ESB-1144 FIX XSS in ContentManager

cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/content/ContentManager.java

@@ -1,3 +1,3 @@
 /*
 * Copyright 2015-Present Entando Inc. (http://www.entando.com) All rights reserved.
 *
@@ -45,6 +45,7 @@
 import org.entando.entando.ent.exception.EntRuntimeException;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
+import org.entando.entando.ent.util.LabelSanitizer;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.cache.annotation.CacheEvict;
 
@@ -293,6 +294,7 @@
     private String addUpdateContent(Content content, boolean updateDate) throws EntException {
         String id = null;
         try {
+            content.setDescription(LabelSanitizer.stripMarkup(content.getDescription()));
             content.setLastModified(new Date());
             if (updateDate) {
                 content.incrementVersion(false);

cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/contentmodel/ContentModelManager.java

@@ -33,6 +33,8 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Properties;
+
+import org.entando.entando.ent.util.LabelSanitizer;
 import org.entando.entando.plugins.jacms.aps.system.services.content.widget.RowContentListHelper;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
@@ -113,6 +115,7 @@ public void releaseTenantAware() {
      */
     @Override
     public void addContentModel(ContentModel model) throws EntException {
+        model.setDescription(LabelSanitizer.stripMarkup(model.getDescription()));
         try {
             this.getContentModelDAO().addContentModel(model);
             this.getCacheWrapper().addContentModel(model);
@@ -149,6 +152,7 @@ public void removeContentModel(ContentModel model) throws EntException {
      */
     @Override
     public void updateContentModel(ContentModel model) throws EntException {
+        model.setDescription(LabelSanitizer.stripMarkup(model.getDescription()));
         try {
             this.getContentModelDAO().updateContentModel(model);
             this.getCacheWrapper().updateContentModel(model);

cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/ResourceManager.java

@@ -1,3 +1,3 @@
 /*
  * Copyright 2015-Present Entando Inc. (http://www.entando.com) All rights reserved.
  *
@@ -40,6 +40,7 @@
 import org.entando.entando.ent.util.EntLogging.EntLogger;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
 import org.entando.entando.ent.util.EntSafeXmlUtils;
+import org.entando.entando.ent.util.LabelSanitizer;
 import org.xml.sax.InputSource;
 
 import jakarta.xml.bind.JAXBContext;
@@ -244,6 +245,7 @@
      */
     @Override
     public void addResource(ResourceInterface resource) throws EntException {
+        resource.setDescription(LabelSanitizer.stripMarkup(resource.getDescription()));
         try {
             this.generateAndSetResourceId(resource, resource.getId());
             this.getResourceDAO().addResource(resource);
@@ -268,7 +270,7 @@
         ResourceInterface oldResource = this.loadResource(bean.getResourceId());
         try {
             if (null == bean.getInputStream()) {
-                oldResource.setDescription(bean.getDescr());
+                oldResource.setDescription(LabelSanitizer.stripMarkup(bean.getDescr()));
                 oldResource.setCategories(bean.getCategories());
                 oldResource.setMetadata(bean.getMetadata());
                 oldResource.setMainGroup(bean.getMainGroup());
@@ -299,6 +301,7 @@
      */
     @Override
     public void updateResource(ResourceInterface resource) throws EntException {
+        resource.setDescription(LabelSanitizer.stripMarkup(resource.getDescription()));
         try {
             this.getResourceDAO().updateResource(resource);
             this.notifyResourceChanging(resource, ResourceChangedEvent.UPDATE_OPERATION_CODE);
@@ -310,7 +313,7 @@
 
     protected ResourceInterface createResource(ResourceDataBean bean) throws EntException {
         ResourceInterface resource = this.createResourceType(bean.getResourceType());
-        resource.setDescription(bean.getDescr());
+        resource.setDescription(LabelSanitizer.stripMarkup(bean.getDescr()));
         resource.setMainGroup(bean.getMainGroup());
         resource.setCategories(bean.getCategories());
         resource.setMasterFileName(bean.getFileName());
@@ -667,7 +670,7 @@
             JAXBContext context = JAXBContext.newInstance(JaxbMetadataMapping.class);
             Unmarshaller unmarshaller = context.createUnmarshaller();
             JaxbMetadataMapping jaxbMapping = (JaxbMetadataMapping) unmarshaller.unmarshal(stream);
             jaxbMapping.getFields().stream().forEach(m -> {
                 String key = m.getKey();
                 String csv = m.getValue();
                 List<String> metadatas = new ArrayList<>();

cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/content/helper/ContentActionHelper.java

