Sanitize ticket text at presentation time to avoid unintended html encoding

diff --git a/src/main/java/com/gitblit/utils/JSoupXssFilter.java b/src/main/java/com/gitblit/utils/JSoupXssFilter.java
index b07bcb9d612920c303585a608a67c4d65f60b1d0..7fa7b2a1de610f5c45d0945cb5f8ac4025492d0d 100644 (file)
--- a/src/main/java/com/gitblit/utils/JSoupXssFilter.java
+++ b/src/main/java/com/gitblit/utils/JSoupXssFilter.java
@@ -68,16 +68,18 @@ public class JSoupXssFilter implements XssFilter {
                 "sub", "sup", "table", "tbody", "td", "tfoot", "th", "thead", "tr", "tt", "u",
                 "ul", "var")
 
-        .addAttributes("a", "href", "title")
+        .addAttributes("a", "class", "href", "style", "title")
         .addAttributes("blockquote", "cite")
         .addAttributes("col", "span", "width")
         .addAttributes("colgroup", "span", "width")
+        .addAttributes("div", "class", "style")
         .addAttributes("img", "align", "alt", "height", "src", "title", "width")
         .addAttributes("ol", "start", "type")
         .addAttributes("q", "cite")
-        .addAttributes("table", "summary", "width")
-        .addAttributes("td", "abbr", "axis", "colspan", "rowspan", "width")
-        .addAttributes("th", "abbr", "axis", "colspan", "rowspan", "scope", "width")
+        .addAttributes("span", "class", "style")
+        .addAttributes("table", "class", "style", "summary", "width")
+        .addAttributes("td", "abbr", "axis", "class", "colspan", "rowspan", "style", "width")
+        .addAttributes("th", "abbr", "axis", "class", "colspan", "rowspan", "scope", "style", "width")
         .addAttributes("ul", "type")
 
         .addEnforcedAttribute("a", "rel", "nofollow")

diff --git a/src/main/java/com/gitblit/wicket/pages/EditTicketPage.java b/src/main/java/com/gitblit/wicket/pages/EditTicketPage.java
index bd2ec63c740ac99504390dda326e8f7a3231224f..1adc71364abdc988dfb482c69866c03af133a4d7 100644 (file)
--- a/src/main/java/com/gitblit/wicket/pages/EditTicketPage.java
+++ b/src/main/java/com/gitblit/wicket/pages/EditTicketPage.java
@@ -50,8 +50,6 @@ import com.gitblit.tickets.TicketNotifier;
 import com.gitblit.tickets.TicketResponsible;\r
 import com.gitblit.utils.StringUtils;\r
 import com.gitblit.wicket.GitBlitWebSession;\r
-import com.gitblit.wicket.SafeTextModel;\r
-import com.gitblit.wicket.SafeTextModel.Mode;\r
 import com.gitblit.wicket.WicketUtils;\r
 import com.gitblit.wicket.panels.MarkdownTextArea;\r
 \r
@@ -112,8 +110,8 @@ public class EditTicketPage extends RepositoryPage {
                }\r
 \r
                typeModel = Model.of(ticket.type);\r
-               titleModel = SafeTextModel.none(ticket.title);\r
-               topicModel = SafeTextModel.none(ticket.topic == null ? "" : ticket.topic);\r
+               titleModel = Model.of(ticket.title);\r
+               topicModel = Model.of(ticket.topic == null ? "" : ticket.topic);\r
                responsibleModel = Model.of();\r
                milestoneModel = Model.of();\r
                mergeToModel = Model.of(ticket.mergeTo == null ? getRepositoryModel().mergeTo : ticket.mergeTo);\r
@@ -136,7 +134,7 @@ public class EditTicketPage extends RepositoryPage {
                form.add(new TextField<String>("title", titleModel));\r
                form.add(new TextField<String>("topic", topicModel));\r
 \r
-               final SafeTextModel markdownPreviewModel = new SafeTextModel(Mode.none);\r
+               final IModel<String> markdownPreviewModel = Model.of(ticket.body == null ? "" : ticket.body);\r
                descriptionPreview = new Label("descriptionPreview", markdownPreviewModel);\r
                descriptionPreview.setEscapeModelStrings(false);\r
                descriptionPreview.setOutputMarkupId(true);\r

