Skip to content

Commit cd378bf

Browse files
rainer-prosirainer-prosi
committed
need some escape
1 parent f25e5b2 commit cd378bf

2 files changed

Lines changed: 24 additions & 23 deletions

File tree

‎src/main/java/org/cip4/jdfutility/GetFileServlet.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
import org.apache.commons.logging.Log;
4848
import org.apache.commons.logging.LogFactory;
4949
import org.cip4.jdflib.util.StreamUtil;
50+
import org.cip4.jdflib.util.StringUtil;
5051
import org.cip4.jdflib.util.UrlUtil;
5152

5253
import jakarta.servlet.ServletConfig;
@@ -139,7 +140,7 @@ void processRequest(final HttpServletRequest request, final HttpServletResponse
139140
response.setContentType(UrlUtil.TEXT_HTML);
140141
response.setStatus(404);
141142
os.write("<HTML><H1>Error</H1><br/>Cannot find file: ".getBytes());
142-
os.write(localName.getBytes());
143+
os.write(StringUtil.replaceCharSet(localName, "<>", "_", 0).getBytes());
143144
os.write("</HTML>".getBytes());
144145
}
145146
StreamUtil.close(os);

‎src/test/java/org/cip4/jdfutility/GetFileServletTest.java‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* The CIP4 Software License, Version 1.0
33
*
44
*
5-
* Copyright (c) 2001-2022 The International Cooperation for the Integration of Processes in Prepress, Press and Postpress (CIP4). All rights reserved.
5+
* Copyright (c) 2001-2026 The International Cooperation for the Integration of Processes in Prepress, Press and Postpress (CIP4). All rights reserved.
66
*
77
* Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
88
*
@@ -44,31 +44,31 @@
4444
import java.nio.file.Path;
4545
import java.nio.file.Paths;
4646

47-
import jakarta.servlet.ServletException;
48-
4947
import org.cip4.jdflib.core.JDFCoreConstants;
5048
import org.junit.jupiter.api.Test;
5149
import org.springframework.mock.web.MockHttpServletRequest;
5250
import org.springframework.mock.web.MockHttpServletResponse;
5351
import org.springframework.mock.web.MockServletConfig;
5452

53+
import jakarta.servlet.ServletException;
54+
5555
public class GetFileServletTest
5656
{
5757

5858
@Test
5959
public void processRequest() throws ServletException, URISyntaxException, IOException
6060
{
61-
Path file = Paths.get(GetFileServlet.class.getResource("/data/resourceInfo.jmf").toURI());
61+
final Path file = Paths.get(GetFileServlet.class.getResource("/data/resourceInfo.jmf").toURI());
6262

63-
MockServletConfig config = new MockServletConfig();
63+
final MockServletConfig config = new MockServletConfig();
6464
config.addInitParameter("rootDir", file.getParent().toString());
6565

66-
GetFileServlet servlet = new GetFileServlet();
66+
final GetFileServlet servlet = new GetFileServlet();
6767
servlet.init(config);
6868

69-
MockHttpServletRequest request = new MockHttpServletRequest();
69+
final MockHttpServletRequest request = new MockHttpServletRequest();
7070
request.setPathInfo(file.getFileName().toString());
71-
MockHttpServletResponse response = new MockHttpServletResponse();
71+
final MockHttpServletResponse response = new MockHttpServletResponse();
7272

7373
servlet.processRequest(request, response);
7474

@@ -80,17 +80,17 @@ public void processRequest() throws ServletException, URISyntaxException, IOExce
8080
@Test
8181
public void processRequestFileNotExists() throws ServletException, URISyntaxException, IOException
8282
{
83-
Path root = Paths.get(GetFileServlet.class.getResource("/data").toURI());
83+
final Path root = Paths.get(GetFileServlet.class.getResource("/data").toURI());
8484

85-
MockServletConfig config = new MockServletConfig();
85+
final MockServletConfig config = new MockServletConfig();
8686
config.addInitParameter("rootDir", root.toString());
8787

88-
GetFileServlet servlet = new GetFileServlet();
88+
final GetFileServlet servlet = new GetFileServlet();
8989
servlet.init(config);
9090

91-
MockHttpServletRequest request = new MockHttpServletRequest();
91+
final MockHttpServletRequest request = new MockHttpServletRequest();
9292
request.setPathInfo("file_that_does_not_exist.txt");
93-
MockHttpServletResponse response = new MockHttpServletResponse();
93+
final MockHttpServletResponse response = new MockHttpServletResponse();
9494

9595
servlet.processRequest(request, response);
9696

@@ -102,15 +102,15 @@ public void processRequestFileNotExists() throws ServletException, URISyntaxExce
102102
@Test
103103
public void processRequestPathTraversal() throws ServletException, IOException
104104
{
105-
MockServletConfig config = new MockServletConfig();
105+
final MockServletConfig config = new MockServletConfig();
106106
config.addInitParameter("rootDir", "./");
107107

108-
GetFileServlet servlet = new GetFileServlet();
108+
final GetFileServlet servlet = new GetFileServlet();
109109
servlet.init(config);
110110

111-
MockHttpServletRequest request = new MockHttpServletRequest();
111+
final MockHttpServletRequest request = new MockHttpServletRequest();
112112
request.setPathInfo("../attack");
113-
MockHttpServletResponse response = new MockHttpServletResponse();
113+
final MockHttpServletResponse response = new MockHttpServletResponse();
114114

115115
servlet.processRequest(request, response);
116116

@@ -122,20 +122,20 @@ public void processRequestPathTraversal() throws ServletException, IOException
122122
@Test
123123
public void processRequestInjection() throws ServletException, IOException
124124
{
125-
MockServletConfig config = new MockServletConfig();
125+
final MockServletConfig config = new MockServletConfig();
126126
config.addInitParameter("rootDir", "./");
127127

128-
GetFileServlet servlet = new GetFileServlet();
128+
final GetFileServlet servlet = new GetFileServlet();
129129
servlet.init(config);
130130

131-
MockHttpServletRequest request = new MockHttpServletRequest();
131+
final MockHttpServletRequest request = new MockHttpServletRequest();
132132
request.setPathInfo("<script>attack</script>");
133-
MockHttpServletResponse response = new MockHttpServletResponse();
133+
final MockHttpServletResponse response = new MockHttpServletResponse();
134134

135135
servlet.processRequest(request, response);
136136

137137
assertEquals(404, response.getStatus());
138-
assertEquals("<HTML><H1>Error</H1><br/>Cannot find file: &lt;script&gt;attack&lt;/script&gt;</HTML>", response.getContentAsString());
138+
assertEquals("<HTML><H1>Error</H1><br/>Cannot find file: _script_attack_/script_</HTML>", response.getContentAsString());
139139
assertEquals("text/html", response.getContentType());
140140
}
141141
}

0 commit comments

Comments
 (0)