SONAR-10438 Fix XSS issues related to select2

diff --git a/server/sonar-web/src/main/js/apps/coding-rules/bulk-change-modal-view.js b/server/sonar-web/src/main/js/apps/coding-rules/bulk-change-modal-view.js
index f9e5e728665e71f11683f3dc2f7a000decc6e6db..87a3c4ef21a1966f41607df584f344235db90823 100644 (file)
--- a/server/sonar-web/src/main/js/apps/coding-rules/bulk-change-modal-view.js
+++ b/server/sonar-web/src/main/js/apps/coding-rules/bulk-change-modal-view.js
@@ -17,6 +17,7 @@
  * along with this program; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
+import escapeHtml from 'escape-html';
 import ModalFormView from '../../components/common/modal-form';
 import Template from './templates/coding-rules-bulk-change-modal.hbs';
 import { translateWithParameters } from '../../helpers/l10n';
@@ -36,8 +37,8 @@ export default ModalFormView.extend({
     const profileBase = this.options.app.qualityProfiles.find(p => p.key === profile);
     const message = translateWithParameters(
       'coding_rules.bulk_change.success',
-      profileBase.name,
-      profileBase.language,
+      escapeHtml(profileBase.name),
+      escapeHtml(profileBase.language),
       succeeded
     );
     this.ui.messagesContainer.append(`<div class="alert alert-success">${message}</div>`);
@@ -47,8 +48,8 @@ export default ModalFormView.extend({
     const profileBase = this.options.app.qualityProfiles.find(p => p.key === profile);
     const message = translateWithParameters(
       'coding_rules.bulk_change.warning',
-      profileBase.name,
-      profileBase.language,
+      escapeHtml(profileBase.name),
+      escapeHtml(profileBase.language),
       succeeded,
       failed
     );
@@ -60,7 +61,8 @@ export default ModalFormView.extend({
     this.$('#coding-rules-bulk-change-profile').select2({
       width: '250px',
       minimumResultsForSearch: 1,
-      openOnEnter: false
+      openOnEnter: false,
+      escapeMarkup: markup => markup
     });
   },
 
@@ -114,7 +116,8 @@ export default ModalFormView.extend({
     }
     return profiles
       .filter(profile => profile.actions && profile.actions.edit)
-      .filter(profile => !profile.isBuiltIn);
+      .filter(profile => !profile.isBuiltIn)
+      .map(profile => ({ ...profile, name: escapeHtml(profile.name) }));
   },
 
   serializeData() {

diff --git a/server/sonar-web/src/main/js/apps/coding-rules/rule/profile-activation-view.js b/server/sonar-web/src/main/js/apps/coding-rules/rule/profile-activation-view.js
index c4c34051150638a8141a83ad2759617da5532037..5b165f22c99eb41a8d6b4d441312e8c411c231ec 100644 (file)
--- a/server/sonar-web/src/main/js/apps/coding-rules/rule/profile-activation-view.js
+++ b/server/sonar-web/src/main/js/apps/coding-rules/rule/profile-activation-view.js
@@ -19,6 +19,7 @@
  */
 import $ from 'jquery';
 import Backbone from 'backbone';
+import escapeHtml from 'escape-html';
 import ModalForm from '../../../components/common/modal-form';
 import Template from '../templates/rule/coding-rules-profile-activation.hbs';
 import { csvEscape } from '../../../helpers/csv';
@@ -49,7 +50,9 @@ export default ModalForm.extend({
 
     this.ui.qualityProfileSelect.select2({
       width: '250px',
-      minimumResultsForSearch: 5
+      minimumResultsForSearch: 5,
+      escapeMarkup: escapeHtml,
+      formatResult: result => result.text
     });
 
     const that = this;
@@ -157,7 +160,7 @@ export default ModalForm.extend({
     const availableProfiles = this.getAvailableQualityProfiles(this.options.rule.get('lang'));
     const contextProfile = this.options.app.state.get('query').qprofile;
 
-    // decrease depth by 1, so the top level starts at 0
+    // decrease depth by 1, so the top level starts at 0, and escape name to prevent xss
     const profilesWithDepth = sortProfiles(availableProfiles).map(profile => ({
       ...profile,
       depth: profile.depth - 1

diff --git a/server/sonar-web/src/main/js/apps/coding-rules/rule/rule-meta-view.js b/server/sonar-web/src/main/js/apps/coding-rules/rule/rule-meta-view.js
index 15d18464f5c777ba57ebc739d8e6e3c130d2cc39..eed403674814926543c9713e52c755654b836214 100644 (file)
--- a/server/sonar-web/src/main/js/apps/coding-rules/rule/rule-meta-view.js
+++ b/server/sonar-web/src/main/js/apps/coding-rules/rule/rule-meta-view.js
@@ -18,6 +18,7 @@
  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
 import $ from 'jquery';
+import escapeHtml from 'escape-html';
 import { difference, union } from 'lodash';
 import Marionette from 'backbone.marionette';
 import RuleFilterMixin from './rule-filter-mixin';
@@ -62,7 +63,9 @@ export default Marionette.ItemView.extend(RuleFilterMixin).extend({
       tags => {
         this.ui.tagInput.select2({
           tags: difference(difference(tags, this.model.get('tags')), this.model.get('sysTags')),
-          width: '300px'
+          width: '300px',
+          escapeMarkup: escapeHtml,
+          formatResult: result => result.text
         });
 
         this.ui.tagsEdit.removeClass('hidden');