diff --git a/src/main/java/com/gitblit/wicket/pages/NewTicketPage.java b/src/main/java/com/gitblit/wicket/pages/NewTicketPage.java
index 21a2af1035d33ba9c30fdf8afbd95156f6cf8df3..e6d9cb1e4c6b34d402832822bc6332319bce4847 100644 (file)
--- a/src/main/java/com/gitblit/wicket/pages/NewTicketPage.java
+++ b/src/main/java/com/gitblit/wicket/pages/NewTicketPage.java
@@ -49,8 +49,6 @@ import com.gitblit.tickets.TicketNotifier;
 import com.gitblit.tickets.TicketResponsible;\r
 import com.gitblit.utils.StringUtils;\r
 import com.gitblit.wicket.GitBlitWebSession;\r
-import com.gitblit.wicket.SafeTextModel;\r
-import com.gitblit.wicket.SafeTextModel.Mode;\r
 import com.gitblit.wicket.WicketUtils;\r
 import com.gitblit.wicket.panels.MarkdownTextArea;\r
 \r
@@ -92,8 +90,8 @@ public class NewTicketPage extends RepositoryPage {
                }\r
 \r
                typeModel = Model.of(TicketModel.Type.defaultType);\r
-               titleModel = SafeTextModel.none();\r
-               topicModel = SafeTextModel.none();\r
+               titleModel = Model.of();\r
+               topicModel = Model.of();\r
                mergeToModel = Model.of(Repository.shortenRefName(getRepositoryModel().mergeTo));\r
                responsibleModel = Model.of();\r
                milestoneModel = Model.of();\r
@@ -108,7 +106,7 @@ public class NewTicketPage extends RepositoryPage {
                form.add(new TextField<String>("title", titleModel));\r
                form.add(new TextField<String>("topic", topicModel));\r
 \r
-               final SafeTextModel markdownPreviewModel = new SafeTextModel(Mode.none);\r
+               final IModel<String> markdownPreviewModel = Model.of();\r
                descriptionPreview = new Label("descriptionPreview", markdownPreviewModel);\r
                descriptionPreview.setEscapeModelStrings(false);\r
                descriptionPreview.setOutputMarkupId(true);\r

diff --git a/src/main/java/com/gitblit/wicket/pages/TicketPage.java b/src/main/java/com/gitblit/wicket/pages/TicketPage.java
index b1f94a5b3bd8681c5689a3f1c1f2669326d90b2c..0bad8beb03f9e651b9dab40a6905d2985188bc4c 100644 (file)
--- a/src/main/java/com/gitblit/wicket/pages/TicketPage.java
+++ b/src/main/java/com/gitblit/wicket/pages/TicketPage.java
@@ -287,7 +287,9 @@ public class TicketPage extends RepositoryPage {
                        desc = getString("gb.noDescriptionGiven");\r
                } else {\r
                        String bugtraq = bugtraqProcessor().processText(getRepository(), repositoryName, ticket.body);\r
-                       desc = MarkdownUtils.transformGFM(app().settings(), bugtraq, ticket.repository);\r
+                       String html = MarkdownUtils.transformGFM(app().settings(), bugtraq, ticket.repository);\r
+                       String safeHtml = app().xssFilter().relaxed(html);\r
+                       desc = safeHtml;\r
                }\r
                add(new Label("ticketDescription", desc).setEscapeModelStrings(false));\r
 \r
@@ -523,7 +525,8 @@ public class TicketPage extends RepositoryPage {
                } else {\r
                        // process the topic using the bugtraq config to link things\r
                        String topic = bugtraqProcessor().processText(getRepository(), repositoryName, ticket.topic);\r
-                       add(new Label("ticketTopic", topic).setEscapeModelStrings(false));\r
+                       String safeTopic = app().xssFilter().relaxed(topic);\r
+                       add(new Label("ticketTopic", safeTopic).setEscapeModelStrings(false));\r
                }\r
 \r
 \r
@@ -703,6 +706,7 @@ public class TicketPage extends RepositoryPage {
                                                 */\r
                                                String bugtraq = bugtraqProcessor().processText(getRepository(), repositoryName, entry.comment.text);\r
                                                String comment = MarkdownUtils.transformGFM(app().settings(), bugtraq, repositoryName);\r
+                                               String safeComment = app().xssFilter().relaxed(comment);\r
                                                Fragment frag = new Fragment("entry", "commentFragment", this);\r
                                                Label commentIcon = new Label("commentIcon");\r
                                                if (entry.comment.src == CommentSource.Email) {\r
@@ -711,7 +715,7 @@ public class TicketPage extends RepositoryPage {
                                                        WicketUtils.setCssClass(commentIcon, "iconic-comment-alt2-stroke");\r
                                                }\r
                                                frag.add(commentIcon);\r
-                                               frag.add(new Label("comment", comment).setEscapeModelStrings(false));\r
+                                               frag.add(new Label("comment", safeComment).setEscapeModelStrings(false));\r
                                                addUserAttributions(frag, entry, avatarWidth);\r
                                                addDateAttributions(frag, entry);\r
                                                item.add(frag);\r
@@ -972,7 +976,8 @@ public class TicketPage extends RepositoryPage {
                                                sb.append("</td></tr>");\r
                                        }\r
                                        sb.append("</tbody></table>");\r
-                                       item.add(new Label("fields", sb.toString()).setEscapeModelStrings(false));\r
+                                       String safeHtml = app().xssFilter().relaxed(sb.toString());\r
+                                       item.add(new Label("fields", safeHtml).setEscapeModelStrings(false));\r
                                } else {\r
                                        item.add(new Label("fields").setVisible(false));\r
                                }\r

