JBoss Portal SVN: r12498 - in branches/JBoss_Portal_Branch_2_7/core/src: resources/portal-server-war and 1 other directory.
8:13 a.m.
Author: chris.laprun(a)jboss.com
Date: 2009-01-14 09:13:21 -0500 (Wed, 14 Jan 2009)
New Revision: 12498
Added:
branches/JBoss_Portal_Branch_2_7/core/src/main/org/jboss/portal/core/util/ParameterSanitizer.java
Modified:
branches/JBoss_Portal_Branch_2_7/core/src/resources/portal-server-war/login.jsp
Log:
- Fixed potential XSS issue.
Added:
branches/JBoss_Portal_Branch_2_7/core/src/main/org/jboss/portal/core/util/ParameterSanitizer.java
===================================================================
---
branches/JBoss_Portal_Branch_2_7/core/src/main/org/jboss/portal/core/util/ParameterSanitizer.java
(rev 0)
+++
branches/JBoss_Portal_Branch_2_7/core/src/main/org/jboss/portal/core/util/ParameterSanitizer.java 2009-01-14
14:13:21 UTC (rev 12498)
@@ -0,0 +1,52 @@
+/*
+* JBoss, a division of Red Hat
+* Copyright 2008, Red Hat Middleware, LLC, and individual contributors as indicated
+* by the @authors tag. See the copyright.txt in the distribution for a
+* full listing of individual contributors.
+*
+* This is free software; you can redistribute it and/or modify it
+* under the terms of the GNU Lesser General Public License as
+* published by the Free Software Foundation; either version 2.1 of
+* the License, or (at your option) any later version.
+*
+* This software is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+* Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public
+* License along with this software; if not, write to the Free
+* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+*/
+
+package org.jboss.portal.core.util;
+
+import org.jboss.portal.common.util.ParameterValidation;
+
+import java.util.regex.Pattern;
+
+/**
+ * TODO
+ * @author <a href="mailto:chris.laprun@jboss.com">Chris
Laprun</a>
+ * @version $Revision$
+ * @deprecated Should use {@link
org.jboss.portal.common.util.ParameterValidation#sanitize} instead starting with 2.7.2
+ */
+public class ParameterSanitizer
+{
+ public final static Pattern CSS_DISTANCE =
Pattern.compile("\\d+\\W*(em|ex|px|in|cm|mm|pt|pc|%)?");
+
+ public static String sanitize(String value, Pattern regex, String defaultValue)
+ {
+ ParameterValidation.throwIllegalArgExceptionIfNull(regex, "expected value
format");
+
+ if(value == null || !regex.matcher(value).matches())
+ {
+ return defaultValue;
+ }
+ else
+ {
+ return value;
+ }
+ }
+}
Modified: branches/JBoss_Portal_Branch_2_7/core/src/resources/portal-server-war/login.jsp
===================================================================
---
branches/JBoss_Portal_Branch_2_7/core/src/resources/portal-server-war/login.jsp 2009-01-14
13:21:07 UTC (rev 12497)
+++
branches/JBoss_Portal_Branch_2_7/core/src/resources/portal-server-war/login.jsp 2009-01-14
14:13:21 UTC (rev 12498)
@@ -22,10 +22,14 @@
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--%>
<%@ page pageEncoding="utf-8" %>
<%@page import="org.jboss.portal.identity.UserStatus"%>
+<%@page import="org.jboss.portal.core.util.ParameterSanitizer"%>
<%@page import="java.util.ResourceBundle"%>
<%
ResourceBundle rb = ResourceBundle.getBundle("Resource",
request.getLocale());
+ // todo: use ParameterValidation.sanitize after 2.7.1
+ String loginheight =
+ ParameterSanitizer.sanitize(request.getParameter("loginheight"),
ParameterSanitizer.CSS_DISTANCE, "300px");
%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
@@ -39,7 +43,7 @@
margin: 0;
padding: 0;
border: 0;
- padding-top: <%=(request.getParameter("loginheight") != null ?
request.getParameter("loginheight") : "300px")%>;
+ padding-top: <%=loginheight%>;
}
/* ]]> */
</style>
@@ -82,7 +86,7 @@
{
out.println(rb.getString("ACCOUNT_NOTASSIGNEDTOROLE"));
}
- %>
+ %>
</div>
<form method="post" action="<%=
response.encodeURL("j_security_check") %>" name="loginform"
id="loginForm"
target="_parent">
@@ -95,9 +99,9 @@
<input type="password" name="j_password"
id="j_password" value=""/>
</div><br class="clear"/>
<div class="button-container"><br
class="clear"/>
- <input style="<%=(request.getParameter("loginheight") !=
null ? "" : "display:none")%>;" type="button"
name="cancel" value="<%= rb.getString("LOGIN_CANCEL")
%>" class="cancel-button"
onclick="window.parent.hideContentModal('login-modal');"/>
+ <input style="display:none" type="button"
name="cancel" value="<%= rb.getString("LOGIN_CANCEL")
%>" class="cancel-button"
onclick="window.parent.hideContentModal('login-modal');"/>
<br class="clear"/>
- <input style="<%=(request.getParameter("loginheight") !=
null ? "" : "right:10px")%>;" type="submit"
name="login" value="<%= rb.getString("LOGIN_SUBMIT")
%>" class="login-button"/>
+ <input style="right:10px" type="submit"
name="login" value="<%= rb.getString("LOGIN_SUBMIT")
%>" class="login-button"/>
</div>
<br class="clear"/>
</form>
6394
days inactive
6394
days old
portal-commits@lists.jboss.org
0 comments
1 participants
participants (1)
-
portal-commits＠lists.jboss.org