diff --git a/WebContent/WEB-INF/dwr.xml b/WebContent/WEB-INF/dwr.xml index 2d6c68637b..87e211ebed 100644 --- a/WebContent/WEB-INF/dwr.xml +++ b/WebContent/WEB-INF/dwr.xml @@ -20,11 +20,10 @@ - - - - - + + + + @@ -111,8 +110,8 @@ - - + + @@ -139,28 +138,28 @@ - - - - - - - + + + + + + + - - + + - + - + @@ -172,16 +171,16 @@ - + - + - + - + @@ -190,8 +189,8 @@ - - + + @@ -216,8 +215,8 @@ - - + + @@ -240,15 +239,35 @@ + + + + + + + + + + + + + + + + + + + + - - - - + + + + ", data.mailingLists, data.users); @@ -228,7 +228,7 @@ img = "images/cog_process.png"; var node = dojo.widget.createWidget("TreeNode", { - title: " "+ handler.message +"", + title: " "+ unescapeHtml(handler.message) +"", widgetId: "h"+ handler.id, object: handler }); @@ -286,7 +286,7 @@ $set("handlerTypeSelect", handler.handlerType); $("handlerTypeSelect").disabled = true; $set("xid", handler.xid); - $set("alias", handler.alias); + $set("alias", unescapeHtml(handler.alias)); $set("disabled", handler.disabled); if (handler.handlerType == ) { $set("targetPointSelect", handler.targetPointId); @@ -527,7 +527,7 @@ selectedHandlerNode.onTitleClick(); } else - $set(handler.id +"Msg", handler.message); + $set(handler.id +"Msg", unescapeHtml(handler.message)); setUserMessage(""); selectedHandlerNode.object = handler; diff --git a/WebContent/WEB-INF/jsp/include/settingsEditor.jsp b/WebContent/WEB-INF/jsp/include/settingsEditor.jsp index 84ad9df6d4..5d56ae000b 100644 --- a/WebContent/WEB-INF/jsp/include/settingsEditor.jsp +++ b/WebContent/WEB-INF/jsp/include/settingsEditor.jsp @@ -153,15 +153,15 @@ this.updatePointList = function(dataTypes) { dwr.util.removeAllOptions("settingsPointList"); - - for (i=0; i - +
@@ -59,7 +59,7 @@ - + "/> diff --git a/WebContent/WEB-INF/jsp/pointHierarchySLTS.jsp b/WebContent/WEB-INF/jsp/pointHierarchySLTS.jsp index c0a5ac24bf..0437618e69 100644 --- a/WebContent/WEB-INF/jsp/pointHierarchySLTS.jsp +++ b/WebContent/WEB-INF/jsp/pointHierarchySLTS.jsp @@ -815,21 +815,33 @@ var messages = { dialog.getButton('btn-Close').disable(); var $button = this; $button.disable(); - $button.spin(); - dialog.setClosable(false); - $.ajax({ - type: "POST", - dataType: "json", - url:myLocation+"pointHierarchy/new/0/"+dialog.getModalBody().find('input').val(), - success: function(msg){ - var titleNewNode = dialog.getModalBody().find('input').val(); - dialog.getModalBody().html('

'+messages.folder+':

  • '+messages.key+':'+msg+'
  • '+messages.title+':'+titleNewNode+'
'); - $button.hide(); - $button.stopSpin(); - dialog.setClosable(true); - dialog.getButton('btn-Close').enable(); - dialog.close(); - reload(); + $button.spin(); + dialog.setClosable(false); + let inputs = dialog.getModalBody().find('input'); + let titleNewNode; + if(inputs.length == 1) { + let inputNode = inputs[0]; + titleNewNode = inputNode.value ? inputNode.value.replaceAll('\\','').replaceAll('\/','') : ''; + } + + if(!titleNewNode) { + dialog.getModalBody().html('

'+messages.folderNotAdd+'

'+ messages.errorThrown +':'+errorThrown+'

'); + dialog.setClosable(true); + dialog.getButton('btn-Close').enable(); + return; + } + + $.ajax({ + type: "POST", + dataType: "json", + url:myLocation+"pointHierarchy/new/0/"+titleNewNode, + success: function(msg){ + $button.hide(); + $button.stopSpin(); + dialog.setClosable(true); + dialog.getButton('btn-Close').enable(); + dialog.close(); + reload(); }, error: function(XMLHttpRequest, textStatus, errorThrown) { dialog.getModalBody().html('

