Skip to content

Commit

Permalink
[GWC-1171] Improve handling special characters in the GWC Demos Page
Browse files Browse the repository at this point in the history
  • Loading branch information
@sikeoka
sikeoka committed Oct 10, 2023
1 parent 65e0fd6 commit 04d8d57
Show file tree
Hide file tree
Showing 3 changed files with 162 additions and 32 deletions.
12 changes: 7 additions & 5 deletions geowebcache/core/src/main/java/org/geowebcache/GeoWebCacheDispatcher.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@
*/
package org.geowebcache;

import static org.apache.commons.text.StringEscapeUtils.escapeHtml4;

import java.io.File;
import java.io.IOException;
import java.io.InputStream;
Expand Down Expand Up @@ -473,7 +475,7 @@ private void handleFrontPage(HttpServletRequest request, HttpServletResponse res
baseUrl = "";
} else {
String[] strs = request.getRequestURL().toString().split("/");
baseUrl = strs[strs.length - 1] + "/";
baseUrl = escapeHtml4(strs[strs.length - 1]) + "/";
}

StringBuilder str = new StringBuilder();
Expand Down Expand Up @@ -576,20 +578,20 @@ private void appendStorageLocations(StringBuilder str) {
LOG.log(Level.SEVERE, "Could not find local cache location", ex);
}
str.append("<tr><th scope=\"row\">Config file:</th><td><tt>")
.append(configLoc)
.append(escapeHtml4(configLoc))
.append("</tt></td></tr>");
str.append("<tr><th scope=\"row\">Local Storage:</th><td><tt>")
.append(localStorageLoc)
.append(escapeHtml4(localStorageLoc))
.append("</tt></td></tr>");
str.append("</tbody>");
if (!blobStoreLocations.isEmpty()) {
str.append("<tbody>");
str.append("<tr><th scope=\"rowgroup\" colspan=\"2\">Blob Stores</th></tr>");
for (Map.Entry<String, String> e : blobStoreLocations.entrySet()) {
str.append("<tr><th scope=\"row\">")
.append(e.getKey())
.append(escapeHtml4(e.getKey()))
.append(":</th><td><tt>")
.append(e.getValue())
.append(escapeHtml4(e.getValue()))
.append("</tt></td></tr>");
}
str.append("</tbody>");
Expand Down
57 changes: 34 additions & 23 deletions geowebcache/core/src/main/java/org/geowebcache/demo/Demo.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,9 @@
*/
package org.geowebcache.demo;

import static org.apache.commons.text.StringEscapeUtils.escapeHtml4;
import static org.owasp.encoder.Encode.forJavaScript;

import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;
Expand All @@ -28,7 +31,6 @@
import java.util.stream.Collectors;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.text.StringEscapeUtils;
import org.geowebcache.GeoWebCacheException;
import org.geowebcache.filter.parameters.FloatParameterFilter;
import org.geowebcache.filter.parameters.ParameterFilter;
Expand All @@ -45,11 +47,11 @@
import org.geowebcache.mime.MimeType;
import org.geowebcache.mime.XMLMime;
import org.geowebcache.util.ServletUtils;
import org.owasp.encoder.Encode;
import org.springframework.util.Assert;

public class Demo {

@SuppressWarnings("PMD.AvoidPrintStackTrace")
public static void makeMap(
TileLayerDispatcher tileLayerDispatcher,
GridSetBroker gridSetBroker,
Expand Down Expand Up @@ -182,11 +184,12 @@ private static void tableRows(
if (!layer.isAdvertised()) {
continue;
}
String escapedLayerName = escapeHtml4(layer.getName());
buf.append("<tr><td style=\"min-width: 100px;\"><strong>")
.append(layer.getName())
.append(escapedLayerName)
.append("</strong><br />\n");
buf.append("<a href=\"rest/seed/")
.append(layer.getName())
.append(escapedLayerName)
.append("\">Seed this layer</a>\n");
buf.append("</td><td>").append(layer.isEnabled()).append("</td>");
buf.append("<td><table width=\"100%\">");
Expand All @@ -197,6 +200,7 @@ private static void tableRows(
if (gridSetName.length() > 20) {
gridSetName = gridSetName.substring(0, 20) + "...";
}
gridSetName = escapeHtml4(gridSetName);
buf.append("<tr><td style=\"width: 170px;\">").append(gridSetName);

buf.append("</td><td>OpenLayers: [");
Expand All @@ -206,8 +210,8 @@ private static void tableRows(
.map(
type ->
generateDemoUrl(
layer.getName(),
gridSubset.getName(),
escapedLayerName,
escapeHtml4(gridSubset.getName()),
type))
.collect(Collectors.joining(", ")));

