[SUP-1666] [java6] add jsoup.clean to removeForm() htmlreplacemarker …

…function (#211) * add jsoup.clean to removeForm() htmlreplacemarker function * update version number * add sanitize test * simplify test * update version number everywhere
WOVNio · Sep 1, 2022 · 1e1b7c9 · 1e1b7c9
1 parent 2b503d7
commit 1e1b7c9
Show file tree

Hide file tree

Showing 6 changed files with 16 additions and 5 deletions.
diff --git a/Makefile b/Makefile
@@ -12,4 +12,4 @@ build:
 
 .PHONY: start_local
 start_local:
-	cd docker/java6; make USE_LOCAL_BUILD=yes WOVN_VERSION=1.0.7-jdk6 && docker-compose up; cd -;
+	cd docker/java6; make USE_LOCAL_BUILD=yes WOVN_VERSION=1.0.8-jdk6 && docker-compose up; cd -;
diff --git a/docker/java6/Makefile b/docker/java6/Makefile
@@ -3,7 +3,7 @@ SHELL        := /bin/bash
 .SHELLFLAGS  := -eu -o pipefail -c
 
 USE_LOCAL_BUILD ?= no
-WOVN_VERSION    ?= 1.0.7-jdk6
+WOVN_VERSION    ?= 1.0.8-jdk6
 PROJECT_NAME     = hello
 PROJECT_LIB_PATH = $(PROJECT_NAME)/src/main/webapp/WEB-INF/lib
 

diff --git a/docker/java6/hello/pom.xml b/docker/java6/hello/pom.xml
@@ -41,7 +41,7 @@
     <dependency>
       <groupId>com.github.wovnio</groupId>
       <artifactId>wovnjava</artifactId>
-      <version>1.0.7-jdk6</version>
+      <version>1.0.8-jdk6</version>
     </dependency>
 
   </dependencies>

diff --git a/pom.xml b/pom.xml
@@ -7,7 +7,7 @@
     <groupId>com.github.wovnio</groupId>
     <artifactId>wovnjava</artifactId>
     <name>wovnjava</name>
-    <version>1.0.7-jdk6</version>
+    <version>1.0.8-jdk6</version>
     <url>https://github.com/WOVNio/wovnjava</url>
 
     <licenses>

diff --git a/src/main/java/com/github/wovnio/wovnjava/HtmlConverter.java b/src/main/java/com/github/wovnio/wovnjava/HtmlConverter.java
@@ -11,6 +11,7 @@
 import org.jsoup.nodes.Element;
 import org.jsoup.parser.Tag;
 import org.jsoup.select.Elements;
+import org.jsoup.safety.Whitelist;
 
 class HtmlConverter {
     private final Document doc;
@@ -106,7 +107,7 @@ private void removeForm() {
             String type = element.attr("type");
             if (type != null && type.toLowerCase().equals("hidden")) {
                 if (element.hasAttr("value")) {
-                    String original = element.attr("value");
+                    String original = Jsoup.clean(element.attr("value"), Whitelist.none());
                     String key = htmlReplaceMarker.generateKey();
                     element.removeAttr("value").removeAttr("VALUE");
                     element.attr("value", key);

diff --git a/src/test/java/com/github/wovnio/wovnjava/HtmlConverterTest.java b/src/test/java/com/github/wovnio/wovnjava/HtmlConverterTest.java
@@ -97,6 +97,16 @@ public void testRemoveForm() throws ConfigurationError {
         assertEquals(original.replace("INPUT", "input").replace("VALUE", "value"), stripExtraSpaces(converter.restore(html)));
     }
 
+    public void testRemoveForm__Sanitize() throws ConfigurationError {
+        String original = "<html lang=\"en\"><head></head><body><form><input type=\"hidden\" name=\"csrf\" value=\"&quot;&gt;&lt;script &gt;alert(String.fromCharCode(88,83,83))&lt;/script&gt;\"></form></body></html>";
+        String sanitized = "<html lang=\"en\"><head></head><body><form><input type=\"hidden\" name=\"csrf\" value=\"\"&gt;\"></form></body></html>";
+        Settings settings = TestUtil.makeSettings(new HashMap<String, String>() {{ put("supportedLangs", "en,fr,ja"); }});
+        HtmlConverter converter = this.createHtmlConverter(settings, location, original);
+        String html = converter.strip();
+
+        assertEquals(sanitized, stripExtraSpaces(converter.restore(html)));
+    }
+
     public void testNested() throws ConfigurationError {
         String original = "<html><head></head><body><form wovn-ignore><script></script><input type=\"hidden\" name=\"csrf\" value=\"random\"><INPUT TYPE=\"HIDDEN\" NAME=\"CSRF_TOKEN\" VALUE=\"RANDOM\"></form></body></html>";
         String removedHtml = "<html><head></head><body><form wovn-ignore><!--wovn-marker-1--></form></body></html>";