arturobernalg opened a new pull request, #577:
URL: https://github.com/apache/jspwiki/pull/577
JSPWIKI-1323: a malformed `JSPWikiUserPrefs` cookie makes the page lose its
stylesheets and scripts.
`Preferences.parseJSONPreferences` read the cookie with `new
Gson().fromJson( value, Map.class )` and no error handling. A value that is not
JSON, or is not a JSON object, made Gson throw inside the page header. The page
was then sent with its header, content and footer but without the links to the
stylesheets and without any script tag, and because no script ran, the script
that replaces the cookie (`Wiki.js` compares the version stored in it) never
ran either. Such a cookie, and one that cannot be decoded, is now ignored and
the default preferences are used. The method is package private now so that it
can be tested; it was private.
Measured with the WAR on Tomcat 10.1, requesting `Wiki.jsp` for the page
Main:
| Cookie | master | this branch |
|---|---|---|
| none | 9966 bytes, 4 script tags | 9966 bytes, 4 script tags |
| `{not-json` | 3954 bytes, 0 script tags | 9966 bytes, 4 script tags |
| `[1,2]` | 3954 bytes, 0 script tags | 9966 bytes, 4 script tags |
| `123` | 3954 bytes, 0 script tags | 9966 bytes, 4 script tags |
| `"text"` | 3954 bytes, 0 script tags | 9966 bytes, 4 script tags |
The 5 tests of the new `PreferencesTest`: 2 of them fail on master
(`JsonSyntaxException`) and all pass here.
I do not know how a real user ends up with such a cookie: I built these
values by hand and did not try a cookie written by an older version. Not run:
the whole test suite.
https://issues.apache.org/jira/browse/JSPWIKI-1323 (related to JSPWIKI-168)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