Expand Down Expand Up @@ -240,12 +244,12 @@ private static void outputKMLSupport(StringBuffer buf, TileLayer layer) {
if (type == XMLMime.kmz) {
return String.format(
"<a href=\"%sservice/kml/%s.kml.kmz\">kmz</a>",
prefix, layer.getName());
prefix, escapeHtml4(layer.getName()));
} else {
return String.format(
"<a href=\"%sservice/kml/%s.%s.kml\">%s</a>",
prefix,
layer.getName(),
escapeHtml4(layer.getName()),
type.getFileExtension(),
type.getFileExtension());
}
Expand Down Expand Up @@ -288,9 +292,9 @@ private static String generateHTML(TileLayer layer, String gridSetStr, String fo

buf.append("<html xmlns=\"http://www.w3.org/1999/xhtml\"><head>\n");
buf.append("<meta http-equiv=\"imagetoolbar\" content=\"no\">\n" + "<title>")
.append(layerName);
buf.append(" ").append(gridSubset.getName());
buf.append(" ").append(formatStr);
.append(escapeHtml4(layerName));
buf.append(" ").append(escapeHtml4(gridSubset.getName()));
buf.append(" ").append(escapeHtml4(formatStr));
buf.append("</title>\n");
buf.append(
"<style type=\"text/css\">\n"
Expand Down Expand Up @@ -369,17 +373,17 @@ private static String generateHTML(TileLayer layer, String gridSetStr, String fo
+ "}\n"
+ "\n");
buf.append("var gridsetName = '")
.append(gridSubset.getGridSet().getName())
.append(forJavaScript(gridSubset.getGridSet().getName()))
.append("';\n" + "var gridNames = ")
.append(
Arrays.stream(gridSubset.getGridNames())
.map(StringEscapeUtils::escapeEcmaScript)
.map(Encode::forJavaScript)
.map(s -> String.format("'%s'", s))
.collect(Collectors.joining(", ", "[", "]")))
.append(";\n" + "var baseUrl = '../service/wmts';\n" + "var style = '';\n");
buf.append("var format = '").append(formatStr).append("';\n");
buf.append("var format = '").append(forJavaScript(formatStr)).append("';\n");
buf.append("var infoFormat = 'text/html';\n");
buf.append("var layerName = '").append(layerName).append("';\n");
buf.append("var layerName = '").append(forJavaScript(layerName)).append("';\n");

String unit = "";
double mpu = gridSet.getMetersPerUnit();
Expand Down Expand Up @@ -673,7 +677,10 @@ private static String makeModifiableParameters(TileLayer tl) {
String key = pf.getKey();
String defaultValue = pf.getDefaultValue();
List<String> legalValues = pf.getLegalValues();
doc.append("<tr><td>").append(key.toUpperCase()).append(": ").append("</td><td>");
doc.append("<tr><td>")
.append(escapeHtml4(key.toUpperCase()))
.append(": ")
.append("</td><td>");
String parameterId = key;
if (pf instanceof StringParameterFilter) {
Map<String, String> keysValues = makeParametersMap(defaultValue, legalValues);
Expand Down Expand Up @@ -722,7 +729,11 @@ private static Map<String, String> makeParametersMap(
private static void makePullDown(
StringBuilder doc, String id, Map<String, String> keysValues, String defaultKey) {
doc.append(
"<select name=\"" + id + "\" onchange=\"window.setParam('" + id + "', value)\">\n");
"<select name=\""
+ escapeHtml4(id)
+ "\" onchange=\"window.setParam('"
+ forJavaScript(id)
+ "', value)\">\n");