diff --git a/server/sonar-web/src/main/js/apps/custom-measures/form-view.js b/server/sonar-web/src/main/js/apps/custom-measures/form-view.js
index d89fa0e800b59af6cd207fb60dd21c319b727e36..b47bd51e1ef31ef0a717325e805e179e7eecd8e1 100644 (file)
--- a/server/sonar-web/src/main/js/apps/custom-measures/form-view.js
+++ b/server/sonar-web/src/main/js/apps/custom-measures/form-view.js
@@ -17,6 +17,7 @@
  * along with this program; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
+import escapeHtml from 'escape-html';
 import ModalForm from '../../components/common/modal-form';
 import Metrics from '../metrics/metrics';
 import Template from './templates/custom-measures-form.hbs';
@@ -35,7 +36,9 @@ export default ModalForm.extend({
     this.$('[data-toggle="tooltip"]').tooltip({ container: 'body', placement: 'bottom' });
     this.$('#create-custom-measure-metric').select2({
       width: '250px',
-      minimumResultsForSearch: 20
+      minimumResultsForSearch: 20,
+      escapeMarkup: escapeHtml,
+      formatResult: result => result.text
     });
   },
 

diff --git a/server/sonar-web/src/main/js/apps/metrics/form-view.js b/server/sonar-web/src/main/js/apps/metrics/form-view.js
index d0ab24e62e735b16839c5c664beb56ffdfdaed9c..440105b4439df54bc5cd01e2dac93f189a0c3bb4 100644 (file)
--- a/server/sonar-web/src/main/js/apps/metrics/form-view.js
+++ b/server/sonar-web/src/main/js/apps/metrics/form-view.js
@@ -18,6 +18,7 @@
  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
 import $ from 'jquery';
+import escapeHtml from 'escape-html';
 import ModalForm from '../../components/common/modal-form';
 import Template from './templates/metrics-form.hbs';
 
@@ -47,7 +48,9 @@ export default ModalForm.extend({
             return { id: item, text: item };
           });
           options.callback({ results, more: false });
-        }
+        },
+        escapeMarkup: escapeHtml,
+        formatResult: result => result.text
       })
       .select2('val', this.model && this.model.get('domain'));
     this.$('#create-metric-type').select2({ width: '250px' });

diff --git a/server/sonar-web/src/main/js/apps/permission-templates/views/FormView.js b/server/sonar-web/src/main/js/apps/permission-templates/views/FormView.js
index 1bf56cf1e0136b7ad89618e159b8940c18a77b49..4f41ec1f3f0077b0cda1516e3dea80648b82d322 100644 (file)
--- a/server/sonar-web/src/main/js/apps/permission-templates/views/FormView.js
+++ b/server/sonar-web/src/main/js/apps/permission-templates/views/FormView.js
@@ -26,10 +26,6 @@ export default ModalForm.extend({
   onRender() {
     ModalForm.prototype.onRender.apply(this, arguments);
     this.$('[data-toggle="tooltip"]').tooltip({ container: 'body', placement: 'bottom' });
-    this.$('#create-custom-measure-metric').select2({
-      width: '250px',
-      minimumResultsForSearch: 20
-    });
   },
 
   onDestroy() {

diff --git a/server/sonar-web/src/main/js/apps/permissions/project/views/ApplyTemplateView.js b/server/sonar-web/src/main/js/apps/permissions/project/views/ApplyTemplateView.js
index a7c8c972d0b10c7bd35e08a22ff21d0384e9b0d1..9d1b6e4409e796c54b0525d5cfac965553b653f3 100644 (file)
--- a/server/sonar-web/src/main/js/apps/permissions/project/views/ApplyTemplateView.js
+++ b/server/sonar-web/src/main/js/apps/permissions/project/views/ApplyTemplateView.js
@@ -17,6 +17,7 @@
  * along with this program; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
+import escapeHtml from 'escape-html';
 import ModalForm from '../../../../components/common/modal-form';
 import { applyTemplateToProject, getPermissionTemplates } from '../../../../api/permissions';
 import Template from '../templates/ApplyTemplateTemplate.hbs';
@@ -40,7 +41,9 @@ export default ModalForm.extend({
     ModalForm.prototype.onRender.apply(this, arguments);
     this.$('#project-permissions-template').select2({
       width: '250px',
-      minimumResultsForSearch: 20
+      minimumResultsForSearch: 20,
+      escapeMarkup: escapeHtml,
+      formatResult: result => result.text
     });
   },
 

diff --git a/server/sonar-web/src/main/js/components/common/modal-form.js b/server/sonar-web/src/main/js/components/common/modal-form.js
index 0610c634f0a4c4c97faeea5bb4ee6d8253a099bd..e344fdcaff4361f93aa66e2cefeda9f67fb024f7 100644 (file)
--- a/server/sonar-web/src/main/js/components/common/modal-form.js
+++ b/server/sonar-web/src/main/js/components/common/modal-form.js
@@ -17,6 +17,7 @@
  * along with this program; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
+import escapeHtml from 'escape-html';
 import ModalView from './modals';
 
 export default ModalView.extend({
@@ -60,13 +61,13 @@ export default ModalView.extend({
     const container = this.ui.messagesContainer.empty();
     if (Array.isArray(errors)) {
       errors.forEach(error => {
-        const html = `<div class="alert alert-danger">${error.msg}</div>`;
+        const html = `<div class="alert alert-danger">${escapeHtml(error.msg)}</div>`;
         container.append(html);
       });
     }
     if (Array.isArray(warnings)) {
       warnings.forEach(warn => {
-        const html = `<div class="alert alert-warning">${warn.msg}</div>`;
+        const html = `<div class="alert alert-warning">${escapeHtml(warn.msg)}</div>`;
         container.append(html);
       });
     }