snoopdave commented on code in PR #176:
URL: https://github.com/apache/roller/pull/176#discussion_r3918727222
##########
app/src/main/java/org/apache/roller/weblogger/pojos/wrapper/WeblogEntryCommentWrapper.java:
##########
@@ -93,7 +93,7 @@ public String getEmail() {
* Value is always html escaped.
*/
public String getUrl() {
- return StringEscapeUtils.escapeHtml4(this.pojo.getUrl());
+ return StringEscapeUtils.escapeHtml4(this.pojo.getSafeUrl());
Review Comment:
🤖Codex: fixed by returning an empty string for null, blank, or invalid
wrapped author URLs.
##########
app/src/main/java/org/apache/roller/weblogger/pojos/WeblogEntryComment.java:
##########
@@ -130,6 +131,13 @@ public String getUrl() {
public void setUrl(String url) {
this.url = url;
}
+
+ /**
+ * URL of the comment writer when it can be safely rendered as a link.
+ */
+ public String getSafeUrl() {
Review Comment:
🤖Codex: fixed by computing the wrapped URL once and binding the admin-view
value once per row.
##########
app/src/test/java/org/apache/roller/weblogger/ui/rendering/IncomingTrackbackRemovalTest.java:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.roller.weblogger.ui.rendering;
+
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.apache.roller.weblogger.ui.rendering.model.ConfigModel;
+import org.apache.roller.weblogger.ui.rendering.model.URLModel;
+import org.apache.roller.weblogger.util.BannedwordslistChecker;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class IncomingTrackbackRemovalTest {
+
+ @Test
+ void incomingTrackbackClassesAndHelpersAreRemoved() {
+ assertThrows(ClassNotFoundException.class, () -> Class.forName(
+
"org.apache.roller.weblogger.ui.rendering.servlets.TrackbackServlet"));
+ assertThrows(ClassNotFoundException.class, () -> Class.forName(
+
"org.apache.roller.weblogger.ui.rendering.util.WeblogTrackbackRequest"));
+ assertThrows(ClassNotFoundException.class, () -> Class.forName(
+
"org.apache.roller.weblogger.ui.rendering.plugins.comments.TrackbackLinkbackCommentValidator"));
+ assertThrows(NoSuchMethodException.class,
+ () -> URLModel.class.getMethod("trackback", String.class));
+ assertThrows(NoSuchMethodException.class,
+ () -> ConfigModel.class.getMethod("getTrackbacksEnabled"));
+ assertThrows(NoSuchMethodException.class,
+ () -> BannedwordslistChecker.class.getMethod(
+ "checkTrackback",
+
org.apache.roller.weblogger.pojos.WeblogEntryComment.class));
+ }
+
+ @Test
+ void deploymentAndRuntimeConfigurationDoNotExposeTrackbacks() throws
Exception {
+ assertFileDoesNotContain("src/main/webapp/WEB-INF/web.xml",
"trackback");
Review Comment:
🤖Codex: fixed by locating source files relative to the compiled test class
instead of the process working directory.
##########
app/src/main/webapp/WEB-INF/velocity/weblog.vm:
##########
@@ -114,30 +113,6 @@ Show RSS, Atom and RSD auto-discovery links as HTML link
elements.
#end
-#**
- * Display a trackback auto-discovery RDF comment for a WeblogEntry, but only
- * if trackbacks are enabled and comments are allowed for the entry.
- **#
-#macro( showTrackbackAutodiscovery $entry )
-#if($config.trackbacksEnabled && $model.weblog.allowComments &&
$entry.commentsStillAllowed)
-<!--
-<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#";
-
xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/";
- xmlns:dc="http://purl.org/dc/elements/1.1/";>
-<rdf:Description
- rdf:about="$url.entry($entry.anchor)"
- trackback:ping="$url.trackback($entry.anchor)"
- dc:title="$entry.title"
- dc:identifier="$url.entry($entry.anchor)"
- dc:subject="$entry.category.name"
- dc:description="$entry.title"
- dc:creator="$entry.creator.userName"
- dc:date="$entry.pubTime" />
-</rdf:RDF>
--->
-#end
-#end
-
#**
Review Comment:
🤖Codex: fixed by retaining deprecated no-op macro and URLModel helper
compatibility for one release.
##########
app/src/main/java/org/apache/roller/weblogger/util/CommentAuthorUrl.java:
##########
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.roller.weblogger.util;
+
+import org.apache.commons.validator.routines.UrlValidator;
+
+/**
+ * Normalizes comment author URLs before they are rendered as links.
+ */
+public final class CommentAuthorUrl {
+
+ private static final UrlValidator VALIDATOR =
+ new UrlValidator(new String[] {"http", "https"});
+
+ private CommentAuthorUrl() {
+ }
+
+ public static String normalize(String value) {
+ if (value == null || value.isBlank()) {
+ return null;
+ }
+ String normalized = value.trim();
+ return VALIDATOR.isValid(normalized) ? normalized : null;
Review Comment:
🤖Codex: fixed by centralizing posting and rendering on CommentAuthorUrl with
URI and IDN support for local, intranet, underscored, and internationalized
hosts.
##########
app/src/main/resources/ApplicationResources_de.properties:
##########
@@ -252,19 +250,15 @@ configForm.allowNewUsers=Erlaube das Anlegen neuer
Benutzer?
configForm.allowedExtensions=Zul\u00E4ssige Dateierweiterungen
configForm.commentHtmlAllowed=HTML in Kommentaren erlauben?
configForm.commentPlugins=An-/Abschalten von Plugins zur Kommentarformatierung
-configForm.commentSettings=Kommentar und Trackback Einstellungen
configForm.editorPages=Bearbeitungsseiten
configForm.emailComments=E-Mailbenachrichtung bei Kommentaren?
configForm.enableComments=Kommentare in Weblogs erlauben?
Review Comment:
🤖Codex: fixed by restoring neutral comment-settings translations in all
seven localized bundles.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