Iterator<Entry<String, String>> iter = keysValues.entrySet().iterator();

Expand All @@ -733,16 +744,16 @@ private static void makePullDown(
if ((key == null && defaultKey == null) || (key != null && key.equals(defaultKey))) {
doc.append(
"<option value=\""
+ entry.getValue()
+ escapeHtml4(entry.getValue())
+ "\" selected=\"selected\">"
+ entry.getKey()
+ escapeHtml4(entry.getKey())
+ "</option>\n");
} else {
doc.append(
"<option value=\""
+ entry.getValue()
+ escapeHtml4(entry.getValue())
+ "\">"
+ entry.getKey()
+ escapeHtml4(entry.getKey())
+ "</option>\n");
}
}
Expand All @@ -753,11 +764,11 @@ private static void makePullDown(
private static void makeTextInput(StringBuilder doc, String id, int size) {
doc.append(
"<input name=\""
+ id
+ escapeHtml4(id)
+ "\" type=\"text\" size=\""
+ size
+ "\" onblur=\"window.setParam('"
+ id
+ forJavaScript(id)
+ "', value)\" />\n");
}

Expand Down
125 changes: 121 additions & 4 deletions geowebcache/core/src/test/java/org/geowebcache/DemoTest.java
View file
Original file line number Diff line number Diff line change
@@ -1,18 +1,30 @@
package org.geowebcache;

import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;
import static org.hamcrest.Matchers.containsString;
import static org.hamcrest.Matchers.not;
import static org.junit.Assert.assertThat;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashMap;
import java.util.LinkedHashSet;
import java.util.Set;
import java.util.TreeSet;
import org.geowebcache.demo.Demo;
import org.geowebcache.filter.parameters.RegexParameterFilter;
import org.geowebcache.filter.parameters.StringParameterFilter;
import org.geowebcache.grid.BoundingBox;
import org.geowebcache.grid.GridSet;
import org.geowebcache.grid.GridSetBroker;
import org.geowebcache.grid.GridSubset;
import org.geowebcache.grid.SRS;
import org.geowebcache.layer.TileLayer;
import org.geowebcache.layer.TileLayerDispatcher;
import org.geowebcache.layer.wms.WMSLayer;
import org.geowebcache.mime.MimeType;
import org.junit.Test;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
Expand Down Expand Up @@ -71,7 +83,112 @@ public void testAdvertised() throws GeoWebCacheException, IOException {
String result = response.getContentAsString();

// Ensure the Advertised Layer is present and the Unadvertised Layer is not
assertTrue(result.contains("testAdv"));
assertFalse(result.contains("testNotAdv"));
assertThat(result, containsString("testAdv"));
assertThat(result, not(containsString("testNotAdv")));
}

@Test
public void testEscapingWithoutLayer() throws Exception {
String unescapedLayer = "layer\"><";
String escapedLayer = "layer&quot;&gt;&lt;";
String unescapedSubset = "ESPG:1234\"><";
String escapedSubset = "ESPG:1234&quot;&gt;&lt;";
String epsg4326 = "ESPG:4326";

GridSubset subSet1 = mock(GridSubset.class);
when(subSet1.getName()).thenReturn(unescapedSubset);
GridSubset subSet2 = mock(GridSubset.class);
when(subSet2.getName()).thenReturn(epsg4326);
Set<String> gridSubsets = new LinkedHashSet<>();
gridSubsets.add(unescapedSubset);
gridSubsets.add(epsg4326);

GridSet gridSet = mock(GridSet.class);
when(gridSet.getName()).thenReturn(epsg4326);

GridSetBroker gsb = mock(GridSetBroker.class);
when(gsb.getWorldEpsg4326()).thenReturn(gridSet);

TileLayer layer = mock(TileLayer.class);
when(layer.getName()).thenReturn(unescapedLayer);
when(layer.isAdvertised()).thenReturn(true);
when(layer.getGridSubsets()).thenReturn(gridSubsets);
when(layer.getGridSubset(epsg4326)).thenReturn(subSet2);
when(layer.getGridSubset(unescapedSubset)).thenReturn(subSet1);
when(layer.getMimeTypes())
.thenReturn(Collections.singletonList(MimeType.createFromFormat("image/png")));