diff --git a/src/main/java/com/gitblit/wicket/panels/CommentPanel.java b/src/main/java/com/gitblit/wicket/panels/CommentPanel.java
index 130e7336127d1c369b6982df122caf5b01fc0066..acf4dd9ae97af937039c852eddd976fec3261d9b 100644 (file)
--- a/src/main/java/com/gitblit/wicket/panels/CommentPanel.java
+++ b/src/main/java/com/gitblit/wicket/panels/CommentPanel.java
@@ -19,14 +19,13 @@ import org.apache.wicket.ajax.AjaxRequestTarget;
 import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 import org.apache.wicket.markup.html.basic.Label;
 import org.apache.wicket.markup.html.form.Form;
+import org.apache.wicket.model.IModel;
 import org.apache.wicket.model.Model;
 
 import com.gitblit.models.RepositoryModel;
 import com.gitblit.models.TicketModel;
 import com.gitblit.models.TicketModel.Change;
 import com.gitblit.models.UserModel;
-import com.gitblit.wicket.SafeTextModel;
-import com.gitblit.wicket.SafeTextModel.Mode;
 import com.gitblit.wicket.WicketUtils;
 import com.gitblit.wicket.pages.BasePage;
 
@@ -90,7 +89,7 @@ public class CommentPanel extends BasePanel {
                        }
                }.setVisible(ticket != null && ticket.number > 0));
 
-               final SafeTextModel markdownPreviewModel = new SafeTextModel(Mode.none);
+               final IModel<String> markdownPreviewModel = Model.of();
                markdownPreview = new Label("markdownPreview", markdownPreviewModel);
                markdownPreview.setEscapeModelStrings(false);
                markdownPreview.setOutputMarkupId(true);

diff --git a/src/main/java/com/gitblit/wicket/panels/MarkdownTextArea.java b/src/main/java/com/gitblit/wicket/panels/MarkdownTextArea.java
index 6e06e5bbcd9f6ec196ab958c5313712eea1c5b50..ade92c090c665660bf9a06bec9ea575775d8e478 100644 (file)
--- a/src/main/java/com/gitblit/wicket/panels/MarkdownTextArea.java
+++ b/src/main/java/com/gitblit/wicket/panels/MarkdownTextArea.java
@@ -20,12 +20,12 @@ import org.apache.wicket.ajax.AjaxRequestTarget;
 import org.apache.wicket.ajax.form.AjaxFormComponentUpdatingBehavior;
 import org.apache.wicket.markup.html.basic.Label;
 import org.apache.wicket.markup.html.form.TextArea;
+import org.apache.wicket.model.IModel;
 import org.apache.wicket.model.PropertyModel;
 import org.apache.wicket.util.time.Duration;
 
 import com.gitblit.utils.MarkdownUtils;
 import com.gitblit.wicket.GitBlitWebApp;
-import com.gitblit.wicket.SafeTextModel;
 
 public class MarkdownTextArea extends TextArea {
 
@@ -35,7 +35,7 @@ public class MarkdownTextArea extends TextArea {
 
        protected String text = "";
 
-       public MarkdownTextArea(String id, final SafeTextModel previewModel, final Label previewLabel) {
+       public MarkdownTextArea(String id, final IModel<String> previewModel, final Label previewLabel) {
                super(id);
                setModel(new PropertyModel(this, "text"));
                add(new AjaxFormComponentUpdatingBehavior("onblur") {
@@ -65,12 +65,13 @@ public class MarkdownTextArea extends TextArea {
                setOutputMarkupId(true);
        }
 
-       protected void renderPreview(SafeTextModel previewModel) {
+       protected void renderPreview(IModel<String> previewModel) {
                if (text == null) {
                        return;
                }
                String html = MarkdownUtils.transformGFM(GitBlitWebApp.get().settings(), text, repositoryName);
-               previewModel.setObject(html);
+               String safeHtml = GitBlitWebApp.get().xssFilter().relaxed(html);
+               previewModel.setObject(safeHtml);
        }
 
        public String getText() {

diff --git a/src/main/java/com/gitblit/wicket/panels/TicketListPanel.java b/src/main/java/com/gitblit/wicket/panels/TicketListPanel.java
index c7079c859bb6887436a70ebcef23284de756187c..cc0b57a8a49bb18152a77ffd49654782253239a4 100644 (file)
--- a/src/main/java/com/gitblit/wicket/panels/TicketListPanel.java
+++ b/src/main/java/com/gitblit/wicket/panels/TicketListPanel.java
@@ -130,9 +130,10 @@ public class TicketListPanel extends BasePanel {
                                                        Repository db = app().repositories().getRepository(repository.name);
                                                        BugtraqProcessor btp  = new BugtraqProcessor(app().settings());
                                                        String content = btp.processText(db, repository.name, labelItem.getModelObject());
+                                                       String safeContent = app().xssFilter().relaxed(content);
                                                        db.close();
 
-                                                       label = new Label("label", content);
+                                                       label = new Label("label", safeContent);
                                                        label.setEscapeModelStrings(false);
 
                                                        tLabel = app().tickets().getLabel(repository, labelItem.getModelObject());