Author: jleroux
Date: Tue Oct 13 00:45:31 2015
New Revision: 1708275
URL: http://svn.apache.org/viewvc?rev=1708275&view=rev
Log:
"Applied fix from trunk for revision: 1708274 " (handled conflicts on
.classpath by hand)
------------------------------------------------------------------------
r1708274 | jleroux | 2015-10-13 02:40:47 +0200 (mar. 13 oct. 2015) | 1
ligne
Fix for ContentWorker at OFBIZ-6669. For that I have added
owasp-java-html-sanitizer-r239.jar and put a "content.sanitize=true"
property in content.properties with some explanations. The reason I put
this property is because the sanitizer does some (safe) changes which might
be unwanted in a context where you are "sure" no one can inject/exploit
your DB, see the JIra issue for details. Note that this does not affect the
*ContentWrapper.java classes where we use OWASP encoding and not sanitizer.
The reason we need the sanitizer here is because we are no only handling
content but also HTML code...
------------------------------------------------------------------------
Added:
ofbiz/branches/release14.12/framework/base/lib/owasp-java-html-sanitizer-r239.jar
- copied unchanged from r1708274,
ofbiz/trunk/framework/base/lib/owasp-java-html-sanitizer-r239.jar
Modified:
ofbiz/branches/release14.12/ (props changed)
ofbiz/branches/release14.12/.classpath
ofbiz/branches/release14.12/LICENSE
ofbiz/branches/release14.12/applications/content/config/content.properties
ofbiz/branches/release14.12/applications/content/src/org/ofbiz/content/content/ContentWorker.java
ofbiz/branches/release14.12/specialpurpose/cmssite/data/CmsSiteDemoData.xml
Propchange: ofbiz/branches/release14.12/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Tue Oct 13 00:45:31 2015
@@ -8,4 +8,4 @@
/ofbiz/branches/json-integration-refactoring:1634077-1635900
/ofbiz/branches/multitenant20100310:921280-927264
/ofbiz/branches/release13.07:1547657
-/ofbiz/trunk:1649072,1649083-1649084,1649086,1649090,1649096,1649230,1649238-1649239,1649248,1649272,1649275,1649280-1649281,1649283,1649285-1649286,1649291,1649329,1649331,1649384,1649393,1649666,1649742,1650240,1650348,1650357,1650583,1650642,1650678,1650821,1650882,1650887,1650938,1651593,1652312,1652361,1652638,1652641,1652672,1652688,1652706,1652725,1652731,1652739,1652852,1653248,1653296,1653456,1653597,1653614,1654175,1654273,1654509,1654670,1654672-1654673,1654683-1654684,1654824,1655046,1655668,1655979,1656014,1656185,1656198,1656445,1656983,1657323,1657506-1657507,1657514,1657714,1657790,1657848,1658364,1658662,1658882,1659224,1659965,1660031,1660053,1660389,1660444,1660579,1661303,1661328,1661760,1661778,1661853,1661862,1661873,1661940,1661951,1661977,1662119-1662120,1662361,1662500,1662812,1662919,1663202,1663912,1663979,1664602,1664604,1664696,1665154,1665162,1665535,1666404,1666511,1666633,1666836,1666939,1666949,1666958,1667055,1667253,1667483,1667492,1667774,1668207,
1668214,1668236,1668246,1668258,1668263,1668265,1668270,1668277,1668314,1668657,1669317,1669588,1672427,1672430,1672846,1672853,1672856,1672862,1672873,1673764,1674447,1674464,1674491,1674496,1674908,1676674,1677123,1677597,1677769-1677770,1678294,1678882,1678911,1679689,1679697,1679709,1679720,1679728,1679732,1679957,1680155,1680288,1680304,1680671,1680675,1680733,1680840,1680881,1682272,1682295,1682415,1682633,1683998,1684094,1686360,1686536,1686545,1686566,1686569,1686574,1686583,1686635,1686651,1686970,1687427,1688772,1690086,1690581,1692357,1692458,1692600,1692604,1693393,1693579,1695017,1696018,1696234,1697590,1697647,1697993,1698259,1698261,1698263,1701164,1701441,1701819,1701825,1701936,1702002,1702548,1702704,1703121,1703586,1703945,1703954,1703965,1703971,1703976-1703977,1703981,1704000,1704014,1704018,1704036,1704043,1704052,1704082,1704140,1704230,1705004,1705329,1705405,1705412,1705417,1705427,1705532,1706159,1706162,1706316,1706531,1706549,1706553,1706561,1706569,17065
77,1706591,1706694,1707837,1707857