@@ -23,6 +23,7 @@
 import org.apache.commons.lang3.StringUtils;
 import org.apache.struts2.ServletActionContext;
 import org.entando.entando.aps.system.services.actionlog.model.ActivityStreamInfo;
+import org.entando.entando.ent.util.LabelSanitizer;
 import org.entando.entando.plugins.jacms.aps.system.services.content.helper.IContentHelper;
 import org.entando.entando.plugins.jacms.aps.util.CmsPageUtil;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
@@ -134,7 +135,8 @@ public void scanEntity(IApsEntity entity, ActionSupport action) {
                 String[] args = {String.valueOf(maxLength)};
                 action.addFieldError(DESCR, action.getText("error.content.descr.wrongMaxLength", args));
             }
-            if (!descr.matches("([^\"])+")) {
+            if (!descr.matches("[^\"<>]+")) {
+                content.setDescription(LabelSanitizer.stripMarkup(content.getDescription()));
                 action.addFieldError(DESCR, action.getText("error.content.descr.wrongCharacters"));
             }
         }

engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java

@@ -1,3 +1,3 @@
 /*
  * Copyright 2015-Present Entando Inc. (http://www.entando.com) All rights reserved.
  *
@@ -59,6 +59,7 @@
 import org.apache.commons.beanutils.BeanComparator;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
+import org.entando.entando.ent.util.LabelSanitizer;
 import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
 
@@ -271,6 +272,7 @@
         if (null == entityType) {
             throw new EntException("Invalid entity type to update");
         }
+        this.sanitizeEntityTypeLabels(entityType);
         Map<String, IApsEntity> entityTypes = this.getEntityTypes();
         IApsEntity oldEntityType = entityTypes.get(entityType.getTypeCode());
         if (null == oldEntityType) {
@@ -282,6 +284,23 @@
         this.notifyEntityTypesChanging(oldEntityType, entityType, EntityTypesChangingEvent.UPDATE_OPERATION_CODE);
     }
 
+    /**
+     * Strips markup from the user-supplied label fields of an entity type (its description
+     * and the name/description of each attribute) before it is persisted
+     */
+    private void sanitizeEntityTypeLabels(IApsEntity entityType) {
+        entityType.setTypeCode(LabelSanitizer.stripMarkup(entityType.getTypeCode()));
+        entityType.setTypeDescription(LabelSanitizer.stripMarkup(entityType.getTypeDescription()));
+        List<AttributeInterface> attributes = entityType.getAttributeList();
+        if (null != attributes) {
+            for (AttributeInterface attribute : attributes) {
+                attribute.setName(LabelSanitizer.stripMarkup(attribute.getName()));
+                attribute.setDescription(LabelSanitizer.stripMarkup(attribute.getDescription()));
+                LabelSanitizer.stripMarkup(attribute.getNames());
+            }
+        }
+    }
+
     protected void verifyReloadingNeeded(IApsEntity oldEntityType, IApsEntity newEntityType) {
         if (this.getStatus(newEntityType.getTypeCode()) == STATUS_NEED_TO_RELOAD_REFERENCES) {
             return;

engine/src/main/java/com/agiletec/aps/system/services/category/CategoryManager.java

@@ -1,3 +1,3 @@
 /*
  * Copyright 2015-Present Entando Inc. (http://www.entando.com) All rights reserved.
  *
@@ -23,6 +23,7 @@
 import org.entando.entando.aps.system.services.tenants.RefreshableBeanTenantAware;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
+import org.entando.entando.ent.util.LabelSanitizer;
 import org.springframework.beans.factory.BeanFactoryUtils;
 import org.springframework.beans.factory.ListableBeanFactory;
 
