Return-Path: Delivered-To: apmail-incubator-jspwiki-dev-archive@minotaur.apache.org Received: (qmail 96138 invoked from network); 7 Mar 2010 13:38:53 -0000 Received: from unknown (HELO mail.apache.org) (140.211.11.3) by 140.211.11.9 with SMTP; 7 Mar 2010 13:38:53 -0000 Received: (qmail 85762 invoked by uid 500); 7 Mar 2010 13:38:32 -0000 Delivered-To: apmail-incubator-jspwiki-dev-archive@incubator.apache.org Received: (qmail 85746 invoked by uid 500); 7 Mar 2010 13:38:32 -0000 Mailing-List: contact jspwiki-dev-help@incubator.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: jspwiki-dev@incubator.apache.org Delivered-To: mailing list jspwiki-dev@incubator.apache.org Received: (qmail 85738 invoked by uid 99); 7 Mar 2010 13:38:32 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 07 Mar 2010 13:38:32 +0000 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of janne.jalkanen@ecyrd.com designates 193.64.5.122 as permitted sender) Received: from [193.64.5.122] (HELO mail.ecyrd.com) (193.64.5.122) by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 07 Mar 2010 13:38:25 +0000 Received: from 84-231-29-168.elisa-mobile.fi (84-231-29-168.elisa-mobile.fi [84.231.29.168]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.ecyrd.com (Postfix) with ESMTPSA id 375A697C1E2 for ; Sun, 7 Mar 2010 15:34:24 +0200 (EET) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1077) Subject: Re: svn commit: r917390 - in /incubator/jspwiki/trunk: ./ src/java/org/apache/wiki/ src/java/org/apache/wiki/plugin/ src/java/org/apache/wiki/preferences/ src/java/org/apache/wiki/rpc/json/ src/java/org/apache/wiki/tags/ src/java/org/apache/wiki/ui/ From: Janne Jalkanen In-Reply-To: Date: Sun, 7 Mar 2010 15:33:22 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: <93C8DEA8-7C06-4985-91D7-48BFBC8CAF94@ecyrd.com> References: <15cc92001003021338x81afd82oaa5a5ccaae0b86e4@mail.gmail.com> <0F35C570-6FE2-4003-95B9-B068541EA3C7@ecyrd.com> <64593FE9-0AAF-4B33-856A-4D9E9A880378@gmail.com> <20100303162113.GA16369@ecyrd.com> <266B732F-3495-46B7-85A0-D96C2948A9C9@ecyrd.com> <4AB9BB4D-7246-4706-8131-B6FA6C4A652B@ecyrd.com> To: jspwiki-dev@incubator.apache.org X-Mailer: Apple Mail (2.1077) X-Virus-Checked: Checked by ClamAV on apache.org Can you detail exactly which security issue is raised by this? After = all, plugins are a) already running at the exact same rights as the rest = of JSPWiki, and b) can insert full HTML code into the body of the page, = including arbitrary "; >>>>>>>>>>>>> - } >>>>>>>>>>>>> - else if( type.equals( RESOURCE_STYLESHEET ) ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - resourceString =3D ">>>>>>>>>>>> css' >>>>>>>>>>>> href=3D'" + resource + "' />"; >>>>>>>>>>>>> - } >>>>>>>>>>>>> - else if( type.equals( RESOURCE_INLINECSS ) ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - resourceString =3D "\n"; >>>>>>>>>>>>> - } >>>>>>>>>>>>> - else if( type.equals( RESOURCE_JSFUNCTION ) ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - resourceString =3D resource; >>>>>>>>>>>>> - } >>>>>>>>>>>>> - else if( type.equals( RESOURCE_HTTPHEADER ) ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - resourceString =3D resource; >>>>>>>>>>>>> - } >>>>>>>>>>>>> - >>>>>>>>>>>>> - if( resourceString !