+/ofbiz/trunk:1649072,1649083-1649084,1649086,1649090,1649096,1649230,1649238-1649239,1649248,1649272,1649275,1649280-1649281,1649283,1649285-1649286,1649291,1649329,1649331,1649384,1649393,1649666,1649742,1650240,1650348,1650357,1650583,1650642,1650678,1650821,1650882,1650887,1650938,1651593,1652312,1652361,1652638,1652641,1652672,1652688,1652706,1652725,1652731,1652739,1652852,1653248,1653296,1653456,1653597,1653614,1654175,1654273,1654509,1654670,1654672-1654673,1654683-1654684,1654824,1655046,1655668,1655979,1656014,1656185,1656198,1656445,1656983,1657323,1657506-1657507,1657514,1657714,1657790,1657848,1658364,1658662,1658882,1659224,1659965,1660031,1660053,1660389,1660444,1660579,1661303,1661328,1661760,1661778,1661853,1661862,1661873,1661940,1661951,1661977,1662119-1662120,1662361,1662500,1662812,1662919,1663202,1663912,1663979,1664602,1664604,1664696,1665154,1665162,1665535,1666404,1666511,1666633,1666836,1666939,1666949,1666958,1667055,1667253,1667483,1667492,1667774,1668207,
1668214,1668236,1668246,1668258,1668263,1668265,1668270,1668277,1668314,1668657,1669317,1669588,1672427,1672430,1672846,1672853,1672856,1672862,1672873,1673764,1674447,1674464,1674491,1674496,1674908,1676674,1677123,1677597,1677769-1677770,1678294,1678882,1678911,1679689,1679697,1679709,1679720,1679728,1679732,1679957,1680155,1680288,1680304,1680671,1680675,1680733,1680840,1680881,1682272,1682295,1682415,1682633,1683998,1684094,1686360,1686536,1686545,1686566,1686569,1686574,1686583,1686635,1686651,1686970,1687427,1688772,1690086,1690581,1692357,1692458,1692600,1692604,1693393,1693579,1695017,1696018,1696234,1697590,1697647,1697993,1698259,1698261,1698263,1701164,1701441,1701819,1701825,1701936,1702002,1702548,1702704,1703121,1703586,1703945,1703954,1703965,1703971,1703976-1703977,1703981,1704000,1704014,1704018,1704036,1704043,1704052,1704082,1704140,1704230,1705004,1705329,1705405,1705412,1705417,1705427,1705532,1706159,1706162,1706316,1706531,1706549,1706553,1706561,1706569,17065
77,1706591,1706694,1707837,1707857,1708274
Modified: ofbiz/branches/release14.12/.classpath
URL:
http://svn.apache.org/viewvc/ofbiz/branches/release14.12/.classpath?rev=1708275&r1=1708274&r2=1708275&view=diff
==============================================================================
--- ofbiz/branches/release14.12/.classpath (original)
+++ ofbiz/branches/release14.12/.classpath Tue Oct 13 00:45:31 2015
@@ -41,6 +41,7 @@
<classpathentry kind="lib"
path="framework/base/lib/log4j-api-2.3.jar"/>
<classpathentry kind="lib" path="framework/base/lib/mail-1.5.1.jar"/>
<classpathentry kind="lib"
path="framework/base/lib/nekohtml-1.9.16.jar"/>
+ <classpathentry kind="lib"
path="framework/base/lib/owasp-java-html-sanitizer-r239.jar"/>
<classpathentry kind="lib" path="framework/base/lib/esapi-2.1.0.jar"/>
<classpathentry kind="lib"
path="framework/base/lib/resolver-2.9.1.jar"/>
<classpathentry kind="lib"
path="framework/base/lib/serializer-2.9.1.jar"/>
Modified: ofbiz/branches/release14.12/LICENSE
URL:
http://svn.apache.org/viewvc/ofbiz/branches/release14.12/LICENSE?rev=1708275&r1=1708274&r2=1708275&view=diff
==============================================================================
--- ofbiz/branches/release14.12/LICENSE (original)
+++ ofbiz/branches/release14.12/LICENSE Tue Oct 13 00:45:31 2015
@@ -67,6 +67,7 @@ framework/base/lib/j2eespecs/annotations
framework/base/lib/j2eespecs/el-api-2.2.jar
framework/base/lib/j2eespecs/jsp-api-2.2.jar
framework/base/lib/j2eespecs/servlet-api-3.0.jar
+framework/base/lib/owasp-java-html-sanitizer-r239.jar
framework/base/lib/scripting/bsf-2.4.0.jar
framework/base/lib/scripting/jakarta-oro-2.0.8.jar
framework/base/lib/scripting/groovy-all-2.2.1.jar
Modified:
ofbiz/branches/release14.12/applications/content/config/content.properties
URL:
http://svn.apache.org/viewvc/ofbiz/branches/release14.12/applications/content/config/content.properties?rev=1708275&r1=1708274&r2=1708275&view=diff
==============================================================================
---
ofbiz/branches/release14.12/applications/content/config/content.properties
(original)
+++
ofbiz/branches/release14.12/applications/content/config/content.properties
Tue Oct 13 00:45:31 2015
@@ -35,3 +35,7 @@ content.upload.always.local.file=true
# content output folder (relative to ofbiz.home)
content.output.path=runtime/output
+
+#Should we sanitize generic content by default (specific contents -
order, party, category, product, configured product, product promo and work
effort - are always encoded)
+# This has a slightly impact on the code rendered, see . True By default!
