Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dev #291

Merged
merged 4 commits into from
Mar 15, 2024
Merged

Dev #291

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
33cb0d2
Bump com.google.guava:guava from 33.0.0-jre to 33.1.0-jre
dependabot[bot] Mar 14, 2024
a44ea81
Refactor session check logic in ThreadsSocialNetwork.kt to include in…
Ziedelth Mar 14, 2024
844bf58
Implement XSS sanitization for user inputs and display fields
Ziedelth Mar 15, 2024
74848db
Bump org.postgresql:postgresql from 42.7.2 to 42.7.3
dependabot[bot] Mar 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,12 @@ val ehcacheVersion = "3.10.8"
val glassfishJaxbVersion = "4.0.5"
val hibernateSearchVersion = "7.1.0.Final"
val tikaVersion = "3.0.0-BETA"
val postgresqlVersion = "42.7.2"
val postgresqlVersion = "42.7.3"
val reflectionsVersion = "0.10.2"
val guiceVersion = "7.0.0"
val liquibaseCoreVersion = "4.26.0"
val quartzVersion = "2.5.0-rc1"
val guavaVersion = "33.0.0-jre"
val guavaVersion = "33.1.0-jre"
val jacksonVersion = "2.17.0"
val playwrightVersion = "1.42.0"
val jsoupVersion = "1.17.2"
Expand Down
3 changes: 2 additions & 1 deletion src/main/kotlin/fr/shikkanime/converters/config/ConfigToConfigDtoConverter.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,14 @@ package fr.shikkanime.converters.config
import fr.shikkanime.converters.AbstractConverter
import fr.shikkanime.dtos.ConfigDto
import fr.shikkanime.entities.Config
import fr.shikkanime.utils.StringUtils

class ConfigToConfigDtoConverter : AbstractConverter<Config, ConfigDto>() {
override fun convert(from: Config): ConfigDto {
return ConfigDto(
uuid = from.uuid,
propertyKey = from.propertyKey,
propertyValue = from.propertyValue,
propertyValue = from.propertyValue?.let { StringUtils.sanitizeXSS(it) },
)
}
}
3 changes: 3 additions & 0 deletions src/main/kotlin/fr/shikkanime/modules/Routing.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import fr.shikkanime.services.caches.ConfigCacheService
import fr.shikkanime.services.caches.SimulcastCacheService
import fr.shikkanime.utils.Constant
import fr.shikkanime.utils.LoggerFactory
import fr.shikkanime.utils.StringUtils
import fr.shikkanime.utils.routes.*
import fr.shikkanime.utils.routes.method.Delete
import fr.shikkanime.utils.routes.method.Get
Expand Down Expand Up @@ -291,6 +292,7 @@ private suspend fun handleTemplateResponse(

val map = response.data as Map<String, Any> // NOSONAR
val modelMap = (map["model"] as Map<String, Any?>).toMutableMap() // NOSONAR
modelMap["su"] = StringUtils

val linkObjects = LinkObject.list()

Expand All @@ -309,6 +311,7 @@ private suspend fun handleTemplateResponse(
link
}


modelMap["footerLinks"] = list.filter { it.footer }

modelMap["title"] = (map["title"] as? String)?.let { title ->
Expand Down
5 changes: 3 additions & 2 deletions src/main/kotlin/fr/shikkanime/socialnetworks/ThreadsSocialNetwork.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,9 @@ class ThreadsSocialNetwork : AbstractSocialNetwork() {
}

private fun checkSession() {
if (initializedAt != null && initializedAt!!.plusMinutes(configCacheService.getValueAsInt(ConfigPropertyKey.THREADS_SESSION_TIMEOUT, 10).toLong())
.isAfter(ZonedDateTime.now())
if (isInitialized &&
initializedAt != null &&
initializedAt!!.plusMinutes(configCacheService.getValueAsInt(ConfigPropertyKey.THREADS_SESSION_TIMEOUT, 10).toLong()).isAfter(ZonedDateTime.now())
) {
return
}
Expand Down
8 changes: 8 additions & 0 deletions src/main/kotlin/fr/shikkanime/utils/StringUtils.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,4 +71,12 @@ object StringUtils {
val slug: String = NONLATIN.matcher(normalized).replaceAll("").replace("-+".toRegex(), "-")
return slug.lowercase()
}

fun sanitizeXSS(input: String): String = input.replace("<", "&lt;")
.replace(">", "&gt;")
.replace("\"", "&quot;")

fun unSanitizeXSS(input: String): String = input.replace("&lt;", "<")
.replace("&gt;", ">")
.replace("&quot;", "\"")
}
1 change: 1 addition & 0 deletions src/main/resources/templates/_freemarker_implicit.ftl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
[#-- @ftlvariable name="footerLinks" type="kotlin.collections.AbstractList<fr.shikkanime.entities.LinkObject>" --]
[#-- @ftlvariable name="seoLinks" type="kotlin.collections.AbstractList<fr.shikkanime.entities.enums.Link>" --]
[#-- @ftlvariable name="query" type="java.lang.String" --]
[#-- @ftlvariable name="su" type="fr.shikkanime.utils.StringUtils" --]