'+messages.folderNotAdd+'

'+ messages.errorThrown +':'+errorThrown+'

'); diff --git a/WebContent/WEB-INF/jsp/pointLinks.jsp b/WebContent/WEB-INF/jsp/pointLinks.jsp index 1ca2b832d4..694a6de922 100644 --- a/WebContent/WEB-INF/jsp/pointLinks.jsp +++ b/WebContent/WEB-INF/jsp/pointLinks.jsp @@ -28,17 +28,19 @@ function init() { PointLinksDwr.init(function(response) { + let srcOpts = response.sourcePoints.map(p => ({ key: p.key, value: unescapeHtml(p.value) })); + let tgtOpts = response.targetPoints.map(p => ({ key: p.key, value: unescapeHtml(p.value) })); sourcePoints = response.sourcePoints; // Add points to source and target selects - dwr.util.addOptions("sourcePointId", response.sourcePoints, "key", "value"); + dwr.util.addOptions("sourcePointId", srcOpts, "key", "value"); jQuery("#sourcePointId").chosen({ allow_single_deselect: true, placeholder_text_single: "", search_contains: true, width: "100%" }); - dwr.util.addOptions("targetPointId", response.targetPoints, "key", "value"); + dwr.util.addOptions("targetPointId", tgtOpts, "key", "value"); jQuery("#targetPointId").chosen({ allow_single_deselect: true, placeholder_text_single: "", diff --git a/WebContent/WEB-INF/jsp/publisherEdit.jsp b/WebContent/WEB-INF/jsp/publisherEdit.jsp index e6d5528553..211c9a4a8f 100644 --- a/WebContent/WEB-INF/jsp/publisherEdit.jsp +++ b/WebContent/WEB-INF/jsp/publisherEdit.jsp @@ -95,7 +95,7 @@ - + @@ -103,20 +103,20 @@ - + - + - + @@ -124,7 +124,7 @@ - + @@ -134,14 +134,14 @@ + selectedValue=""/> - - + + diff --git a/WebContent/WEB-INF/jsp/publisherEdit/editHttpSender.jsp b/WebContent/WEB-INF/jsp/publisherEdit/editHttpSender.jsp index 54a80b122b..cb97d8c666 100644 --- a/WebContent/WEB-INF/jsp/publisherEdit/editHttpSender.jsp +++ b/WebContent/WEB-INF/jsp/publisherEdit/editHttpSender.jsp @@ -35,22 +35,22 @@ var list = response.data.allPoints; for (var i=0; i"; @@ -164,7 +164,7 @@ else { hide("noStaticParametersMsg"); dwr.util.addRows("staticParameterList", staticParameterList, [ - function(data) { return data.key +"="+ data.value; }, + function(data) { return escapeHtml(data.key) +"="+ escapeHtml(data.value); }, function(data, options) { return ""; @@ -211,11 +211,11 @@ hide("selectedPointsEmpty"); dwr.util.addRows("selectedPoints", selectedPoints, [ - function(data) { return data.pointName; }, + function(data) { return "" + escapeHtml(data.pointName) + ""; }, function(data) { return ""; }, - function(data) { return data.pointType; }, + function(data) { return "" + data.pointType + ""; }, function(data) { - return ""; }, function(data) { diff --git a/WebContent/WEB-INF/jsp/publisherEdit/editPachube.jsp b/WebContent/WEB-INF/jsp/publisherEdit/editPachube.jsp index bd9c9742a2..411f1ea4f2 100644 --- a/WebContent/WEB-INF/jsp/publisherEdit/editPachube.jsp +++ b/WebContent/WEB-INF/jsp/publisherEdit/editPachube.jsp @@ -27,7 +27,7 @@ var list = response.data.allPoints; for (var i=0; i" + escapeHtml(data.pointName) + ""; }, function(data) { return ""; }, function(data) { return data.pointType; }, function(data) { diff --git a/WebContent/WEB-INF/jsp/publisherEdit/editPersistent.jsp b/WebContent/WEB-INF/jsp/publisherEdit/editPersistent.jsp index 99c3bfecf1..2d22baf2e5 100644 --- a/WebContent/WEB-INF/jsp/publisherEdit/editPersistent.jsp +++ b/WebContent/WEB-INF/jsp/publisherEdit/editPersistent.jsp @@ -28,7 +28,7 @@ var list = response.data.allPoints; for (var i=0; i" + escapeHtml(data.pointName) + ""; }, function(data) { return ""; }, function(data) { return data.pointType; }, function(data) { diff --git a/WebContent/WEB-INF/jsp/publisherList.jsp b/WebContent/WEB-INF/jsp/publisherList.jsp index 43246b24db..89425474ec 100644 --- a/WebContent/WEB-INF/jsp/publisherList.jsp +++ b/WebContent/WEB-INF/jsp/publisherList.jsp @@ -34,9 +34,9 @@ dwr.util.removeAllRows("publisherList"); dwr.util.addRows("publisherList", publishers, [ - function(p) { return ""+ p.name +""; }, - function(p) { return p.typeMessage; }, - function(p) { return p.configDescription; }, + function(p) { return "" + p.name + ""; }, + function(p) { return "" + unescapeHtml(p.typeMessage) + ""; }, + function(p) { return "" + unescapeHtml(p.configDescription) + ""; }, function(p) { if (p.enabled) return '" '+ diff --git a/WebContent/WEB-INF/jsp/reports.jsp b/WebContent/WEB-INF/jsp/reports.jsp index fd92eb1666..318964b300 100644 --- a/WebContent/WEB-INF/jsp/reports.jsp +++ b/WebContent/WEB-INF/jsp/reports.jsp @@ -142,7 +142,7 @@ hide("noReportInstances"); dwr.util.addRows("reportInstancesList", instanceArray, [ - function(ri) { return "" + escapeHtml(ri.name) + ""; }, + function(ri) { return ri.name; }, function(ri) { return ri.prettyRunStartTime; }, function(ri) { return ri.prettyRunDuration; }, function(ri) { return ri.prettyReportStartTime; }, @@ -158,15 +158,15 @@ return ""; var result = ""; + "onclick='exportData(\""+ ri.name +"\", "+ ri.id +")'/>"; if (ri.includeEvents != ) result += ""; + "onclick='exportEventData(\""+ ri.name +"\", "+ ri.id +")'/>"; if (ri.includeUserComments) result += ""; + "onclick='exportUserComments(\""+ ri.name +"\", "+ ri.id +")'/>"; result += ""+ @@ -204,15 +204,15 @@ } function exportData(name, instanceId) { - window.location = "export/"+ name +".csv?instanceId="+ instanceId; + window.location = "export/"+ encodeURIComponent(name) +".csv?instanceId="+ instanceId; } function exportEventData(name, instanceId) { - window.location = "eventExport/"+ name +"Events.csv?instanceId="+ instanceId; + window.location = "eventExport/"+ encodeURIComponent(name) +"Events.csv?instanceId="+ instanceId; } function exportUserComments(name, instanceId) { - window.location = "userCommentExport/"+ name +"Comments.csv?instanceId="+ instanceId; + window.location = "userCommentExport/"+ encodeURIComponent(name) +"Comments.csv?instanceId="+ instanceId; } function viewChart(instanceId) { @@ -336,8 +336,7 @@ } function updateReport(id, name) { - let escapedName = escapeHtml(name); - $("r"+ id +"Name").innerHTML = escapedName; + $("r"+ id +"Name").innerHTML = name; } function clearMessages() { diff --git a/WebContent/WEB-INF/jsp/scheduledEvents.jsp b/WebContent/WEB-INF/jsp/scheduledEvents.jsp index 11f3da220a..2588e03020 100644 --- a/WebContent/WEB-INF/jsp/scheduledEvents.jsp +++ b/WebContent/WEB-INF/jsp/scheduledEvents.jsp @@ -76,8 +76,8 @@ show($("scheduledEventDetails")); editingScheduledEvent = se; - $set("xid", se.xid); - $set("alias", se.alias); + $set("xid", unescapeHtml(se.xid)); + $set("alias", unescapeHtml(se.alias)); $set("alarmLevel", se.alarmLevel); updateAlarmLevelImage(); $set("scheduleType", se.scheduleType); @@ -91,14 +91,14 @@ $set("activeHour", se.activeHour); $set("activeMinute", se.activeMinute); $set("activeSecond", se.activeSecond); - $set("activeCron", se.activeCron); + $set("activeCron", unescapeHtml(se.activeCron)); $set("inactiveYear", se.inactiveYear); $set("inactiveMonth", se.inactiveMonth); $set("inactiveDay", se.inactiveDay); $set("inactiveHour", se.inactiveHour); $set("inactiveMinute", se.inactiveMinute); $set("inactiveSecond", se.inactiveSecond); - $set("inactiveCron", se.inactiveCron); + $set("inactiveCron", unescapeHtml(se.inactiveCron)); setUserMessage(); }); diff --git a/WebContent/WEB-INF/jsp/scripting.jsp b/WebContent/WEB-INF/jsp/scripting.jsp index cf42c8eaaa..65d0f730e8 100644 --- a/WebContent/WEB-INF/jsp/scripting.jsp +++ b/WebContent/WEB-INF/jsp/scripting.jsp @@ -103,7 +103,7 @@ } function updateScript(se) { - $("se"+ se.id +"Name").innerHTML = escapeHtml(se.name); + $("se"+ se.id +"Name").innerHTML = se.name; //setScheduledEventImg(se.disabled, $("se"+ se.id +"Img")); } @@ -118,9 +118,9 @@ show($("scriptDetails")); editingScript = s; - setValueInNode('xid', s.xid); - setValueInNode('name', s.name); - setValueInNode('script', s.script); + setValueInNode('xid', unescapeHtml(s.xid)); + setValueInNode('name', unescapeHtml(s.name)); + setValueInNode('script', unescapeHtml(s.script)); let handlePointsContext = new ScriptPointsContext(s.pointsOnContext, pointsArray); setPointsContext(handlePointsContext); diff --git a/WebContent/WEB-INF/jsp/users.jsp b/WebContent/WEB-INF/jsp/users.jsp index 50833c25a5..7116b6b5e3 100644 --- a/WebContent/WEB-INF/jsp/users.jsp +++ b/WebContent/WEB-INF/jsp/users.jsp @@ -323,7 +323,7 @@ function updateUser(response) { var user = response.data ? response.data.user : response.user; - $("u"+ user.id +"Username").textContent = user.username; + $("u"+ user.id +"Username").innerHTML = user.username; setUserImg(user.admin, user.disabled, $("u"+ user.id +"Img")); } diff --git a/WebContent/WEB-INF/jsp/usersProfiles.jsp b/WebContent/WEB-INF/jsp/usersProfiles.jsp index 20c796fd48..e5e7faff76 100644 --- a/WebContent/WEB-INF/jsp/usersProfiles.jsp +++ b/WebContent/WEB-INF/jsp/usersProfiles.jsp @@ -148,7 +148,7 @@ function showUserProfileCB(userProfile) { //show($("deleteButton")); show($("userProfileDetails")); - $set("userProfileName", userProfile.name); + $set("userProfileName", unescapeHtml(userProfile.name)); if (dataSources != null){ var i, j, dscb, dp; diff --git a/WebContent/WEB-INF/jsp/watchList.jsp b/WebContent/WEB-INF/jsp/watchList.jsp index 2ad9d93b81..192b68c453 100644 --- a/WebContent/WEB-INF/jsp/watchList.jsp +++ b/WebContent/WEB-INF/jsp/watchList.jsp @@ -120,7 +120,7 @@ function addPointNames(folder) { var i; for (i=0; i " + spanNode.innerHTML + "", @@ -658,10 +658,10 @@ - - ${sst:escapeLessThan(wl.value)} + ${sst:escapeLessThan(wl.value)} diff --git a/WebContent/WEB-INF/tags/page.tag b/WebContent/WEB-INF/tags/page.tag index 6c28a5b385..1e74c63756 100644 --- a/WebContent/WEB-INF/tags/page.tag +++ b/WebContent/WEB-INF/tags/page.tag @@ -30,7 +30,9 @@ <c:choose> - <c:when test="${!empty instanceDescriptionHeader}">${instanceDescriptionHeader}</c:when> + <c:when test="${!empty instanceDescriptionHeader}"> + <c:out value="${instanceDescriptionHeader}"/> + </c:when> <c:otherwise><spring:message code="header.title"/></c:otherwise> </c:choose> @@ -218,7 +220,9 @@