@@ -82,6 +83,8 @@
 	 */
 	@Override
 	public void addCategory(Category category) throws EntException {
+		category.setCode(LabelSanitizer.stripMarkup(category.getCode()));
+		LabelSanitizer.stripMarkup(category.getTitles());
 		try {
 			this.getCategoryDAO().addCategory(category);
             this.getCacheWrapper().addCategory(category);
@@ -121,6 +124,7 @@
 	 */
 	@Override
 	public void updateCategory(Category category) throws EntException {
+		LabelSanitizer.stripMarkup(category.getTitles());
 		try {
 			this.getCategoryDAO().updateCategory(category);
             this.getCacheWrapper().updateCategory(category);

engine/src/main/java/com/agiletec/aps/system/services/group/GroupManager.java

@@ -27,6 +27,7 @@
 import org.apache.commons.beanutils.BeanComparator;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
+import org.entando.entando.ent.util.LabelSanitizer;
 
 /**
  * Servizio gestore dei gruppi.
@@ -87,6 +88,7 @@ public void releaseTenantAware() {
     @Override
     public void addGroup(Group group) throws EntException {
         try {
+            group.setDescr(LabelSanitizer.stripMarkup(group.getDescr()));
             this.getGroupDAO().addGroup(group);
             this.getCacheWrapper().addGroup(group);
         } catch (Throwable t) {
@@ -121,6 +123,7 @@ public void removeGroup(Group group) throws EntException {
     @Override
     public void updateGroup(Group group) throws EntException {
         try {
+            group.setDescr(LabelSanitizer.stripMarkup(group.getDescr()));
             this.getGroupDAO().updateGroup(group);
             this.getCacheWrapper().updateGroup(group);
         } catch (Throwable t) {

engine/src/main/java/com/agiletec/aps/system/services/page/PageManager.java

@@ -45,6 +45,7 @@
 import org.entando.entando.ent.exception.EntException;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
+import org.entando.entando.ent.util.LabelSanitizer;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 
@@ -131,6 +132,7 @@ public synchronized void deletePage(String pageCode) throws EntException {
      */
     @Override
     public synchronized void addPage(IPage page) throws EntException {
+        LabelSanitizer.stripMarkup(page.getTitles());
         try {
             IPage parent = this.getDraftPage(page.getParentCode());
             if (null == parent) {
@@ -165,6 +167,7 @@ public synchronized void addPage(IPage page) throws EntException {
      */
     @Override
     public synchronized void updatePage(IPage page) throws EntException {
+        LabelSanitizer.stripMarkup(page.getTitles());
         try {
             this.getPageDAO().updatePage(page);
             this.getCacheWrapper().updateDraftPage(page);

engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelManager.java

@@ -23,6 +23,7 @@
 import org.entando.entando.aps.system.services.guifragment.GuiFragmentUtilizer;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
+import org.entando.entando.ent.util.LabelSanitizer;
 
 import java.util.*;
 import java.util.regex.*;
@@ -87,6 +88,8 @@ public void addPageModel(PageModel pageModel) throws EntException {
             logger.debug("Null page template can be add");
             return;
         }
+        pageModel.setCode(LabelSanitizer.stripMarkup(pageModel.getCode()));
+        pageModel.setDescription(LabelSanitizer.stripMarkup(pageModel.getDescription()));
         try {
             this.getPageModelDAO().addModel(pageModel);
             this.getCacheWrapper().addPageModel(pageModel);
@@ -103,6 +106,8 @@ public void updatePageModel(PageModel pageModel) throws EntException {
             logger.debug("Null page template can be update");
             return;
         }
+        pageModel.setCode(LabelSanitizer.stripMarkup(pageModel.getCode()));
+        pageModel.setDescription(LabelSanitizer.stripMarkup(pageModel.getDescription()));
         try {
             PageModel pageModelToUpdate = this.getCacheWrapper().getPageModel(pageModel.getCode());
             if (null == pageModelToUpdate) {

engine/src/main/java/com/agiletec/aps/system/services/role/RoleManager.java

@@ -25,6 +25,7 @@
 import com.agiletec.aps.system.services.role.cache.IRoleCacheWrapper;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
+import org.entando.entando.ent.util.LabelSanitizer;
 
