github-advanced-security[bot] commented on code in PR #523:
URL: https://github.com/apache/jspwiki/pull/523#discussion_r3839456528
##########
jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java:
##########
@@ -103,6 +114,47 @@
return "Image src='{image.jpg}'";
}
+ /**
+ * Accepts an author-supplied style only if every declaration sets an
allow-listed presentational property.
+ * CSS escapes and functions (backslash, parentheses) and negative
lengths are rejected outright: they could
+ * disguise a forbidden property (<tt>\\70 osition</tt>), smuggle a URL
(<tt>url(...)</tt>), or drag the
+ * rendered box over other page content (<tt>margin-top:-9999px</tt>).
+ *
+ * @param style the author-supplied style parameter, already
entity-encoded
+ * @return true if every declaration is allow-listed
+ */
+ static boolean isSafeStyle( final String style ) {
+ if( style.indexOf( '\\' ) >= 0 || style.indexOf( '(' ) >= 0 ) {
+ return false;
+ }
+ for( final String declaration : style.split( ";" ) ) {
+ if( declaration.trim().isEmpty() ) {
+ continue;
+ }
+ final int colon = declaration.indexOf( ':' );
+ if( colon < 0 ) {
+ return false;
+ }
+ final String property = declaration.substring( 0, colon
).trim().toLowerCase( Locale.ENGLISH );
+ final String value = declaration.substring( colon + 1 );
+ if( !SAFE_STYLE_PROPERTIES.contains( property ) || value.matches(
".*-\\s*\\.?\\d.*" ) ) {
Review Comment:
## CodeQL / Polynomial regular expression used on uncontrolled data
This [regular expression](1) that depends on a [user-provided value](2) may
run slow on strings starting with '-0' and with many repetitions of '-0'.
This [regular expression](1) that depends on a [user-provided value](3) may
run slow on strings starting with '-0' and with many repetitions of '-0'.
[Show more
details](https://github.com/apache/jspwiki/security/code-scanning/34)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
