 - Retra je nachylna na XSS
1 parent 6cf3eb9 commit a6d94ab

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

62 files changed

+477
-388
lines changed

Diff for: src/main/java/cz/softinel/retra/core/system/web/SystemController.java

+5-3
Original file line numberDiff line numberDiff line change
@@ -419,9 +419,11 @@ private void prepareProjects(Model model, boolean showAll) {
419419

420420
private List<Project> filterActiveProject(Set<Project> projects) {
421421
List<Project> filtersList = new ArrayList<Project>();
422-
for (Project p : projects) {
423-
if (p.getState() == Project.STATE_ACTIVE) {
424-
filtersList.add(p);
422+
if (projects != null && !projects.isEmpty()) {
423+
for (Project p : projects) {
424+
if (p.getState() == Project.STATE_ACTIVE) {
425+
filtersList.add(p);
426+
}
425427
}
426428
}
427429
return filtersList;

Diff for: src/main/java/cz/softinel/retra/core/utils/decorator/DateDecorator.java

+5
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
import javax.servlet.jsp.PageContext;
88

9+
import org.apache.commons.lang.StringEscapeUtils;
910
import org.displaytag.decorator.DisplaytagColumnDecorator;
1011
import org.displaytag.exception.DecoratorException;
1112
import org.displaytag.properties.MediaTypeEnum;
@@ -25,6 +26,10 @@ public Object decorate(Object columnValue, PageContext pageContext, MediaTypeEnu
2526
return dateFormat.format(columnValue);
2627
}
2728

29+
if (columnValue instanceof String) {
30+
return StringEscapeUtils.escapeHtml(columnValue.toString());
31+
}
32+
2833
// not date return it as it comes
2934
return columnValue;
3035
}

Diff for: src/main/java/cz/softinel/retra/core/utils/decorator/EmailDecorator.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import javax.servlet.jsp.PageContext;
44

5+
import org.apache.commons.lang.StringEscapeUtils;
56
import org.displaytag.decorator.DisplaytagColumnDecorator;
67
import org.displaytag.exception.DecoratorException;
78
import org.displaytag.properties.MediaTypeEnum;
@@ -12,7 +13,8 @@ public Object decorate(Object columnValue, PageContext pageContext, MediaTypeEnu
1213
if (columnValue == null) {
1314
return null;
1415
}
15-
return "<a href='mailto:" + columnValue + "'>" + columnValue + "</a>";
16+
String escaped = StringEscapeUtils.escapeHtml(columnValue.toString());
17+
return "<a href='mailto:" + escaped + "'>" + escaped + "</a>";
1618
}
1719

1820
}

Diff for: src/main/java/cz/softinel/retra/core/utils/decorator/HourDecorator.java

+5
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
import javax.servlet.jsp.PageContext;
88

9+
import org.apache.commons.lang.StringEscapeUtils;
910
import org.displaytag.decorator.DisplaytagColumnDecorator;
1011
import org.displaytag.exception.DecoratorException;
1112
import org.displaytag.properties.MediaTypeEnum;
@@ -25,6 +26,10 @@ public Object decorate(Object columnValue, PageContext pageContext, MediaTypeEnu
2526
return dateFormat.format(columnValue);
2627
}
2728

29+
if (columnValue instanceof String) {
30+
return StringEscapeUtils.escapeHtml(columnValue.toString());
31+
}
32+
2833
// not date return it as it comes
2934
return columnValue;
3035
}

Diff for: src/main/java/cz/softinel/retra/core/utils/decorator/HoursDecorator.java

+5
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import javax.servlet.http.HttpServletRequest;
99
import javax.servlet.jsp.PageContext;
1010

11+
import org.apache.commons.lang.StringEscapeUtils;
1112
import org.displaytag.decorator.DisplaytagColumnDecorator;
1213
import org.displaytag.exception.DecoratorException;
1314
import org.displaytag.properties.MediaTypeEnum;
@@ -37,6 +38,10 @@ public Object decorate(Object columnValue, PageContext pageContext, MediaTypeEnu
3738
return formatter.format(columnValue);
3839
}
3940

41+
if (columnValue instanceof String) {
42+
return StringEscapeUtils.escapeHtml(columnValue.toString());
43+
}
44+
4045
// not number return it as it comes
4146
return columnValue;
4247
}

