naruto-lgtm opened a new pull request, #1446:
URL: https://github.com/apache/poi/pull/1446
Repro: rename a font in the font table of any .doc to `</style><p>x` (the
new test does this to Times New Roman in SampleDoc.doc) and convert it with
`WordToHtmlConverter` and a Transformer whose `OutputKeys.METHOD` is `html`, as
the converter's own `main` does. The stylesheet comes out as
`.p1{...font-family:</style><p>x;...}`: the font name closes the `<style>`
element and whatever follows is parsed as markup, so a document converted for
display can carry a `<script>` of its own (stored XSS). A name can also add CSS
declarations and rules.
Cause: `WordToHtmlUtils.addFontFamily`, and an inline copy in
`WordToHtmlConverter.outputCharacters`, append the name from
`Ffn.getMainFontName` to the CSS as it is, and the html output method writes
the text of `<style>` unescaped, so nothing between the font table and the page
escapes it.
Fix: names made of letters, digits, spaces, hyphens and underscores are
written exactly as before; any other name is written as a double-quoted CSS
string with quotes, backslashes, control characters and `<` `>` hex-escaped,
which keeps the name inside its declaration and the declaration inside the
element. The inline copy now goes through `addFontFamily`. The new test fails
before the change; the other tests of the hwpf converter package still pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
