Skip to content
This repository was archived by the owner on May 5, 2021. It is now read-only.

Commit e4184b0

Browse files
BarnaBarthaBarnaBartha
authored
Merge pull request SORMAS-Foundation#3083 from hzi-braunschweig/feature-2859-XssHtmlEncoding
Feature 2859 xss html encoding
2 parents 6519e3e + 4a5974d commit e4184b0

19 files changed

Lines changed: 58 additions & 41 deletions

‎sormas-api/src/main/java/de/symeda/sormas/api/ResourceBundle.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
package de.symeda.sormas.api;
22

3+
import org.apache.commons.text.StringEscapeUtils;
4+
35
public class ResourceBundle {
46

57
private java.util.ResourceBundle resourceBundle;
@@ -20,7 +22,7 @@ public String getString(String key, String defaultValue) {
2022

2123
}
2224

23-
return value;
25+
return StringEscapeUtils.escapeHtml4(value);
2426
}
2527

2628
public String getString(String key) {

‎sormas-api/src/main/java/de/symeda/sormas/api/caze/classification/ClassificationHtmlRenderer.java‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
import de.symeda.sormas.api.utils.DataHelper;
3232
import de.symeda.sormas.api.utils.DateHelper;
3333
import de.symeda.sormas.api.utils.InfoProvider;
34+
import org.apache.commons.text.StringEscapeUtils;
3435

3536
/**
3637
* Provides methods that create HTML Strings to visualize the automatic classification rules.
@@ -174,7 +175,7 @@ public static String createHtmlForDownload(String sormasServerUrl, List<Disease>
174175
html.append("<h1 style=\"text-align: center; color: #005A9C;\">").append(I18nProperties.getString(Strings.classificationClassificationRules)).append("</h1>");
175176
html.append("<h4 style=\"text-align: center;\">")
176177
.append(I18nProperties.getString(Strings.classificationGeneratedFor))
177-
.append(" ").append(InfoProvider.get().getVersion())
178+
.append(" ").append(StringEscapeUtils.escapeHtml4(InfoProvider.get().getVersion()))
178179
.append(StringUtils.wrap(I18nProperties.getString(Strings.on), " "))
179180
.append(sormasServerUrl).append(StringUtils.wrap(I18nProperties.getString(Strings.at), " "))
180181
.append(DateHelper.formatLocalDateTime(new Date(), language)).append("</h4>");
@@ -270,9 +271,9 @@ private static String createSurroundingDiv(ClassificationCriteriaType criteriaTy
270271
//@formatter:off
271272
return "<div class='classification-rules'>"
272273
+ "<div class='main-criteria main-criteria-"
273-
+ criteriaType.toString()
274+
+ StringEscapeUtils.escapeHtml4(criteriaType.toString())
274275
+ "'>"
275-
+ content
276+
+ StringEscapeUtils.escapeHtml4(content)
276277
+ "</div></div>";
277278
//@formatter:on
278279
}
@@ -284,7 +285,7 @@ private static String createHeadlineDiv(String headline) {
284285

285286
//@formatter:off
286287
return "<div class='headline'>"
287-
+ headline
288+
+ StringEscapeUtils.escapeHtml4(headline)
288289
+ "</div>";
289290
//@formatter:on
290291
}
@@ -307,7 +308,7 @@ private static String createCriteriaSurroundingDiv(String content) {
307308

308309
//@formatter:off
309310
return "<div class='criteria'>"
310-
+ content
311+
+ StringEscapeUtils.escapeHtml4(content)
311312
+ "</div>";
312313
//@formatter:on
313314
}
@@ -319,7 +320,7 @@ private static String createSubCriteriaSurroundingDiv(String content) {
319320

320321
//@formatter:off
321322
return "<div class='sub-criteria'><div class='sub-criteria-content'>"
322-
+ content
323+
+ StringEscapeUtils.escapeHtml4(content)
323324
+ "</div></div>";
324325
//@formatter:on
325326
}
@@ -328,7 +329,7 @@ private static String createSubCriteriaSurroundingDiv(String content) {
328329
* Creates the div for an actual criteria containing its description.
329330
*/
330331
private static String createCriteriaItemDiv(String text) {
331-
return text + "<br/>";
332+
return StringEscapeUtils.escapeHtml4(text) + "<br/>";
332333
}
333334

