Merge pull request #63 from rightsstatements/develop

Escape additional parameters to prevent XSS
rightsstatements · Jan 25, 2018 · a971bc1 · a971bc1
2 parents 31998b5 + 166fbd6
commit a971bc1
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/app/controllers/Application.java b/app/controllers/Application.java
@@ -9,6 +9,7 @@
 import com.hp.hpl.jena.rdf.model.Model;
 import com.hp.hpl.jena.rdf.model.ModelFactory;
 
+import org.apache.commons.lang3.StringEscapeUtils;
 import play.Logger;
 import play.Play;
 import play.api.http.MediaRange;
@@ -436,7 +437,7 @@ private HashMap<String, String> getParameters(Http.Request request, String id) {
       for (String validParameter : validParameters.split(" ")) {
         String suppliedParameter = request.getQueryString(validParameter);
         if (suppliedParameter != null) {
-          parameters.put(validParameter, request.getQueryString(validParameter));
+          parameters.put(validParameter, StringEscapeUtils.escapeHtml4(request.getQueryString(validParameter)));
         }
       }
     }

diff --git a/test/controllers/ApplicationTest.java b/test/controllers/ApplicationTest.java
@@ -286,12 +286,13 @@ public void testGetStatementPage() {
     running(fakeApplication, new Runnable() {
       @Override
       public void run() {
-        Result result = route(fakeRequest(routes.Application.getStatementPage("InC", "1.0", "en"))
-            .header("Accept", "text/html"));
+        Result result = route(fakeRequest("GET", routes.Application.getStatementPage("InC-OW-EU", "1.0", "en").url()
+            .concat("&relatedURL=%22%3E%3Cscript%3Ewindow.location%20=%22http://www.google.com%22%3C/script%3E")));
         assertEquals(200, result.status());
         assertEquals("text/html", result.contentType());
-        assertEquals("<http://null/page/InC/1.0/>; rel=derivedfrom", result.header("Link"));
+        assertEquals("<http://null/page/InC-OW-EU/1.0/>; rel=derivedfrom", result.header("Link"));
         assertEquals("en", result.header("Content-Language"));
+        assertEquals(-1, contentAsString(result).indexOf("<script>window.location =\"http://www.google.com\"</script>"));
         //FIXME: re-enable once templates are finalized
         //assertEquals(getResource("page/InC/1.0"), contentAsString(result));
       }