Skip to content

Commit 02f0fc4

Browse files
srl295srl295
authored
Merge pull request from GHSA-h4jg-287w-hc7g
- also update JSP README.md for running - use the OWASP sanitizer library For: XSS bug in util.unicode.org JSP utils #498
1 parent 248ea94 commit 02f0fc4

File tree

9 files changed

+37
-17
lines changed

9 files changed

+37
-17
lines changed

‎UnicodeJsps/pom.xml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,19 @@
8080
<artifactId>unicodetools-testutils</artifactId>
8181
<scope>test</scope>
8282
</dependency>
83-
</dependencies>
83+
84+
<dependency>
85+
<groupId>org.owasp.encoder</groupId>
86+
<artifactId>encoder</artifactId>
87+
<version>1.2.3</version>
88+
</dependency>
89+
90+
<dependency>
91+
<groupId>org.owasp.encoder</groupId>
92+
<artifactId>encoder-jsp</artifactId>
93+
<version>1.2.3</version>
94+
</dependency>
95+
</dependencies>
8496
<build>
8597
<finalName>${project.artifactId}</finalName>
8698
<plugins>

‎UnicodeJsps/src/main/webapp/bidic.jsp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
<%@ page import="org.owasp.encoder.Encode" %>
12
<html>
23

34
<head>
@@ -258,7 +259,7 @@ function setUbaInput(str) {
258259
</tr>
259260
<tr>
260261
<td>
261-
<textarea id="idInputCharSeq" name="s" rows="2" cols="100" maxlength="200" oninput="setUbaInputFromEdit(event)"><%= valInputCharSeq %></textarea>
262+
<textarea id="idInputCharSeq" name="s" rows="2" cols="100" maxlength="200" oninput="setUbaInputFromEdit(event)"><%= Encode.forHtmlContent(valInputCharSeq) %></textarea>
262263
</td>
263264
</tr>
264265
<tr style="display:none">

‎UnicodeJsps/src/main/webapp/bnf.jsp‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
<%@ page import="org.owasp.encoder.Encode" %>
12
<html>
23
<head>
34
<%@ include file="header.jsp" %>
@@ -50,23 +51,23 @@
5051
<th style="width: 50%">Input</th>
5152
</tr>
5253
<tr>
53-
<td><textarea name="a" rows="8" cols="10" style="width: 100%"><%=bnf%></textarea></td>
54+
<td><textarea name="a" rows="8" cols="10" style="width: 100%"><%=Encode.forHtmlContent(bnf)%></textarea></td>
5455
</tr>
5556
<tr>
5657
<th style="width: 50%">TestText</th>
5758
</tr>
5859
<tr>
59-
<td><textarea name="b" rows="8" cols="10" style="width: 100%"><%=test%></textarea></td>
60+
<td><textarea name="b" rows="8" cols="10" style="width: 100%"><%=Encode.forHtmlContent(test)%></textarea></td>
6061
</tr>
6162
</table>
6263
<input id='main' type="submit" value="Show Modified BNF Pattern" onClick="window.location.href='bnf.jsp?a='+document.getElementById('main').value"/>
6364
</form>
6465
<hr>
6566
<h2>Modified BNF Pattern</h2>
66-
<p><%=fixedbnf%></p>
67+
<p><%=Encode.forHtmlContent(fixedbnf)%></p>
6768
<hr>
6869
<h2>Underlined Find Values</h2>
69-
<p><%=testPattern%></p>
70+
<p><%=Encode.forHtmlContent(testPattern)%></p>
7071
<hr>
7172
<h2>Random Generation</h2>
7273
<%=random%>

‎UnicodeJsps/src/main/webapp/breaks.jsp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
<%@ page import="org.owasp.encoder.Encode" %>
12
<html>
23

34
<head>
@@ -38,7 +39,7 @@ span.break { border-right: 1px solid red;}
3839
<input type="submit" value="Test" /></td>
3940
</tr>
4041
<tr>
41-
<td><textarea name="a" rows="30" cols="30" style="width:100%; height:100%"><%=text%></textarea></td>
42+
<td><textarea name="a" rows="30" cols="30" style="width:100%; height:100%"><%=Encode.forHtmlContent(text)%></textarea></td>
4243
<td>
4344
<%=UnicodeJsp.showBreaks(text, choice)%>&nbsp;</td>
4445
</tr>

‎UnicodeJsps/src/main/webapp/idna.jsp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
<%@ page import="org.owasp.encoder.Encode" %>
12
<html>
23
<head>
34
<%@ include file="header.jsp" %>
@@ -29,7 +30,7 @@
2930
<th class='r'>For special characters, you can use <a target="picker" href="http://macchiato.com/picker/MyApplication.html">Picker</a></th>
3031
</tr>
3132
<tr>
32-
<td colSpan='2'><textarea name="a" rows="12" cols="10" style="width: 100%"><%=IDNA2008%></textarea></td>
33+
<td colSpan='2'><textarea name="a" rows="12" cols="10" style="width: 100%"><%=Encode.forHtmlContent(IDNA2008)%></textarea></td>
3334
</tr>
3435
</table>
3536
<input id='main' type="submit" value="Show IDNA Status" onClick="window.location.href='idna.jsp?a='+document.getElementById('main').value"/>