334335
private enum ClassificationCriteriaType {

‎sormas-ui/src/main/java/de/symeda/sormas/ui/action/ActionListEntry.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
import de.symeda.sormas.ui.utils.ButtonHelper;
3838
import de.symeda.sormas.ui.utils.CssStyles;
3939
import de.symeda.sormas.ui.utils.DateFormatHelper;
40+
import org.apache.commons.text.StringEscapeUtils;
4041

4142
@SuppressWarnings("serial")
4243
public class ActionListEntry extends HorizontalLayout {
@@ -77,11 +78,11 @@ public ActionListEntry(ActionDto action) {
7778
descReplyLayout.addStyleName(CssStyles.RICH_TEXT_CONTENT_CONTAINER);
7879
withContentLayout.addComponents(descReplyLayout);
7980

80-
Label description = new Label(action.getDescription(), ContentMode.HTML);
81+
Label description = new Label(StringEscapeUtils.escapeHtml4(action.getDescription()), ContentMode.HTML);
8182
description.setWidth(100, Unit.PERCENTAGE);
8283
descReplyLayout.addComponent(description);
8384
if (!Strings.isNullOrEmpty(action.getReply())) {
84-
Label replyLabel = new Label(action.getReply(), ContentMode.HTML);
85+
Label replyLabel = new Label(StringEscapeUtils.escapeHtml4(action.getReply()), ContentMode.HTML);
8586
replyLabel.setWidth(100, Unit.PERCENTAGE);
8687
replyLabel.addStyleName(CssStyles.REPLY);
8788
descReplyLayout.addComponent(replyLabel);

‎sormas-ui/src/main/java/de/symeda/sormas/ui/configuration/linelisting/LineListingActiveDistrictsLayout.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import de.symeda.sormas.api.i18n.Strings;
1212
import de.symeda.sormas.ui.utils.CssStyles;
1313
import de.symeda.sormas.ui.utils.DateFormatHelper;
14+
import org.apache.commons.text.StringEscapeUtils;
1415

1516
@SuppressWarnings("serial")
1617
public class LineListingActiveDistrictsLayout extends CssLayout {
@@ -27,7 +28,7 @@ private void buildLayout() {
2728

2829
for (FeatureConfigurationIndexDto config : configurations) {
2930
StringBuilder captionBuilder = new StringBuilder();
30-
captionBuilder.append("<b>").append(config.getDistrictName()).append("</b><br/>");
31+
captionBuilder.append("<b>").append(StringEscapeUtils.escapeHtml4(config.getDistrictName())).append("</b><br/>");
3132
if (config.getEndDate() != null) {
3233
captionBuilder.append(I18nProperties.getString(Strings.until)).append(" ").append(DateFormatHelper.formatDate(config.getEndDate()));
3334
} else {

‎sormas-ui/src/main/java/de/symeda/sormas/ui/configuration/linelisting/LineListingConfigurationEditLayout.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
import de.symeda.sormas.api.i18n.Strings;
2525
import de.symeda.sormas.ui.utils.ButtonHelper;
2626
import de.symeda.sormas.ui.utils.CssStyles;
27+
import org.apache.commons.text.StringEscapeUtils;
2728

2829
@SuppressWarnings("serial")
2930
public class LineListingConfigurationEditLayout extends VerticalLayout {
@@ -66,7 +67,7 @@ private void buildLayout() {
6667
I18nProperties.getString(
6768
regionName != null ? Strings.infoLineListingConfigurationRegionEdit : Strings.infoLineListingConfigurationNationEdit),
6869
disease.toString(),
69-
regionName),
70+
StringEscapeUtils.escapeHtml4(regionName)),
7071
ContentMode.HTML);
7172
CssStyles.style(lblInfo, CssStyles.VSPACE_4);
7273
addComponent(lblInfo);

‎sormas-ui/src/main/java/de/symeda/sormas/ui/dashboard/DiseaseBurdenGrid.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -94,12 +94,9 @@ public String convertToPresentation(Float value, Class<? extends String> targetT
9494
String strValue = "" + Math.abs(value);
9595
if (strValue.equals("100.0"))
9696
strValue = "100";
97-
// or use below to remove insignificant decimals
98-
// if (strValue.endsWith(".0"))
99-
// strValue = strValue.substring(0, strValue.length() - 3);
10097

10198
//@formatter:off
102-
stringRepresentation =
99+
stringRepresentation =
103100
"<div style=\"width:100%\">"
104101
+ "<div class=\"\" style=\"display: inline-block;margin-top: 2px;width: 70%;text-align:left;\">" + strValue + "%" + "</div>"
105102
+ "<div class=\"v-label v-widget " + criticalLevel + " v-label-" + criticalLevel