Diff for: src/main/java/cz/softinel/retra/core/utils/decorator/ScheduleOverviewDecorator.java

+7-2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
import javax.servlet.jsp.PageContext;
88

9+
import org.apache.commons.lang.StringEscapeUtils;
910
import org.displaytag.decorator.DisplaytagColumnDecorator;
1011
import org.displaytag.exception.DecoratorException;
1112
import org.displaytag.properties.MediaTypeEnum;
@@ -43,9 +44,9 @@ public Object decorate(Object columnValue, PageContext pageContext, MediaTypeEnu
4344
Type type = schedule.getType();
4445
String typeName = "";
4546
if (type != null) {
46-
typeName = type.getName();
47+
typeName = StringEscapeUtils.escapeHtml(type.getName());
4748
}
48-
String comment = schedule.getComment();
49+
String comment = StringEscapeUtils.escapeHtml(schedule.getComment());
4950
if (comment == null) {
5051
comment = "";
5152
}
@@ -96,6 +97,10 @@ public Object decorate(Object columnValue, PageContext pageContext, MediaTypeEnu
9697

9798
}
9899

100+
if (columnValue instanceof String) {
101+
result = StringEscapeUtils.escapeHtml(columnValue.toString());
102+
}
103+
99104
// not schedule return it as it comes
100105
return result;
101106
}

Diff for: src/main/java/cz/softinel/retra/jiraintegration/JiraHelper.java

+14-3
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
import java.util.regex.Matcher;
66
import java.util.regex.Pattern;
77

8+
import org.apache.commons.lang.StringEscapeUtils;
9+
810
import cz.softinel.retra.jiraintegration.logic.JiraLogic;
911

1012
public abstract class JiraHelper {
@@ -60,10 +62,11 @@ public static String getLinkableText(final String text, String linkText, final J
6062
JiraIssue issue = jiraLogic.getJiraIssue(code);
6163
String title = code;
6264
if (issue != null) {
63-
title = code + " - " + issue.getSummary();
65+
String summary = getSafeJiraText(issue.getSummary());
66+
title = code + " - " + summary;
67+
String replacement = String.format(url, code, title, code);
68+
result = result.replaceAll(code, replacement);
6469
}
65-
String replacement = String.format(url, code, title, code);
66-
result = result.replaceAll(code, replacement);
6770
}
6871
} else {
6972
result = text;
@@ -75,4 +78,12 @@ public static String getLinkableText(final String text, String linkText, final J
7578
return result;
7679
}
7780

81+
public static String getSafeJiraText(final String text) {
82+
String safeText = "";
83+
if (text != null) {
84+
safeText = StringEscapeUtils.escapeHtml(text);
85+
safeText = safeText.replace("$", "&dollar;").replace("{", "&lcub;").replace("}", "&rcub;");
86+
}
87+
return safeText;
88+
}
7889
}

Diff for: src/main/java/cz/softinel/retra/jiraintegration/JiraIssue.java

+6
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,12 @@ public void setSelf(String self) {
8484
this.self = self;
8585
}
8686

87+
public void setSummary(String summary) {
88+
if (fields != null) {
89+
this.fields.setSummary(summary);
90+
}
91+
}
92+
8793
public String getSummary() {
8894
return fields == null ? null : fields.summary;
8995
}

Diff for: src/main/java/cz/softinel/retra/worklog/blo/WorklogLogicImpl.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import java.util.ArrayList;
44
import java.util.List;
55

6+
import org.apache.commons.lang.StringEscapeUtils;
67
import org.springframework.transaction.annotation.Propagation;
78
import org.springframework.transaction.annotation.Transactional;
89
import org.springframework.util.Assert;
@@ -427,7 +428,7 @@ private void updateDescriptionGui(Worklog worklog) {
427428
}
428429

429430
private void updateDescriptionGuiImpl(Worklog worklog) {
430-
worklog.setDescriptionGui(JiraHelper.getLinkableText(worklog.getDescription(), jiraLogic));
431+
worklog.setDescriptionGui(JiraHelper.getLinkableText(StringEscapeUtils.escapeHtml(worklog.getDescription()), jiraLogic));
431432
}
432433

433434
private boolean isGivenEmpLoggedEmployee(Long givenPk) {

Diff for: src/main/java/cz/softinel/retra/worklog/web/AbstractWorklogFormController.java

