Convert ampersands to & when sanitizing forms (#222)

WOVNio · Oct 7, 2022 · debfb69 · debfb69
1 parent 98d1991
commit debfb69
Show file tree

Hide file tree

Showing 6 changed files with 9 additions and 8 deletions.
diff --git a/Makefile b/Makefile
@@ -12,4 +12,4 @@ build:
 
 .PHONY: start_local
 start_local:
-	cd docker/java6; make USE_LOCAL_BUILD=yes WOVN_VERSION=1.0.9-jdk6 && docker-compose up; cd -;
+	cd docker/java6; make USE_LOCAL_BUILD=yes WOVN_VERSION=1.0.10-jdk6 && docker-compose up; cd -;
diff --git a/docker/java6/Makefile b/docker/java6/Makefile
@@ -3,7 +3,7 @@ SHELL        := /bin/bash
 .SHELLFLAGS  := -eu -o pipefail -c
 
 USE_LOCAL_BUILD ?= no
-WOVN_VERSION    ?= 1.0.9-jdk6
+WOVN_VERSION    ?= 1.0.10-jdk6
 PROJECT_NAME     = hello
 PROJECT_LIB_PATH = $(PROJECT_NAME)/src/main/webapp/WEB-INF/lib
 

diff --git a/docker/java6/hello/pom.xml b/docker/java6/hello/pom.xml
@@ -41,7 +41,7 @@
     <dependency>
       <groupId>com.github.wovnio</groupId>
       <artifactId>wovnjava</artifactId>
-      <version>1.0.9-jdk6</version>
+      <version>1.0.10-jdk6</version>
     </dependency>
 
   </dependencies>

diff --git a/pom.xml b/pom.xml
@@ -7,7 +7,7 @@
     <groupId>com.github.wovnio</groupId>
     <artifactId>wovnjava</artifactId>
     <name>wovnjava</name>
-    <version>1.0.9-jdk6</version>
+    <version>1.0.10-jdk6</version>
     <url>https://github.com/WOVNio/wovnjava</url>
 
     <licenses>

diff --git a/src/main/java/com/github/wovnio/wovnjava/HtmlConverter.java b/src/main/java/com/github/wovnio/wovnjava/HtmlConverter.java
@@ -107,6 +107,7 @@ private void removeForm() {
             if (type != null && type.toLowerCase().equals("hidden")) {
                 if (element.hasAttr("value")) {
                     String original = element.attr("value")
+                    .replaceAll("&", "&amp;")
                     .replaceAll("\"", "&quot;")
                     .replaceAll("'", "&#39;")
                     .replaceAll(">", "&gt;")

diff --git a/src/test/java/com/github/wovnio/wovnjava/HtmlConverterTest.java b/src/test/java/com/github/wovnio/wovnjava/HtmlConverterTest.java
@@ -98,8 +98,8 @@ public void testRemoveForm() throws ConfigurationError {
     }
 
     public void testRemoveForm__Sanitize__DoubleQuotes() throws ConfigurationError {
-        String original = "<html lang=\"en\"><head></head><body><form><input type=\"hidden\" name=\"csrf\" value=\"&quot;&gt;&lt;script &gt;alert(String.fromCharCode(88,83,83))&lt;/script&gt;\"></form></body></html>";
-        String sanitized = "<html lang=\"en\"><head></head><body><form><input type=\"hidden\" name=\"csrf\" value=\"&quot;&gt;&lt;script &gt;alert(String.fromCharCode(88,83,83))&lt;/script&gt;\"></form></body></html>";
+        String original = "<html lang=\"en\"><head></head><body><form><input type=\"hidden\" name=\"csrf\" value=\"&test=true&quot;&gt;&lt;script &gt;alert(String.fromCharCode(88,83,83))&lt;/script&gt;\"></form></body></html>";
+        String sanitized = "<html lang=\"en\"><head></head><body><form><input type=\"hidden\" name=\"csrf\" value=\"&amp;test=true&quot;&gt;&lt;script &gt;alert(String.fromCharCode(88,83,83))&lt;/script&gt;\"></form></body></html>";
         Settings settings = TestUtil.makeSettings(new HashMap<String, String>() {{ put("supportedLangs", "en,fr,ja"); }});
         HtmlConverter converter = this.createHtmlConverter(settings, location, original);
         String html = converter.strip();
@@ -108,8 +108,8 @@ public void testRemoveForm__Sanitize__DoubleQuotes() throws ConfigurationError {
     }
 
     public void testRemoveForm__Sanitize__SingleQuotes() throws ConfigurationError {
-        String original = "<html lang=\"en\"><head></head><body><form><input type=\"hidden\" name=\"csrf\" value=\'&#39;&gt;&lt;script &gt;alert(String.fromCharCode(88,83,83))&lt;/script&gt;\'></form></body></html>";
-        String sanitized = "<html lang=\"en\"><head></head><body><form><input type=\"hidden\" name=\"csrf\" value=\"&#39;&gt;&lt;script &gt;alert(String.fromCharCode(88,83,83))&lt;/script&gt;\"></form></body></html>";
+        String original = "<html lang=\"en\"><head></head><body><form><input type=\"hidden\" name=\"csrf\" value=\'&test=true&#39;&gt;&lt;script &gt;alert(String.fromCharCode(88,83,83))&lt;/script&gt;\'></form></body></html>";
+        String sanitized = "<html lang=\"en\"><head></head><body><form><input type=\"hidden\" name=\"csrf\" value=\"&amp;test=true&#39;&gt;&lt;script &gt;alert(String.fromCharCode(88,83,83))&lt;/script&gt;\"></form></body></html>";
         Settings settings = TestUtil.makeSettings(new HashMap<String, String>() {{ put("supportedLangs", "en,fr,ja"); }});
         HtmlConverter converter = this.createHtmlConverter(settings, location, original);
         String html = converter.strip();