Copilot commented on code in PR #2814:
URL: https://github.com/apache/groovy/pull/2814#discussion_r3809191208
##########
subprojects/groovy-groovydoc/src/test/groovy/org/codehaus/groovy/tools/groovydoc/GroovyDocToolTest.java:
##########
@@ -326,6 +326,52 @@ private String renderSingle(Path sourcePath, String pkg,
String simpleName) thro
return output.getText(MOCK_DIR + "/" + pkg + "/" + simpleName +
".html");
}
+ // GROOVY-12277: a {@link} label and target are doc-comment text that
groovydoc puts into
+ // the href and title of an anchor it builds itself, so they must be
encoded for those
+ // contexts. This is groovydoc's own construction, not the documented
raw-HTML passthrough
+ // of a comment body.
+ public void testLinkTagCannotBreakOutOfTheAnchorItBuilds() throws
Exception {
+ String pkg = "org/codehaus/groovy/tools/groovydoc/testfiles/docfiles";
+ Path tmp = Files.createTempDirectory("linktag-");
+ Path pkgDir = tmp.resolve(pkg);
+ Files.createDirectories(pkgDir);
+ Files.writeString(pkgDir.resolve("Helper.groovy"),
+ "package " + pkg.replace('/', '.') + "\nclass Helper { void
go() {} }\n");
+ Files.writeString(pkgDir.resolve("LinkTag.groovy"),
+ "package " + pkg.replace('/', '.') + "\n" +
+ "/**\n" +
+ " * See {@link Helper x'><img src=q
onerror='alert(1)}\n" +
Review Comment:
The payload in the {@link Helper ...} label uses HTML entities
(`><img`), but `getDocUrl`/`buildUrl` appear to treat the label as plain
text and don’t decode entities. As a result, this assertion can pass even on
the vulnerable implementation because the generated HTML would still contain
`<img...` rather than a literal `<img...>` tag.
To make this a reliable regression test for escaping in `title`/anchor text,
use a payload with literal `'><img ...>` so it would have produced an actual
`<img` tag in the generated HTML before the fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