[#-- @ftlvariable name="analyticsDomain" type="java.lang.String" --]
[#-- @ftlvariable name="analyticsApi" type="java.lang.String" --]
Expand Down
4 changes: 2 additions & 2 deletions src/main/resources/templates/admin/animes/edit.ftl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,12 +46,12 @@
</div>
<div class="col-md-6">
<label for="name" class="form-label">Name</label>
<input type="text" class="form-control" id="name" name="name" value="${anime.name}">
<input type="text" class="form-control" id="name" name="name" value="${su.sanitizeXSS(anime.name)}">
</div>
<div class="col-md-6">
<label for="shortName" class="form-label">Short name</label>
<input type="text" class="form-control" id="shortName" name="shortName"
value="${anime.shortName}" disabled>
value="${su.sanitizeXSS(anime.shortName)}" disabled>
</div>
<div class="col-md-6">
<label for="releaseDateTime" class="form-label">Release date time</label>
Expand Down
2 changes: 1 addition & 1 deletion src/main/resources/templates/admin/animes/list.ftl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@
table.innerHTML = '';

animes.forEach(anime => {
table.innerHTML += buildTableElement(anime.uuid, anime.name, anime.description, anime.status);
table.innerHTML += buildTableElement(anime.uuid, anime.shortName, anime.description, anime.status);
});
}

Expand Down
2 changes: 1 addition & 1 deletion src/main/resources/templates/admin/config/edit.ftl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
</div>
<div class="col-md-6">
<label for="value" class="form-label">Value</label>
<input type="text" class="form-control" id="value" name="value" value="${config.propertyValue}">
<input type="text" class="form-control" id="value" name="value" value="${su.sanitizeXSS(config.propertyValue)}">
</div>
</div>
</div>
Expand Down
2 changes: 1 addition & 1 deletion src/main/resources/templates/admin/episodes/edit.ftl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
</div>
<div class="col-md-6">
<label for="anime" class="form-label">Anime</label>
<input type="text" class="form-control" id="anime" name="anime" value="${episode.anime.name}"
<input type="text" class="form-control" id="anime" name="anime" value="${su.sanitizeXSS(episode.anime.shortName)}"
disabled>
</div>
<div class="col-md-6">
Expand Down
2 changes: 1 addition & 1 deletion src/main/resources/templates/site/_layout.ftl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@

<#if (analyticsDomain?? && analyticsDomain?length != 0) && (analyticsApi?? && analyticsApi?length != 0) && (analyticsScript?? && analyticsScript?length != 0)>
<script data-domain="${analyticsDomain}" data-api="${analyticsApi}">
${analyticsScript}
${su.unSanitizeXSS(analyticsScript)}
</script>
</#if>
</head>
Expand Down
2 changes: 1 addition & 1 deletion src/main/resources/templates/site/anime.ftl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<div class="row g-3 mt-3">
<div class="col-md-4 col-12 mt-0 text-center">
<img src="https://api.shikkanime.fr/v1/attachments?uuid=${anime.uuid}&type=image"
alt="${anime.shortName?replace("\"", "'")} anime image" class="img-fluid w-50" width="480"
alt="${su.sanitizeXSS(anime.shortName)} anime image" class="img-fluid w-50" width="480"
height="720">
</div>

Expand Down
2 changes: 1 addition & 1 deletion src/main/resources/templates/site/components/anime.ftl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
@mouseleave="hover = false">
<div class="position-relative">
<img src="https://api.shikkanime.fr/v1/attachments?uuid=${anime.uuid}&type=image"
alt="${anime.shortName?replace("\"", "'")} anime image" class="img-fluid" width="480"
alt="${su.sanitizeXSS(anime.shortName)} anime image" class="img-fluid" width="480"
height="720">

<span class="h6 mt-2 text-truncate-2">${anime.shortName}</span>
Expand Down
2 changes: 1 addition & 1 deletion src/main/resources/templates/site/components/episode.ftl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
<div class="position-relative">
<div class="position-relative">
<img src="https://api.shikkanime.fr/v1/attachments?uuid=${episode.uuid}&type=image"
alt="${episode.anime.shortName?replace("\"", "'")} episode preview image"
alt="${su.sanitizeXSS(episode.anime.shortName)} episode preview image"
class="img-fluid<#if episode.uncensored> blur</#if>" width="640" height="360">

<img src="https://www.shikkanime.fr/assets/img/platforms/${episode.platform.image}"
Expand Down
Loading