‎sormas-ui/src/main/java/de/symeda/sormas/ui/dashboard/campaigns/CampaignDashboardDiagramComponent.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
import de.symeda.sormas.api.i18n.Captions;
88
import de.symeda.sormas.api.i18n.I18nProperties;
99
import de.symeda.sormas.ui.highcharts.HighChart;
10+
import org.apache.commons.text.StringEscapeUtils;
1011

1112
import java.math.BigDecimal;
1213
import java.math.RoundingMode;
@@ -49,7 +50,6 @@ public CampaignDashboardDiagramComponent(
4950

5051
setMargin(false);
5152
addComponent(campaignColumnChart);
52-
// setExpandRatio(campaignColumnChart, 1);
5353

5454
for (CampaignDiagramDataDto diagramData : diagramDataList) {
5555
if (!axisKeys.contains(diagramData.getGroupingKey())) {
@@ -106,10 +106,10 @@ public void buildDiagramChart(String title) {
106106
}
107107

108108
//@formatter:off
109-
hcjs.append("} } },"
109+
hcjs.append("} } },"
110110
+ "legend: { backgroundColor: 'transparent', margin: 30 },"
111111
+ "colors: ['#4472C4', '#ED7D31', '#A5A5A5', '#FFC000', '#5B9BD5', '#70AD47', '#FF0000', '#6691C4','#ffba08','#519e8a','#ed254e','#39a0ed','#FF8C00','#344055','#D36135','#82d173'],"
112-
+ "title:{ text: '" + title + "', style: { fontSize: '15px' } },");
112+
+ "title:{ text: '" + StringEscapeUtils.escapeEcmaScript(title) + "', style: { fontSize: '15px' } },");
113113
//@formatter:on
114114

115115
Map<String, Long> stackMap = diagramDefinition.getCampaignDiagramSeries()
@@ -124,7 +124,7 @@ public void buildDiagramChart(String title) {
124124
}
125125
hcjs.append("categories: [");
126126
for (Object axisKey : axisKeys) {
127-
hcjs.append("'").append(axisCaptions.get(axisKey)).append("',");
127+
hcjs.append("'").append(StringEscapeUtils.escapeEcmaScript(axisCaptions.get(axisKey))).append("',");
128128
}
129129
hcjs.append("]},");
130130

@@ -166,7 +166,7 @@ public void buildDiagramChart(String title) {
166166
Collection<CampaignDiagramDataDto> values = seriesData.values();
167167
Iterator<CampaignDiagramDataDto> iterator = values.iterator();
168168
final String fieldName = iterator.hasNext() ? iterator.next().getFieldCaption() : seriesKey;
169-
hcjs.append("{ name:'").append(fieldName).append("', data: [");
169+
hcjs.append("{ name:'").append(StringEscapeUtils.escapeEcmaScript(fieldName)).append("', data: [");
170170
for (Object axisKey : axisKeys) {
171171
if (seriesData.containsKey(axisKey)) {
172172
if (showPercentages && totalValuesMap != null) {
@@ -189,7 +189,7 @@ public void buildDiagramChart(String title) {
189189
}
190190
}
191191
if (series.getStack() != null) {
192-
hcjs.append("],stack:'").append(series.getStack()).append("'},");
192+
hcjs.append("],stack:'").append(StringEscapeUtils.escapeEcmaScript(series.getStack())).append("'},");
193193
} else {
194194
hcjs.append("]},");
195195
}

‎sormas-ui/src/main/java/de/symeda/sormas/ui/events/EventController.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@
5757
import de.symeda.sormas.ui.utils.CommitDiscardWrapperComponent;
5858
import de.symeda.sormas.ui.utils.CommitDiscardWrapperComponent.CommitListener;
5959
import de.symeda.sormas.ui.utils.VaadinUiUtil;
60+
import org.apache.commons.text.StringEscapeUtils;
6061

6162
public class EventController {
6263

@@ -397,7 +398,7 @@ public void deleteAllSelectedItems(Collection<EventIndexDto> selectedRows, Runna
397398
String.format(
398399
I18nProperties.getString(Strings.messageCountEventsNotDeleted),
399400
String.format("<b>%s</b>", countNotDeletedEvents),
400-
String.format("<b>%s</b>", nonDeletableEvents)),
401+
String.format("<b>%s</b>", StringEscapeUtils.escapeHtml4(nonDeletableEvents.toString()))),
401402
I18nProperties.getString(Strings.messageEventsNotDeletedReason)),
402403
ContentMode.HTML);
403404
response.setWidth(600, Sizeable.Unit.PIXELS);

