Arturo Bernal created JSPWIKI-1323:
--------------------------------------
Summary: A malformed JSPWikiUserPrefs cookie makes the page lose
its stylesheets and scripts
Key: JSPWIKI-1323
URL: https://issues.apache.org/jira/browse/JSPWIKI-1323
Project: JSPWiki
Issue Type: Bug
Reporter: Arturo Bernal
The preferences of the user are read from the cookie JSPWikiUserPrefs in
Preferences.parseJSONPreferences (jspwiki-main) with new Gson().fromJson(
value, Map.class ) and no error handling.
Measured on master (4b436f943, the war on Tomcat 10.1), requesting Wiki.jsp for
the page Main with the cookie set:
* No cookie, or a JSON object with an unknown SkinName, an invalid TimeZone or
DateFormat, an unknown Language, or null or array values: HTTP 200 and the
complete page (9966 bytes, 4 script tags, links to templates/default/).
* A value that is not JSON ({not-json) or is not a JSON object ([1,2], 123,
"text"): HTTP 200 but a page of 3954 bytes with the header, the content and the
footer and nothing in the head: no link to the stylesheets and no script tag (0
of them). The log has com.google.gson.JsonSyntaxException inside a JSP tag
(WikiTagBase).
The user gets the page as plain HTML without style, and because no script is
loaded, the script that would replace the cookie (Wiki.js compares the version
stored in it) never runs, so the page stays that way until the cookie is
deleted by hand. This is the kind of incompatibility between the server and the
cookie that JSPWIKI-168 is about.
I do not know how a real user ends up with such a cookie: I built these values
by hand and did not try a cookie written by an older version.
Proposal: ignore the cookie when its value is not a JSON object, so that the
default preferences are used and the script can replace it.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