+1
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,7 @@ protected void prepareJiraIssues(Model model) {
200200
if (issues != null && !issues.isEmpty()) {
201201
for (JiraIssue ji : issues) {
202202
ji.setGuiLink(JiraHelper.getLinkableText(ji.getKey(), "(Show...)", jiraLogic));
203+
ji.setSummary(JiraHelper.getSafeJiraText(ji.getSummary()));
203204
}
204205
}
205206
model.put("issues", issues);

Diff for: src/main/java/cz/softinel/uaf/lovs/LovsFactory.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ public Lov getLov(String code, ApplicationContext applicationContext) {
8383
}
8484

8585
Lov lov = lovsInMap.get(code);
86-
if (lov == null || lov.getFields() != null) {
86+
if (lov == null || lov.getFields() == null) {
8787
throw new RuntimeException("Missing LOV for code: " + code);
8888
}
8989
// TODO: Check ... it is good solution?

Diff for: src/main/java/cz/softinel/uaf/vc/tag/SelectTag.java

+15-2
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@
99
import java.util.Map;
1010

1111
import org.apache.commons.beanutils.BeanUtils;
12+
import org.apache.commons.lang.StringEscapeUtils;
13+
import org.apache.poi.util.StringUtil;
1214

1315
import cz.softinel.uaf.util.CommonHelper;
1416

@@ -85,7 +87,15 @@ public int compare(Object o1, Object o2) {
8587
try {
8688
Comparable<String> v1 = BeanUtils.getProperty(o1, orderBy);
8789
String v2 = BeanUtils.getProperty(o2, orderBy);
88-
return v1.compareTo(v2);
90+
if (v1 != null && v2 != null) {
91+
return v1.compareTo(v2);
92+
} else {
93+
if (v2 == null) {
94+
return 0;
95+
} else {
96+
return -1;
97+
}
98+
}
8999
} catch (IllegalAccessException e) {
90100
throw new RuntimeException("Exception while getting property: " + e.getMessage(), e);
91101
} catch (InvocationTargetException e) {
@@ -194,8 +204,11 @@ private void generateOption(String value, String label, int level) {
194204
prefix = "&nbsp;&nbsp;&nbsp;&nbsp;" + prefix;
195205
}
196206
}
207+
String escapedValue = StringEscapeUtils.escapeHtml(value);
208+
String escapedLabel = StringEscapeUtils.escapeHtml(label);
209+
197210
output.append(
198-
"\n <option value='" + value + "'" + selectedAttribute + ">" + prefix + label + "</option>");
211+
"\n <option value='" + escapedValue + "'" + selectedAttribute + ">" + prefix + escapedLabel + "</option>");
199212
}
200213

201214
// Setters ...

Diff for: src/main/webapp/WEB-INF/jsp/Includes.jsp

+1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
--%><%@ taglib prefix="spring" uri="http://www.springframework.org/tags" %><%--
88
--%><%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %><%--
99
--%><%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %><%--
10+
--%><%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %><%--
1011
--%><%@ taglib prefix="display" uri="http://displaytag.sf.net" %><%--
1112
--%><%--
1213
--%><%@ taglib prefix="vc" uri="/WEB-INF/tld/visual-component.tld" %><%--

Diff for: src/main/webapp/WEB-INF/jsp/retra/ComponentCreate.jsp

+4-4
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,19 @@
77
<form action="${requestURI}" method="post" >
88

99
<spring:bind path="componentForm.pk">
10-
<input type="hidden" name="${status.expression}" value="${status.value}" />
10+
<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
1111
</spring:bind>
1212

1313
<spring:bind path="componentForm.projectPk">
14-
<input type="hidden" name="${status.expression}" value="${status.value}" />
14+
<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
1515
</spring:bind>
1616

1717
<table class="formTable">
1818
<tr>
1919
<spring:bind path="componentForm.code">
2020
<th><fmt:message key="entity.component.code" /></th>
2121
<td>
22-
<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
22+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
2323
<c:forEach items="${status.errorMessages}">
2424
<span class="error"><fmt:message key="error.sign" /></span>
2525
</c:forEach>
@@ -30,7 +30,7 @@
3030
<spring:bind path="componentForm.name">
3131
<th><fmt:message key="entity.component.name" /></th>
3232
<td>
33-
<input type="text" name="${status.expression}" value="${status.value}" maxlength="250"/>
33+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250"/>
3434
<c:forEach items="${status.errorMessages}">
3535
<span class="error"><fmt:message key="error.sign" /></span>
3636
</c:forEach>