TileLayerDispatcher tld = mock(TileLayerDispatcher.class);
when(tld.getLayerNames()).thenReturn(Collections.singleton(unescapedLayer));
when(tld.getTileLayer(unescapedLayer)).thenReturn(layer);

MockHttpServletResponse response = new MockHttpServletResponse();
Demo.makeMap(tld, gsb, null, new MockHttpServletRequest(), response);
String result = response.getContentAsString();

assertThat(result, not(containsString(unescapedLayer)));
assertThat(result, containsString(escapedLayer));
assertThat(result, not(containsString(unescapedSubset)));
assertThat(result, containsString(escapedSubset));
}

@Test
public void testEscapingWithLayer() throws Exception {
String unescapedLayer = "layer'\"><";
String escapedLayer = "layer'&quot;&gt;&lt;";
String escapedLayerJS = "layer\\x27\\x22><";
String unescapedSubset = "ESPG:1234'\"><";
String escapedSubset = "ESPG:1234'&quot;&gt;&lt;";
String escapedSubsetJS = "ESPG:1234\\x27\\x22><";

GridSet gridSet = mock(GridSet.class);
when(gridSet.getName()).thenReturn(unescapedSubset);

GridSubset subSet = mock(GridSubset.class);
when(subSet.getName()).thenReturn(unescapedSubset);
when(subSet.getGridSet()).thenReturn(gridSet);
when(subSet.getGridNames()).thenReturn(new String[] {unescapedSubset});
when(subSet.getSRS()).thenReturn(SRS.getEPSG4326());
when(subSet.getGridSetBounds()).thenReturn(BoundingBox.WORLD4326);
when(subSet.getOriginalExtent()).thenReturn(BoundingBox.WORLD4326);

TileLayer layer = mock(TileLayer.class);
when(layer.getName()).thenReturn(unescapedLayer);
when(layer.isAdvertised()).thenReturn(true);
when(layer.getGridSubsets()).thenReturn(Collections.singleton(unescapedSubset));
when(layer.getGridSubset(unescapedSubset)).thenReturn(subSet);
when(layer.getDefaultMimeType()).thenReturn(MimeType.createFromFormat("image/png"));

String unescapedString = "string'\"><";
String escapedString = "string'&quot;&gt;&lt;";
String escapedStringJS = "string\\x27\\x22><";
String unescapedRegex = "regex'\"><";
String escapedRegex = "regex'&quot;&gt;&lt;";
String escapedRegexJS = "regex\\x27\\x22><";
StringParameterFilter stringFilter = new StringParameterFilter();
stringFilter.setKey(unescapedString);
RegexParameterFilter regexFilter = new RegexParameterFilter();
regexFilter.setKey(unescapedRegex);
when(layer.getParameterFilters()).thenReturn(Arrays.asList(stringFilter, regexFilter));

TileLayerDispatcher tld = mock(TileLayerDispatcher.class);
when(tld.getTileLayer(unescapedLayer)).thenReturn(layer);

MockHttpServletResponse response = new MockHttpServletResponse();
Demo.makeMap(tld, null, unescapedLayer, new MockHttpServletRequest(), response);
String result = response.getContentAsString();

assertThat(result, not(containsString(unescapedLayer)));
assertThat(result, containsString(escapedLayer));
assertThat(result, containsString(escapedLayerJS));
assertThat(result, not(containsString(unescapedSubset)));
assertThat(result, containsString(escapedSubset));
assertThat(result, containsString(escapedSubsetJS));
assertThat(result, not(containsString(unescapedString)));
assertThat(result, containsString(escapedString));
assertThat(result, containsString(escapedStringJS));
assertThat(result, not(containsString(unescapedRegex)));
assertThat(result, containsString(escapedRegex));
assertThat(result, containsString(escapedRegexJS));
}
}

0 comments on commit 04d8d57

Please sign in to comment.