‎UnicodeJsps/src/main/webapp/languageid.jsp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
<%@ page import="org.owasp.encoder.Encode" %>
12
<html>
23
<head>
34
<%@ include file="header.jsp" %>
@@ -45,7 +46,7 @@
4546
<th style="width: 50%">Input</th>
4647
</tr>
4748
<tr>
48-
<td><input type="text" name="a" rows="8" cols="10" style="width: 100%" value="<%=languageCode%>"/></td>
49+
<td><input type="text" name="a" rows="8" cols="10" style="width: 100%" value="<%=Encode.forHtmlAttribute(languageCode)%>"/></td>
4950
</tr>
5051
</table>
5152

‎UnicodeJsps/src/main/webapp/list-unicodeset.jsp‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<html>
22
<head>
3+
<%@ page import="org.owasp.encoder.Encode" %>
34
<%@ include file="header.jsp" %>
45
<title>Unicode Utilities: UnicodeSet</title>
56
</head>
@@ -36,7 +37,7 @@
3637
<th style="width: 50%">Input</th>
3738
</tr>
3839
<tr>
39-
<td><textarea name="a" rows="8" cols="10" style="width: 100%"><%=setA%></textarea></td>
40+
<td><textarea name="a" rows="8" cols="10" style="width: 100%"><%=Encode.forHtmlContent(setA)%></textarea></td>
4041
</tr>
4142
<tr>
4243
<td>
@@ -46,9 +47,9 @@
4647
<input type="checkbox" <%=ucdFormat ? "checked" : ""%> name="ucd"><label for="ucd">UCD format</label>&nbsp;&nbsp;
4748
<input type="checkbox" <%=escape ? "checked" : ""%> name="esc"><label for="esc">Escape</label>&nbsp;&nbsp;
4849
<label for="g">Group by:</label>
49-
<input type="text" <%=escape ? "checked" : ""%> name="g" size="25" value="<%=group%>">
50+
<input type="text" <%=escape ? "checked" : ""%> name="g" size="25" value="<%=Encode.forHtmlAttribute(group)%>">
5051
<label for="i">Info:</label>
51-
<input type="text" <%=escape ? "checked" : ""%> name="i" size="25" value="<%=info%>">
52+
<input type="text" <%=escape ? "checked" : ""%> name="i" size="25" value="<%=Encode.forHtmlAttribute(info)%>">
5253
</td>
5354
</tr>
5455
</table>

‎UnicodeJsps/src/main/webapp/regex.jsp‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
<%@ page import="org.owasp.encoder.Encode" %>
12
<html>
23
<head>
34
<%@ include file="header.jsp" %>
@@ -41,20 +42,20 @@
4142
<th style="width: 50%">Input</th>
4243
</tr>
4344
<tr>
44-
<td><textarea name="a" rows="8" cols="10" style="width: 100%"><%=regex%></textarea></td>
45+
<td><textarea name="a" rows="8" cols="10" style="width: 100%"><%=Encode.forHtmlContent(regex)%></textarea></td>
4546
</tr>
4647
<tr>
4748
<th style="width: 50%">TestText</th>
4849
</tr>
4950
<tr>
50-
<td><textarea name="b" rows="8" cols="10" style="width: 100%"><%=test%></textarea></td>
51+
<td><textarea name="b" rows="8" cols="10" style="width: 100%"><%=Encode.forHtmlContent(test)%></textarea></td>
5152
</tr>
5253
</table>
5354
<input id='main' type="submit" value="Show Modified Regex Pattern" onClick="window.location.href='regex.jsp?a='+document.getElementById('main').value"/>
5455
</form>
5556
<hr>
5657
<h2>Modified Regex Pattern</h2>
57-
<p><%=fixedRegex%></p>
58+
<p><%=Encode.forHtmlContent(fixedRegex)%></p>
5859
<hr>
5960
<h2>Underlined Find Values</h2>
6061
<p><%=testPattern%></p>

‎UnicodeJsps/src/main/webapp/transform.jsp‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
<%@ page import="org.owasp.encoder.Encode" %>
12
<html>
23
<head>
34
<%@ include file="header.jsp" %>
@@ -24,13 +25,13 @@
2425
<th style="width: 50%">Transform Rules</th>
2526
</tr>
2627
<tr>
27-
<td><textarea name="a" rows="8" cols="10" style="width: 100%"><%=transform%></textarea></td>
28+
<td><textarea name="a" rows="8" cols="10" style="width: 100%"><%=Encode.forHtmlContent(transform)%></textarea></td>
2829
</tr>
2930
<tr>
3031
<th style="width: 50%">Sample</th>
3132
</tr>
3233
<tr>
33-
<td><textarea name="b" rows="8" cols="10" style="width: 100%"><%=sample%></textarea></td>
34+
<td><textarea name="b" rows="8" cols="10" style="width: 100%"><%=Encode.forHtmlContent(sample)%></textarea></td>
3435
</tr>
3536
</table>
3637
<input id='main' type="submit" value="Show Transform" onClick="window.location.href='transform.jsp?a='+document.getElementById('main').value"/>

0 commit comments

Comments
 (0)