diff --git a/build.gradle b/build.gradle index 0d97451cff..18ed3a2aeb 100644 --- a/build.gradle +++ b/build.gradle @@ -241,13 +241,14 @@ test { includeTestsMatching "com.serotonin.mango.util.StartStopDataPointsUtilsTestsSuite" includeTestsMatching "org.scada_lts.utils.BlockingQueuesUtilsTest" includeTestsMatching "org.scada_lts.web.security.XssValidatorUtilsTestsSuite" - includeTestsMatching "org.scada_lts.web.mvc.api.validation.css.CssValidatorTestsSuite" + includeTestsMatching "org.scada_lts.web.beans.validation.css.CssValidatorTestsSuite" includeTestsMatching "org.scada_lts.web.beans.validation.xss.XssValidatorTestsSuite" includeTestsMatching "org.scada_lts.utils.CyclicDependencyValidationUtilsTest" includeTestsMatching "org.scada_lts.ds.polling.protocol.opcua.vo.OpcUaDataTypeTestsSuite" includeTestsMatching "com.serotonin.mango.vo.EngineeringUnitsTypesTest" includeTestsMatching "org.scada_lts.cache.PointHierarchyCacheTestsSuite" includeTestsMatching "com.serotonin.mango.rt.dataImage.types.BinaryValueTestsSuite" + includeTestsMatching "org.scada_lts.web.security.dwr.XssBeanConverterUtilsTestsSuite" } failFast = true diff --git a/scadalts-ui/src/apps/App.vue b/scadalts-ui/src/apps/App.vue index 9211f0703f..c2d26da627 100644 --- a/scadalts-ui/src/apps/App.vue +++ b/scadalts-ui/src/apps/App.vue @@ -18,12 +18,8 @@
- - {{ topDescriptionPrefix }} - - - {{ topDescription }} - + +
@@ -89,7 +85,7 @@ import NavigationBar from '../layout/NavigationBar.vue'; import internetMixin from '@/utils/connection-status-utils'; import NotificationAlert from '../layout/snackbars/NotificationAlert.vue'; -import {unescapeHtml} from "@/utils/common"; +import {unescapeHtml, unescapeVueHtml} from "@/utils/common"; export default { name: 'app', @@ -179,6 +175,7 @@ export default { }, methods: { + unescapeVueHtml, fetchCustomCss() { let customCss = this.$store.state.systemSettings.customCss; diff --git a/scadalts-ui/src/components/common/EscapedTextarea.vue b/scadalts-ui/src/components/common/EscapedTextarea.vue new file mode 100644 index 0000000000..ebcdc61c9b --- /dev/null +++ b/scadalts-ui/src/components/common/EscapedTextarea.vue @@ -0,0 +1,51 @@ + + + diff --git a/scadalts-ui/src/components/datasources/MetaDataSource/point.vue b/scadalts-ui/src/components/datasources/MetaDataSource/point.vue index 0c8e2d4f00..af01bcd747 100644 --- a/scadalts-ui/src/components/datasources/MetaDataSource/point.vue +++ b/scadalts-ui/src/components/datasources/MetaDataSource/point.vue @@ -316,7 +316,7 @@ - + > {{ $t('script.runScript') }} @@ -384,8 +384,10 @@ "); + objectEscaped = new ContextualizedScriptVO(); + objectEscaped.setScript("<script>alert(1)</script>"); + } + + @Test + public void when_convertObjectEscaped_then_Object_escaped() throws ScadaMarshallException { + + //when: + Object result = XssBeanConverterUtils.convertObjectEscaped(objectUnescaped); + + //then: + Assert.assertEquals(objectEscaped, result); + } + + @Test + public void when_convertObjectUnescaped_then_Object_unescaped() throws ScadaMarshallException { + + //when: + Object result = XssBeanConverterUtils.convertObjectUnescaped(objectEscaped); + + //then: + Assert.assertEquals(objectUnescaped, result); + } + + @Test + public void when_convertObjectUnescaped_then_not_same_arg() throws ScadaMarshallException { + + //when: + Object result = XssBeanConverterUtils.convertObjectUnescaped(objectEscaped); + + //then: + Assert.assertNotSame(objectEscaped, result); + } + + @Test + public void when_convertObjectEscaped_then_not_same_arg() throws ScadaMarshallException { + + //when: + Object result = XssBeanConverterUtils.convertObjectEscaped(objectUnescaped); + + //then: + Assert.assertNotSame(objectUnescaped, result); + } + +} \ No newline at end of file diff --git a/test/org/scada_lts/web/security/dwr/XssBeanConverterUtilsExceptionTest.java b/test/org/scada_lts/web/security/dwr/XssBeanConverterUtilsExceptionTest.java new file mode 100644 index 0000000000..d99e45f6fa --- /dev/null +++ b/test/org/scada_lts/web/security/dwr/XssBeanConverterUtilsExceptionTest.java @@ -0,0 +1,44 @@ +package org.scada_lts.web.security.dwr; + +import org.junit.Test; +import org.junit.runner.RunWith; +import org.junit.runners.Parameterized; + +@RunWith(Parameterized.class) +public class XssBeanConverterUtilsExceptionTest { + + @Parameterized.Parameters(name = "{index}: value: {0}, type: {1}") + public static Object[][] data() { + return new Object[][] { + {"", String.class}, + {'o', Character.class}, + {1.0, Double.class}, + {1, Integer.class}, + {Short.valueOf("1"), Short.class}, + {1L, Long.class}, + {true, Boolean.class}, + {false, Boolean.class}, + }; + } + + private final Object value; + + public XssBeanConverterUtilsExceptionTest(Object value, Class type) { + this.value = value; + } + + @Test(expected = ScadaMarshallException.class) + public void when_convertObjectEscaped_for_object_with_type_no_source_then_IllegalArgumentException() throws ScadaMarshallException { + + //when: + XssBeanConverterUtils.convertObjectEscaped(value); + } + + @Test(expected = ScadaMarshallException.class) + public void when_convertObjectUnescaped_for_object_with_type_no_source_then_IllegalArgumentException() throws ScadaMarshallException { + + //when: + XssBeanConverterUtils.convertObjectUnescaped(value); + } + +} \ No newline at end of file diff --git a/test/org/scada_lts/web/security/dwr/XssBeanConverterUtilsTest.java b/test/org/scada_lts/web/security/dwr/XssBeanConverterUtilsTest.java new file mode 100644 index 0000000000..937d5f9cc4 --- /dev/null +++ b/test/org/scada_lts/web/security/dwr/XssBeanConverterUtilsTest.java @@ -0,0 +1,136 @@ +package org.scada_lts.web.security.dwr; + +import br.org.scadabr.vo.permission.WatchListAccess; +import br.org.scadabr.vo.usersProfiles.UsersProfileVO; +import com.serotonin.db.IntValuePair; +import com.serotonin.mango.rt.dataSource.PointLocatorRT; +import com.serotonin.mango.view.View; +import com.serotonin.mango.vo.DataPointVO; +import com.serotonin.mango.vo.dataSource.DataPointSaveHandler; +import com.serotonin.mango.vo.dataSource.DataSourceVO; +import com.serotonin.mango.vo.dataSource.PointLocatorVO; +import com.serotonin.mango.vo.dataSource.virtual.VirtualDataSourceVO; +import com.serotonin.mango.vo.event.CompoundEventDetectorVO; +import com.serotonin.mango.vo.event.EventHandlerVO; +import com.serotonin.mango.vo.event.EventTypeVO; +import com.serotonin.mango.vo.mailingList.AddressEntry; +import com.serotonin.mango.vo.mailingList.MailingList; +import com.serotonin.mango.vo.mailingList.UserEntry; +import com.serotonin.mango.vo.report.ReportInstance; +import com.serotonin.mango.vo.report.ReportVO; +import com.serotonin.mango.web.dwr.beans.DataPointBean; +import com.serotonin.mango.web.dwr.beans.EventSourceBean; +import com.serotonin.mango.web.dwr.beans.RecipientListEntryBean; +import com.serotonin.web.dwr.DwrResponseI18n; +import com.serotonin.web.i18n.LocalizableMessage; +import