=3D null ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - resources.add( resourceString ); >>>>>>>>>>>>> - } >>>>>>>>>>>>> - >>>>>>>>>>>>> - log.debug( "Request to add a resource: " + >>>>>>>>>>>>> resourceString ); >>>>>>>>>>>>> - >>>>>>>>>>>>> - resourcemap.put( type, resources ); >>>>>>>>>>>>> - ctx.setVariable( RESOURCE_INCLUDES, resourcemap = ); >>>>>>>>>>>>> - } >>>>>>>>>>>>> - >>>>>>>>>>>>> - /** >>>>>>>>>>>>> - * Returns resource requests for a particular type. = If there >>>>>>>>>>>>> are no >>>>>>>>>>>>> - * resources, returns an empty array. >>>>>>>>>>>>> - * >>>>>>>>>>>>> - * @param ctx WikiContext >>>>>>>>>>>>> - * @param type The resource request type >>>>>>>>>>>>> - * @return a String array for the resource requests >>>>>>>>>>>>> - * @deprecated use the Stripes = layout-component >>>>>>>>>>>>> tags >>>>>>>>>>>> instead >>>>>>>>>>>>> - */ >>>>>>>>>>>>> - @SuppressWarnings( "unchecked" ) >>>>>>>>>>>>> - public static String[] getResourceRequests( = WikiContext ctx, >>>>>>>>>>>>> String >>>>>>>>>>>> type ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - HashMap> hm =3D = (HashMap>>>>>>>>>>> Vector>) ctx.getVariable( RESOURCE_INCLUDES ); >>>>>>>>>>>>> - >>>>>>>>>>>>> - if( hm =3D=3D null ) >>>>>>>>>>>>> - return new String[0]; >>>>>>>>>>>>> - >>>>>>>>>>>>> - Vector resources =3D hm.get( type ); >>>>>>>>>>>>> - >>>>>>>>>>>>> - if( resources =3D=3D null ) >>>>>>>>>>>>> - return new String[0]; >>>>>>>>>>>>> - >>>>>>>>>>>>> - String[] res =3D new String[resources.size()]; >>>>>>>>>>>>> - >>>>>>>>>>>>> - return resources.toArray( res ); >>>>>>>>>>>>> - } >>>>>>>>>>>>> - >>>>>>>>>>>>> - /** >>>>>>>>>>>>> - * Returns all those types that have been requested = so far. >>>>>>>>>>>>> - * >>>>>>>>>>>>> - * @param ctx the wiki context >>>>>>>>>>>>> - * @return the array of types requested >>>>>>>>>>>>> - * @deprecated use the Stripes = layout-component >>>>>>>>>>>>> tags >>>>>>>>>>>> instead >>>>>>>>>>>>> - */ >>>>>>>>>>>>> - @SuppressWarnings( "unchecked" ) >>>>>>>>>>>>> - public static String[] getResourceTypes( WikiContext = ctx ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - String[] res =3D new String[0]; >>>>>>>>>>>>> - >>>>>>>>>>>>> - if( ctx !=3D null ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - HashMap hm =3D = (HashMap) >>>>>>>>>>>> ctx.getVariable( RESOURCE_INCLUDES ); >>>>>>>>>>>>> - >>>>>>>>>>>>> - if( hm !=3D null ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - Set keys =3D hm.keySet(); >>>>>>>>>>>>> - >>>>>>>>>>>>> - res =3D keys.toArray( res ); >>>>>>>>>>>>> - } >>>>>>>>>>>>> - } >>>>>>>>>>>>> - >>>>>>>>>>>>> - return res; >>>>>>>>>>>>> - } >>>>>>>>>>>>> - >>>>>>>>>>>>> + >>>>>>>>>>>>> /** >>>>>>>>>>>>> * Returns an empty collection, since at the moment the >>>>>>>>>>>> TemplateManager does >>>>>>>>>>>>> * not manage any modules. >>>>>>>>>>>>> @@ -631,50 +346,6 @@ >>>>>>>>>>>>> */ >>>>>>>>>>>>> public Collection modules() >>>>>>>>>>>>> { >>>>>>>>>>>>> - return EMPTY_MODULE_LIST; >>>>>>>>>>>>> - } >>>>>>>>>>>>> - >>>>>>>>>>>>> - /** >>>>>>>>>>>>> - * Adds all of the resources under a specified path = prefix >>>>>>>>>>>>> to the >>>>>>>>>>>>> - * resource resolver map, with the "short name" of = the path >>>>>>>>>>>>> as the >>>>>>>>>>>>> - * key, and the full path as the value. The short = name is the >>>>>>>>>>>> portion >>>>>>>>>>>>> - * of the path after the prefix. If a resource with = that >>>>>>>>>>>>> short name >>>>>>>>>>>>> - * has already been added to the resource map, it = will not >>>>>>>>>>>>> be added >>>>>>>>>>>>> - * again. Any resources ending in {@code /} (i.e., a >>>>>>>>>>>>> directory path) >>>>>>>>>>>>> - * will be processed recursively. >>>>>>>>>>>>> - * @param context the servlet context >>>>>>>>>>>>> - * @param resolver the resource resolver map >>>>>>>>>>>>> - * @param prefix the path prefix that the search = initiates >>>>>>>>>>>>> from >>>>>>>>>>>>> - * @param dir the directory to search relative to the = path >>>>>>>>>>>>> prefix. >>>>>>>>>>>> If not >>>>>>>>>>>>> - * supplied, the path prefix directory itself will be = searched >>>>>>>>>>>>> - */ >>>>>>>>>>>>> - @SuppressWarnings("unchecked") >>>>>>>>>>>>> - private static void addResources( ServletContext = context, >>>>>>>>>>>> Map resolver, String prefix, String dir ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - String searchPath =3D dir =3D=3D null ? prefix : = prefix + dir; >>>>>>>>>>>>> - Set resources =3D = context.getResourcePaths( >>>>>>>>>>>>> searchPath ); >>>>>>>>>>>>> - if ( resources !=3D null ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - for ( String resource : resources ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - String shortName =3D resource.substring( >>>>>>>>>>>>> prefix.length() >>>>>>>>>>>> ); >>>>>>>>>>>>> - >>>>>>>>>>>>> - // Directory: process these entries too >>>>>>>>>>>>> - if ( shortName.endsWith( "/" ) ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - addResources( context, resolver, = prefix, >>>>>>>>>>>>> shortName >>>>>>>>>>>> ); >>>>>>>>>>>>> - } >>>>>>>>>>>>> - >>>>>>>>>>>>> - // Regular resource: add it if we don't = have it >>>>>>>>>>>>> already >>>>>>>>>>>>> - else >>>>>>>>>>>>> - { >>>>>>>>>>>>> - boolean alreadyProcessed =3D >>>>>>>>>>>>> resolver.containsKey( >>>>>>>>>>>> shortName ); >>>>>>>>>>>>> - if ( !alreadyProcessed ) >>>>>>>>>>>>> - { >>>>>>>>>>>>> - resolver.put( shortName, resource = ); >>>>>>>>>>>>> - } >>>>>>>>>>>>> - } >>>>>>>>>>>>> - } >>>>>>>>>>>>> - } >>>>>>>>>>>>> + return Collections.emptyList(); >>>>>>>>>>>>> } >>>>>>>>>>>>> } >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Modified: >>>>>>>>>>>> = incubator/jspwiki/trunk/src/java/org/apache/wiki/ui/stripes/ >>>>>>>>>>>> TemplateResolution.java >>>>>>>>>>>>> URL: >>>>>>>>>>>> = http://svn.apache.org/viewvc/incubator/jspwiki/trunk/src/java/org/apache/w= iki/ui/stripes/TemplateResolution.java?rev=3D917390&r1=3D917389&r2=3D91739= 0&view=3Ddiff >>>>>>>>>>>>>=20 >>>>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>>>>>>> = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>>>>>>>> --- >>>>>>>>>>>> = incubator/jspwiki/trunk/src/java/org/apache/wiki/ui/stripes/ >>>>>>>>>>>> TemplateResolution.java >>>>>>>>>>>> (original) >>>>>>>>>>>>> +++ >>>>>>>>>>>> = incubator/jspwiki/trunk/src/java/org/apache/wiki/ui/stripes/ >>>>>>>>>>>> TemplateResolution.java >>>>>>>>>>>> Mon Mar 1 05:23:10 2010 >>>>>>>>>>>>> @@ -22,6 +22,8 @@ >>>>>>>>>>>>> { >>>>>>>>>>>>> private static final Logger LOG =3D = LoggerFactory.getLogger( >>>>>>>>>>>> TemplateResolution.class ); >>>>>>>>>>>>>=20 >>>>>>>>>>>>> + private static final String DEFAULT_PATH_PREFIX =3D = "/" + >>>>>>>>>>>> TemplateManager.TEMPLATE_DIR + "/" + >>>>>>>>>>>> TemplateManager.DEFAULT_TEMPLATE + "/"; >>>>>>>>>>>>> + >>>>>>>>>>>>> /** >>>>>>>>>>>>> * Constructs a new TemplateResolution >>>>>>>>>>>>> * >>>>>>>>>>>>> @@ -41,7 +43,7 @@ >>>>>>>>>>>>> String path =3D TemplateManager.getResourceResolver( >>>>>>>>>>>>> servletContext >>>>>>>>>>>> ).get( getPath() ); >>>>>>>>>>>>> if( path =3D=3D null ) >>>>>>>>>>>>> { >>>>>>>>>>>>> - path =3D "/templates/" + >>>>>>>>>>>>> TemplateManager.DEFAULT_TEMPLATE + >>>>>>>>>>>> "/" + getPath(); >>>>>>>>>>>>> + path =3D DEFAULT_PATH_PREFIX + getPath(); >>>>>>>>>>>>> } >>>>>>>>>>>>> setPath( path ); >>>>>>>>>>>>>=20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>=20 >>>>>>>>>>>>=20 >>>>>>>>>>=20 >>>>>>>>=20 >>>>>>>=20 >>>>=20 >>>>=20 >>=20 >>=20