Diff for: src/main/webapp/WEB-INF/jsp/retra/ComponentEdit.jsp

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
<spring:bind path="componentForm.code">
2020
<th><fmt:message key="entity.component.code" /></th>
2121
<td>
22-
<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
22+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
2323
<c:forEach items="${status.errorMessages}">
2424
<span class="error"><fmt:message key="error.sign" /></span>
2525
</c:forEach>
@@ -30,7 +30,7 @@
3030
<spring:bind path="componentForm.name">
3131
<th><fmt:message key="entity.component.name" /></th>
3232
<td>
33-
<input type="text" name="${status.expression}" value="${status.value}" maxlength="250"/>
33+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250"/>
3434
<c:forEach items="${status.errorMessages}">
3535
<span class="error"><fmt:message key="error.sign" /></span>
3636
</c:forEach>

Diff for: src/main/webapp/WEB-INF/jsp/retra/EmployeeChangeContactInfo.jsp

+7-7
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<spring:bind path="employeeForm.user.contactInfo.firstName">
1111
<th><fmt:message key="entity.contactInfo.firstName" /></th>
1212
<td>
13-
<input type="text" name="${status.expression}" value="${status.value}" />
13+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
1414
<c:forEach items="${status.errorMessages}">
1515
<span class="error"><fmt:message key="error.sign" /></span>
1616
</c:forEach>
@@ -21,7 +21,7 @@
2121
<spring:bind path="employeeForm.user.contactInfo.lastName">
2222
<th><fmt:message key="entity.contactInfo.lastName" /></th>
2323
<td>
24-
<input type="text" name="${status.expression}" value="${status.value}" />
24+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
2525
<c:forEach items="${status.errorMessages}">
2626
<span class="error"><fmt:message key="error.sign" /></span>
2727
</c:forEach>
@@ -32,7 +32,7 @@
3232
<spring:bind path="employeeForm.user.contactInfo.email">
3333
<th><fmt:message key="entity.contactInfo.email" /></th>
3434
<td>
35-
<input type="text" name="${status.expression}" value="${status.value}" />
35+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
3636
<c:forEach items="${status.errorMessages}">
3737
<span class="error"><fmt:message key="error.sign" /></span>
3838
</c:forEach>
@@ -43,7 +43,7 @@
4343
<spring:bind path="employeeForm.user.contactInfo.web">
4444
<th><fmt:message key="entity.contactInfo.web" /></th>
4545
<td>
46-
<input type="text" name="${status.expression}" value="${status.value}" />
46+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
4747
<c:forEach items="${status.errorMessages}">
4848
<span class="error"><fmt:message key="error.sign" /></span>
4949
</c:forEach>
@@ -54,7 +54,7 @@
5454
<spring:bind path="employeeForm.user.contactInfo.phone1">
5555
<th><fmt:message key="entity.contactInfo.phone1" /></th>
5656
<td>
57-
<input type="text" name="${status.expression}" value="${status.value}" />
57+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
5858
<c:forEach items="${status.errorMessages}">
5959
<span class="error"><fmt:message key="error.sign" /></span>
6060
</c:forEach>
@@ -65,7 +65,7 @@
6565
<spring:bind path="employeeForm.user.contactInfo.phone2">
6666
<th><fmt:message key="entity.contactInfo.phone2" /></th>
6767
<td>
68-
<input type="text" name="${status.expression}" value="${status.value}" />
68+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
6969
<c:forEach items="${status.errorMessages}">
7070
<span class="error"><fmt:message key="error.sign" /></span>
7171
</c:forEach>
@@ -76,7 +76,7 @@
7676
<spring:bind path="employeeForm.user.contactInfo.fax">
7777
<th><fmt:message key="entity.contactInfo.fax" /></th>
7878
<td>
79-
<input type="text" name="${status.expression}" value="${status.value}" />
79+
<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
8080
<c:forEach items="${status.errorMessages}">
8181
<span class="error"><fmt:message key="error.sign" /></span>
8282
</c:forEach>

0 commit comments

Comments
 (0)