Changeset 33720 for main

Timestamp:

2019-11-25T20:08:31+13:00 (4 years ago)

Author:

ak19

Message:

Implemented Dr Bainbridge's suggestions based on Kathy's solution to preventing script elements in queries (like a close script tag, open script tag, alert(1), close script tag) from ending up live when a search is performed.

Location:

main/trunk/greenstone3

Files:

• src/java/org/greenstone/gsdl3/util/XSLTUtil.java (modified) (2 diffs)
• web/interfaces/default/transform/javascript-global-setup.xsl (modified) (5 diffs)

main/trunk/greenstone3/src/java/org/greenstone/gsdl3/util/XSLTUtil.java

@@ -752 +752 @@
         return str.replace("\"", "\\\"");
     }
-
+        public static String escapeAngleBrackets(String str)
+    {
+        if (str == null || str.length() < 1)
+        {
+            return null;
+        }
+        return str.replace("<", "&lt;").replace(">", "&gt;");
+    }
+    
     public static String escapeNewLinesAndQuotes(String str)
     {
@@ -761 +769 @@
         return escapeNewLines(escapeQuotes(str));
     }
-
+    
+    public static String escapeNewLinesQuotesAngleBracketsForJSString(String str)
+    {
+        // The \n and " becomes \\\n and \\\"
+        // but the <> are escaped/encoded for html, i.e. &gt; and &lt;  
+        if (str == null || str.length() < 1)
+        {
+            return null;
+        }
+        return escapeAngleBrackets(escapeNewLines(escapeQuotes(str)));
+    }
     public static String getGlobalProperty(String name)
     {

main/trunk/greenstone3/web/interfaces/default/transform/javascript-global-setup.xsl

@@ -34 +34 @@
             <xsl:for-each select="/page/pageRequest/paramList/param">
                 <xsl:text disable-output-escaping="yes">name = "</xsl:text><xsl:value-of select="@name"/><xsl:text disable-output-escaping="yes">";</xsl:text>
-                <xsl:text disable-output-escaping="yes">value = "</xsl:text><xsl:value-of disable-output-escaping="yes" select="util:escapeNewLinesAndQuotes(@value)"/><xsl:text disable-output-escaping="yes">";</xsl:text>
+                <xsl:text disable-output-escaping="yes">value = "</xsl:text><xsl:value-of disable-output-escaping="yes" select="util:escapeNewLinesQuotesAngleBracketsForJSString(@value)"/><xsl:text disable-output-escaping="yes">";</xsl:text>
                 <xsl:text disable-output-escaping="yes">name = name.replace(".", "_");</xsl:text>
                 gs.cgiParams[name] = value;             
@@ -77 +77 @@
             <xsl:for-each select="/page/pageResponse/metadataList/metadata">
                 <xsl:text disable-output-escaping="yes">name = "</xsl:text><xsl:value-of select="@name"/><xsl:text disable-output-escaping="yes">";</xsl:text>
-                <xsl:text disable-output-escaping="yes">value = "</xsl:text><xsl:value-of disable-output-escaping="yes" select="util:escapeNewLinesAndQuotes(.)"/><xsl:text disable-output-escaping="yes">";</xsl:text>
+                <xsl:text disable-output-escaping="yes">value = "</xsl:text><xsl:value-of disable-output-escaping="yes" select="util:escapeNewLinesQuotesAngleBracketsForJSString(.)"/><xsl:text disable-output-escaping="yes">";</xsl:text>
                 <xsl:text disable-output-escaping="yes">lang = "</xsl:text><xsl:value-of select="@lang"/><xsl:text disable-output-escaping="yes">";</xsl:text>
                 addMetadataToList(name, value, gs.siteMetadata, lang);
@@ -84 +84 @@
             <xsl:for-each select="/page/pageResponse/collection/metadataList/metadata">
                 <xsl:text disable-output-escaping="yes">name = "</xsl:text><xsl:value-of select="@name"/><xsl:text disable-output-escaping="yes">";</xsl:text>
-                <xsl:text disable-output-escaping="yes">value = "</xsl:text><xsl:value-of disable-output-escaping="yes" select="util:escapeNewLinesAndQuotes(.)"/><xsl:text disable-output-escaping="yes">";</xsl:text>
+                <xsl:text disable-output-escaping="yes">value = "</xsl:text><xsl:value-of disable-output-escaping="yes" select="util:escapeNewLinesQuotesAngleBracketsForJSString(.)"/><xsl:text disable-output-escaping="yes">";</xsl:text>
                 <xsl:text disable-output-escaping="yes">lang = "</xsl:text><xsl:value-of select="@lang"/><xsl:text disable-output-escaping="yes">";</xsl:text>
                 addMetadataToList(name, value, gs.collectionMetadata, lang);
@@ -91 +91 @@
             <xsl:for-each select="/page/pageResponse/document/metadataList/metadata">
                 <xsl:text disable-output-escaping="yes">name = "</xsl:text><xsl:value-of select="@name"/><xsl:text disable-output-escaping="yes">";</xsl:text>
-                <xsl:text disable-output-escaping="yes">value = "</xsl:text><xsl:value-of disable-output-escaping="yes" select="util:escapeNewLinesAndQuotes(.)"/><xsl:text disable-output-escaping="yes">";</xsl:text>
+                <xsl:text disable-output-escaping="yes">value = "</xsl:text><xsl:value-of disable-output-escaping="yes" select="util:escapeNewLinesQuotesAngleBracketsForJSString(.)"/><xsl:text disable-output-escaping="yes">";</xsl:text>
                 <xsl:text disable-output-escaping="yes">lang = "</xsl:text><xsl:value-of select="@lang"/><xsl:text disable-output-escaping="yes">";</xsl:text>
                 addMetadataToList(name, value, gs.documentMetadata, lang);
@@ -103 +103 @@
                 <xsl:for-each select="metadataList/metadata">
                     <xsl:text disable-output-escaping="yes">name = "</xsl:text><xsl:value-of select="@name"/><xsl:text disable-output-escaping="yes">";</xsl:text>
-                    <xsl:text disable-output-escaping="yes">value = "</xsl:text><xsl:value-of disable-output-escaping="yes" select="util:escapeNewLinesAndQuotes(.)"/><xsl:text disable-output-escaping="yes">";</xsl:text>
+                    <xsl:text disable-output-escaping="yes">value = "</xsl:text><xsl:value-of disable-output-escaping="yes" select="util:escapeNewLinesQuotesAngleBracketsForJSString(.)"/><xsl:text disable-output-escaping="yes">";</xsl:text>
                     <xsl:text disable-output-escaping="yes">lang = "</xsl:text><xsl:value-of select="@lang"/><xsl:text disable-output-escaping="yes">";</xsl:text>
                     addMetadataToList(name, value, metaList, lang);