[JBoss JIRA] Created: (GTNPORTAL-2073) XSS encoding in UIFormTextAreaInput.java
by Honza Fnukal (JIRA)
XSS encoding in UIFormTextAreaInput.java
----------------------------------------
Key: GTNPORTAL-2073
URL: https://issues.jboss.org/browse/GTNPORTAL-2073
Project: GateIn Portal
Issue Type: Enhancement
Security Level: Public (Everyone can see)
Reporter: Honza Fnukal
Fight place where to encode value is when rendering as this is UI component responsibility.
This component is used by many others, and some pass value encoded, some not.
Eg:
In UIGadgetEditor is this method and it encodes value, this cause double encoding:
public void processRender(WebuiRequestContext context) throws Exception
{
UIFormTextAreaInput uiInputSource = getUIFormTextAreaInput(FIELD_SOURCE);
UIFormStringInput uiInputName = getUIStringInput(FIELD_NAME);
String encoded = StringEscapeUtils.escapeHtml(StringEscapeUtils.unescapeHtml(uiInputSource.getValue()));
uiInputSource.setValue(encoded);
if(this.isEdit()) { uiInputName.setEditable(false); }
super.processRender(context);
}
There is probably more code like this, I thin the best is clean it up here.
Unfortunately it is probably in SP in similar way too. If we disable encoding in UIFormTextAreaInput, it will fix double encoding, but enable XSS where it is not encoded.
This task track such places and remove encoding from other places.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years
[JBoss JIRA] Created: (GTNPORTAL-2136) [Shindig] Patch to fix iframeUrl value in metadata request
by kien nguyen (JIRA)
[Shindig] Patch to fix iframeUrl value in metadata request
----------------------------------------------------------
Key: GTNPORTAL-2136
URL: https://issues.jboss.org/browse/GTNPORTAL-2136
Project: GateIn Portal
Issue Type: Task
Security Level: Public (Everyone can see)
Reporter: kien nguyen
Fix For: 3.2.0-M02
Attachments: GTNPORTAL-2136-fix-iframeUrl.patch
We have many case for using the iframeUrl value but now, iframeUrl of metadata is something like this:
"iframeUrl":"//http://%host%/eXoGadgetServer/gadgets/ifr?url=http%3A%2F%2F172.19.20.50%3A8080%2Frest%2Fjcr%2Frepository%2Fdev-monit%2FUntitled%2520file.xml&container=&view=%25view%25&lang=%25lang%25&country=%25country%25&debug=%25debug%25&nocache=%25nocache%25&v=4e0d7f0f06c4a0fe425bcdcb96b9e97f"
The url began with two slashes. we have to remove them.
Apache Shindig issue here: https://issues.apache.org/jira/browse/SHINDIG-1460
I attached patch to fix this
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years
[JBoss JIRA] Created: (GTNPORTAL-2140) Hardcoded Scope.GRANDCHILDREN in UINavigationNodeSelector
by Marek Posolda (JIRA)
Hardcoded Scope.GRANDCHILDREN in UINavigationNodeSelector
---------------------------------------------------------
Key: GTNPORTAL-2140
URL: https://issues.jboss.org/browse/GTNPORTAL-2140
Project: GateIn Portal
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Components: Performance
Affects Versions: 3.2.0-M01
Reporter: Marek Posolda
Fix For: 3.2.0-M02
I am testing with many pages/nodes and I have portal with 27 navigation nodes at navigation bar and each have additional 27 navigation nodes. So I have 27 + 27^2 = 756 navigation nodes.
I tried to change default scope value 2 to value 1 because loading of 756 is very expensive and took more than 100 seconds. So I changed preference "level" for UINavigationPortlet, SiteMapPortlet, UIUserToolbarSitePortlet, UIUserToolbarGroupPortlet, UIUserToolbarDashboardPortlet. This helped to avoid expensive load of all nodes when working with portal. However there is still one place in class UINavigationNodeSelector, where is hardcoded scope to value 2 and when I am trying to edit navigation of my portal, it's loading 120 seconds. Is it possible to make it configurable so that users can change it to 1 or other value according to their preference?
Steps to reproduce:
1) Add portal site with 27 + 27^2 navigation nodes and pages. I am attaching my XML descriptors for this site named "myportal2".
2) Change "level" preference in web.war/WEB-INF/portlet.xml and exoadmin.war/WEB-INF/portlet.xml for UINavigationPortlet, SiteMapPortlet, UIUserToolbarSitePortlet, UIUserToolbarGroupPortlet, UIUserToolbarDashboardPortlet
3) Start portal against emtpy database
4) Login as root
5) http://localhost:8080/portal/classic/portalnavigation and click to "Edit navigation" of portal "myportal2"
Now I need to wait around 120 seconds because UINavigationNodeSelector.initTreeData() needs to load all 756 nodes.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years