net.sf.mbus4j.SerialPortConnection; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.junit.runners.Parameterized; +import org.scada_lts.dao.model.UserIdentifier; + +import java.util.List; + +@RunWith(Parameterized.class) +public class XssBeanConverterUtilsTest { + + @Parameterized.Parameters(name = "{index}: value: {0}, type: {1}") + public static Object[][] data() { + DataPointVO dataPoint = new DataPointVO(-1, -1, -1); + dataPoint.setPointLocator(new PointLocatorVO() { + @Override + public int getDataTypeId() { + return 0; + } + + @Override + public LocalizableMessage getDataTypeMessage() { + return null; + } + + @Override + public LocalizableMessage getConfigurationDescription() { + return null; + } + + @Override + public boolean isSettable() { + return false; + } + + @Override + public boolean isRelinquishable() { + return false; + } + + @Override + public PointLocatorRT createRuntime() { + return null; + } + + @Override + public void validate(DwrResponseI18n response) { + + } + + @Override + public DataPointSaveHandler getDataPointSaveHandler() { + return null; + } + + @Override + public void addProperties(List list) { + + } + + @Override + public void addPropertyChanges(List list, Object o) { + + } + }); + return new Object[][] { + {new VirtualDataSourceVO(), DataSourceVO.class}, + {new WatchListAccess(), WatchListAccess.class}, + {new SerialPortConnection(), SerialPortConnection.class}, + {new UserIdentifier(), UserIdentifier.class}, + {new Exception(), Exception.class}, + {new UsersProfileVO(), UsersProfileVO.class}, + {new View(), View.class}, + {dataPoint, DataPointVO.class}, + {new DataPointBean(dataPoint), DataPointBean.class}, + {new CompoundEventDetectorVO(), CompoundEventDetectorVO.class}, + {new EventHandlerVO(), EventHandlerVO.class}, + {new EventTypeVO(-1, -1, -1), EventTypeVO.class}, + {new IntValuePair(), IntValuePair.class}, + {new EventSourceBean(), EventSourceBean.class}, + {new AddressEntry(), AddressEntry.class}, + {new MailingList(), MailingList.class}, + {new UserEntry(), UserEntry.class}, + {new ReportInstance(), ReportInstance.class}, + {new ReportVO(), ReportVO.class}, + {new RecipientListEntryBean(), RecipientListEntryBean.class}, + + }; + } + + private final Object value; + + public XssBeanConverterUtilsTest(Object value, Class type) { + this.value = value; + } + + @Test + public void when_convertObjectEscaped_for_object_with_type_no_source_then_IllegalArgumentException() throws ScadaMarshallException { + + //when: + XssBeanConverterUtils.convertObjectEscaped(value); + } + + @Test + public void when_convertObjectUnescaped_for_object_with_type_no_source_then_IllegalArgumentException() throws ScadaMarshallException { + + //when: + XssBeanConverterUtils.convertObjectUnescaped(value); + } + +} \ No newline at end of file diff --git a/test/org/scada_lts/web/security/dwr/XssBeanConverterUtilsTestsSuite.java b/test/org/scada_lts/web/security/dwr/XssBeanConverterUtilsTestsSuite.java new file mode 100644 index 0000000000..262cde9806 --- /dev/null +++ b/test/org/scada_lts/web/security/dwr/XssBeanConverterUtilsTestsSuite.java @@ -0,0 +1,13 @@ +package org.scada_lts.web.security.dwr; + +import org.junit.runner.RunWith; +import org.junit.runners.Suite; + +@RunWith(Suite.class) +@Suite.SuiteClasses({ + XssBeanConverterUtilsTest.class, + XssBeanConverterUtilsExceptionTest.class, + XssBeanConverterUtilsEscapedTest.class +}) +public class XssBeanConverterUtilsTestsSuite { +}