‎sormas-ui/src/main/java/de/symeda/sormas/ui/statistics/StatisticsView.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -314,7 +314,7 @@ private void addGenerateButton(VerticalLayout statisticsLayout) {
314314
Notification errorNotification = null;
315315
for (StatisticsFilterComponent filterComponent : filterComponents) {
316316
if (filterComponent.getSelectedAttribute() != StatisticsCaseAttribute.JURISDICTION
317-
&& filterComponent.getSelectedAttribute() != StatisticsCaseAttribute.PLACE_OF_RESIDENCE
317+
&& filterComponent.getSelectedAttribute() != StatisticsCaseAttribute.PLACE_OF_RESIDENCE
318318
&& (filterComponent.getSelectedAttribute() == null
319319
|| filterComponent.getSelectedAttribute().getSubAttributes().length > 0
320320
&& filterComponent.getSelectedSubAttribute() == null)) {
@@ -544,7 +544,7 @@ public void generateChart() {
544544
hcjs.append("xAxis: { categories: [");
545545
if (xAxisAttribute != null) {
546546
xAxisCaptions.forEach((key, value) -> {
547-
hcjs.append("'").append(xAxisCaptions.get(key)).append("',");
547+
hcjs.append("'").append(StringEscapeUtils.escapeEcmaScript(xAxisCaptions.get(key))).append("',");
548548
});
549549

550550
if (appendUnknownXAxisCaption) {
@@ -628,7 +628,7 @@ public void generateChart() {
628628
seriesValue = value.getIncidence(incidenceDivisor);
629629
}
630630
Object seriesId = value.getRowKey();
631-
hcjs.append("['").append(seriesCaptions.get(seriesId)).append("',").append(seriesValue).append("],");
631+
hcjs.append("['").append(StringEscapeUtils.escapeEcmaScript(seriesCaptions.get(seriesId))).append("',").append(seriesValue).append("],");
632632
});
633633
if (unknownSeriesElement != null) {
634634
Object seriesValue;
@@ -1020,7 +1020,7 @@ private List<StatisticsCaseCountDto> generateStatistics() {
10201020
if (hasMissingPopulationData) {
10211021
caseIncidencePossible = false;
10221022
List<String> missingPopulationDataNamesList = FacadeProvider.getRegionFacade().getNamesByIds(missingPopulationDataRegionIds);
1023-
missingPopulationDataNames = String.join(", ", missingPopulationDataNamesList);
1023+
missingPopulationDataNames = StringEscapeUtils.escapeEcmaScript(String.join(", ", missingPopulationDataNamesList));
10241024
}
10251025
}
10261026

‎sormas-ui/src/main/java/de/symeda/sormas/ui/task/TaskGrid.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,11 @@
2323
import com.vaadin.data.provider.DataProvider;
2424
import com.vaadin.data.provider.ListDataProvider;
2525
import com.vaadin.shared.data.sort.SortDirection;
26+
import com.vaadin.ui.Label;
2627
import com.vaadin.ui.renderers.DateRenderer;
2728
import com.vaadin.ui.renderers.HtmlRenderer;
2829

30+
import com.vaadin.ui.renderers.TextRenderer;
2931
import de.symeda.sormas.api.FacadeProvider;
3032
import de.symeda.sormas.api.Language;
3133
import de.symeda.sormas.api.ReferenceDto;
@@ -118,14 +120,14 @@ public TaskGrid(TaskCriteria criteria) {
118120

119121
Column<TaskIndexDto, UserReferenceDto> assigneeUserColumn = (Column<TaskIndexDto, UserReferenceDto>) getColumn(TaskIndexDto.ASSIGNEE_USER);
120122
assigneeUserColumn.setRenderer(user -> {
121-
String html;
123+
String text;
122124
if (user != null) {
123-
html = ControllerProvider.getTaskController().getUserCaptionWithPendingTaskCount(user);
125+
text = ControllerProvider.getTaskController().getUserCaptionWithPendingTaskCount(user);
124126
} else {
125-
html = "";
127+
text = "";
126128
}
127-
return html;
128-
}, new HtmlRenderer());
129+
return text;
130+
}, new TextRenderer());
129131

130132
Column<TaskIndexDto, TaskPriority> priorityColumn = (Column<TaskIndexDto, TaskPriority>) getColumn(TaskIndexDto.PRIORITY);
131133
priorityColumn.setStyleGenerator(item -> {

0 commit comments

Comments
 (0)