+content.sanitize=true
Modified:
ofbiz/branches/release14.12/applications/content/src/org/ofbiz/content/content/ContentWorker.java
URL:
http://svn.apache.org/viewvc/ofbiz/branches/release14.12/applications/content/src/org/ofbiz/content/content/ContentWorker.java?rev=1708275&r1=1708274&r2=1708275&view=diff
==============================================================================
---
ofbiz/branches/release14.12/applications/content/src/org/ofbiz/content/content/ContentWorker.java
(original)
+++
ofbiz/branches/release14.12/applications/content/src/org/ofbiz/content/content/ContentWorker.java
Tue Oct 13 00:45:31 2015
@@ -54,6 +54,7 @@ import org.ofbiz.entity.condition.Entity
import org.ofbiz.entity.condition.EntityOperator;
import org.ofbiz.entity.util.EntityQuery;
import org.ofbiz.entity.util.EntityUtil;
+import org.ofbiz.entity.util.EntityUtilProperties;
import org.ofbiz.minilang.MiniLangException;
import org.ofbiz.minilang.SimpleMapProcessor;
import org.ofbiz.service.DispatchContext;
@@ -61,6 +62,8 @@ import org.ofbiz.service.GenericServiceE
import org.ofbiz.service.LocalDispatcher;
import org.ofbiz.service.ModelService;
import org.ofbiz.service.ServiceUtil;
+import org.owasp.html.PolicyFactory;
+import org.owasp.html.Sanitizers;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
@@ -335,7 +338,23 @@ public class ContentWorker implements or
Locale locale, String mimeTypeId, boolean cache) throws
GeneralException, IOException {
Writer writer = new StringWriter();
renderContentAsText(dispatcher, delegator, contentId, writer,
templateContext, locale, mimeTypeId, null, null, cache);
- return writer.toString();
+ String rendered = writer.toString();
+ // According to
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#XSS_Prevention_Rules_Summary
+ // Normally head should be protected by X-XSS-Protection Response
Header by default
+ if
(EntityUtilProperties.propertyValueEqualsIgnoreCase("content.properties",
"content.sanitize", "true", delegator)
+ && (rendered.contains("<script>")
+ || rendered.contains("<!--")
+ || rendered.contains("<div")
+ || rendered.contains("<style>")
+ || rendered.contains("<span")
+ || rendered.contains("<input")
+ || rendered.contains("<input")
+ || rendered.contains("<iframe")
+ || rendered.contains("<a"))) {
+ PolicyFactory sanitizer =
Sanitizers.FORMATTING.and(Sanitizers.BLOCKS).and(Sanitizers.IMAGES).and(Sanitizers.LINKS).and(Sanitizers.STYLES);
+ rendered = sanitizer.sanitize(rendered);
+ }
+ return rendered;
}
public static String renderContentAsText(LocalDispatcher dispatcher,
Delegator delegator, String contentId, Appendable out,
Modified:
ofbiz/branches/release14.12/specialpurpose/cmssite/data/CmsSiteDemoData.xml
URL:
http://svn.apache.org/viewvc/ofbiz/branches/release14.12/specialpurpose/cmssite/data/CmsSiteDemoData.xml?rev=1708275&r1=1708274&r2=1708275&view=diff
==============================================================================
---
ofbiz/branches/release14.12/specialpurpose/cmssite/data/CmsSiteDemoData.xml
(original)
+++
ofbiz/branches/release14.12/specialpurpose/cmssite/data/CmsSiteDemoData.xml
Tue Oct 13 00:45:31 2015
@@ -78,7 +78,7 @@ under the License.
<p>
This is a site to demonstrate the CMS capabilities of
OFBiz. Its basic function is the editing of website text
inside a browser. If you want to edit the text you are
reading now, logon to the backend system, select the content component
- click on 'cmssite' in the website list and ten click on the
'cms' button. There you see on the left hand side the tree of this website.
+ click on 'cmssite' in the website list and then click on
the 'cms' button. There you see on the left hand side the tree of this
website.
If you click on 'homepage' then you can edit the content of
this page at the box in the r
</p>
<p>
