[roller] 01/09: TagDataServlet input validation.

[mbien]

This is an automated email from the ASF dual-hosted git repository.

mbien pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/roller.git

commit 97cf6e7d66d186fca9c184e077d1f7bd013f3988
Author: Michael Bien <mbie...@gmail.com>
AuthorDate: Mon Mar 22 03:05:19 2021 +0100

    TagDataServlet input validation.
---
 .../webservices/tagdata/TagDataServlet.java        | 58 +++++++++++++++-------
 1 file changed, 41 insertions(+), 17 deletions(-)

diff --git 
a/app/src/main/java/org/apache/roller/weblogger/webservices/tagdata/TagDataServlet.java
 
b/app/src/main/java/org/apache/roller/weblogger/webservices/tagdata/TagDataServlet.java
index 9d2fa31..5277319 100644
--- 
a/app/src/main/java/org/apache/roller/weblogger/webservices/tagdata/TagDataServlet.java
+++ 
b/app/src/main/java/org/apache/roller/weblogger/webservices/tagdata/TagDataServlet.java
@@ -26,6 +26,8 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.text.StringEscapeUtils;
 import org.apache.roller.weblogger.WebloggerException;
 import org.apache.roller.weblogger.business.URLStrategy;
 import org.apache.roller.weblogger.business.WeblogEntryManager;
@@ -44,7 +46,7 @@ import org.apache.roller.weblogger.util.Utilities;
  * These URLs are supported:
  * <ul>
  * <li>/roller-services/tagdata - get tag data for entire site</li>
- * <li>/roller-services/tagdata/weblogs/[handle] - get tag data for specific 
weblog</li>
+ * <li>/roller-services/tagdata/weblog/[handle] - get tag data for specific 
weblog</li>
  * </ul>
  * See the <a 
href="http://cwiki.apache.org/confluence/display/ROLLER/Proposal+Tag+Data+API";>
  * Tag Data API</a> proposal for details.
@@ -70,36 +72,56 @@ public class TagDataServlet extends HttpServlet {
             HttpServletRequest request, HttpServletResponse response) 
             throws ServletException, IOException {
 
-        String[] pathInfo = new String[0];
-        boolean siteWide;
-        String handle;
-        String prefix;
-        String format = "json";
-        int page = 0;
-        
         // TODO: last modified or ETag support, caching, etc.
 
+        String[] pathInfo = new String[0];
+        
         if (request.getPathInfo() != null) {
             pathInfo = 
Utilities.stringToStringArray(request.getPathInfo(),"/");
         }
+        
+        boolean siteWide;
+        String handle;
+
         if (pathInfo.length == 0) {
             siteWide = true;
             // we'll use the front-page weblog to form URLs
             handle = 
WebloggerRuntimeConfig.getProperty("site.frontpage.weblog.handle");
-        } else if (pathInfo.length == 2 && "weblog".equals(pathInfo[0])) {
+        } else if (pathInfo.length == 2 && "weblog".equals(pathInfo[0]) && 
StringUtils.isAlphanumeric(pathInfo[1])) {
             siteWide = false;
             handle = pathInfo[1];
         } else {
             response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Malformed 
URL");
             return;
         }
-        prefix = request.getParameter("prefix");
+
+        String prefix = request.getParameter("prefix");
+
+        if(prefix != null && !StringUtils.isAlphanumeric(prefix)) {
+            response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Malformed 
URL");
+            return;
+        }
+        
+        String format = "json";  // default
+        
         if (request.getParameter("format") != null) {
+            
             format = request.getParameter("format");
+            if(!format.equals("json") || !format.equals("xml")) {
+                response.sendError(HttpServletResponse.SC_BAD_REQUEST, 
"Malformed URL");
+                return;
+            }
+        }
+        
+        int page = 0;
+        if(request.getParameter("page") != null) {
+            try {
+                page = Integer.parseInt(request.getParameter("page"));
+            } catch (NumberFormatException notIgnored) {
+                response.sendError(HttpServletResponse.SC_BAD_REQUEST, 
"Malformed URL");
+                return;
+            }
         }
-        try {
-            page = Integer.parseInt(request.getParameter("page"));
-        } catch (Exception ignored) {}
 
         Weblogger roller = WebloggerFactory.getWeblogger();
         List<TagStat> tags;
@@ -108,6 +130,10 @@ public class TagDataServlet extends HttpServlet {
             WeblogManager wmgr = roller.getWeblogManager();
             WeblogEntryManager emgr = roller.getWeblogEntryManager();
             weblog = wmgr.getWeblogByHandle(handle);
+            if(weblog == null) {
+                response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Weblog 
not found");
+                return;
+            }
             // get tags, if site-wide then don't specify weblog
             tags = emgr.getTags(siteWide ? null : weblog, null, prefix, page * 
MAX, MAX + 1);
 
@@ -119,8 +145,8 @@ public class TagDataServlet extends HttpServlet {
         if ("json".equals(format)) {
             response.setContentType("application/json; charset=utf-8");
             PrintWriter pw = response.getWriter();
-            pw.println("{ \"prefix\": \"" + (prefix == null ? "" : prefix) + 
"\",");
-            pw.println("  \"weblog\": \"" + (!siteWide ? handle : "") + "\",");
+            pw.println("{ \"prefix\": \"" + (prefix == null ? "" : 
StringEscapeUtils.escapeJson(prefix)) + "\",");
+            pw.println("  \"weblog\": \"" + (!siteWide ? weblog.getHandle() : 
"") + "\",");
             pw.println("  \"tagcounts\": [" );
             int count = 0;
             for (Iterator it = tags.iterator(); it.hasNext();) {
@@ -177,8 +203,6 @@ public class TagDataServlet extends HttpServlet {
             }
             pw.println("</categories>");
             response.flushBuffer();
-        } else {
-            response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Malformed 
URL");
         }
     }
 }