 /**
  * Servizio di gestione dei ruoli.
@@ -110,6 +111,7 @@ public void removeRole(Role role) throws EntException {
 	 */
 	@Override
 	public void updateRole(Role role) throws EntException {
+		role.setDescription(LabelSanitizer.stripMarkup(role.getDescription()));
 		try {
 			this.getRoleDAO().updateRole(role);
 			this.getRoleCacheWrapper().updateRole(role);
@@ -127,6 +129,7 @@ public void updateRole(Role role) throws EntException {
 	 */
 	@Override
 	public void addRole(Role role) throws EntException {
+		role.setDescription(LabelSanitizer.stripMarkup(role.getDescription()));
 		try {
 			this.getRoleDAO().addRole(role);
 			this.getRoleCacheWrapper().addRole(role);

engine/src/main/java/org/entando/entando/aps/system/services/guifragment/GuiFragmentManager.java

@@ -32,6 +32,7 @@
 import org.entando.entando.aps.system.services.guifragment.event.GuiFragmentChangedEvent;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
+import org.entando.entando.ent.util.LabelSanitizer;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.cache.annotation.CacheEvict;
@@ -128,6 +129,7 @@ protected FieldSearchFilter[] addFilter(FieldSearchFilter[] filters, FieldSearch
     @CacheEvict(value = ICacheInfoManager.DEFAULT_CACHE_NAME, key = "'GuiFragment_'.concat(#guiFragment.code)")
     public void addGuiFragment(GuiFragment guiFragment) throws EntException {
         try {
+            guiFragment.setCode(LabelSanitizer.stripMarkup(guiFragment.getCode()));
             this.getGuiFragmentDAO().insertGuiFragment(guiFragment);
             this.notifyGuiFragmentChangedEvent(guiFragment, GuiFragmentChangedEvent.INSERT_OPERATION_CODE);
             this.evictGroups();
@@ -141,6 +143,7 @@ public void addGuiFragment(GuiFragment guiFragment) throws EntException {
     @CacheEvict(value = ICacheInfoManager.DEFAULT_CACHE_NAME, key = "'GuiFragment_'.concat(#guiFragment.code)")
     public void updateGuiFragment(GuiFragment guiFragment) throws EntException {
         try {
+            guiFragment.setCode(LabelSanitizer.stripMarkup(guiFragment.getCode()));
             this.getGuiFragmentDAO().updateGuiFragment(guiFragment);
             this.notifyGuiFragmentChangedEvent(guiFragment, GuiFragmentChangedEvent.UPDATE_OPERATION_CODE);
             this.evictGroups();

engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeManager.java

@@ -30,6 +30,7 @@
 import org.entando.entando.ent.exception.EntException;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
+import org.entando.entando.ent.util.LabelSanitizer;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -120,6 +121,7 @@ public void addWidgetType(WidgetType widgetType) throws EntException {
             if (null != widgetType.getTypeParameters() && null != widgetType.getConfig()) {
                 throw new EntException("ERROR : Params not null and config not null");
             }
+            LabelSanitizer.stripMarkup(widgetType.getTitles());
             this.getWidgetTypeDAO().addWidgetType(widgetType);
             this.getCacheWrapper().addWidgetType(widgetType);
             this.notifyWidgetTypeChanging(widgetType.getCode(), WidgetTypeChangedEvent.INSERT_OPERATION_CODE);
@@ -220,6 +222,7 @@ public void updateWidgetType(String widgetTypeCode, ApsProperties titles, ApsPro
             } else {
                 readonlyPageWidgetConfigLocalVar = readonlyPageWidgetConfig;
             }
+            LabelSanitizer.stripMarkup(titles);
             this.getWidgetTypeDAO().updateWidgetType(widgetTypeCode, titles, defaultConfig, mainGroup, configUi, bundleId, readonlyPageWidgetConfigLocalVar, widgetCategory, icon);
             type.setTitles(titles);
             type.setConfig(defaultConfig);

engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java

@@ -0,0 +1,53 @@
+/*
+ * Copyright 2015-Present Entando Inc. (http://www.entando.com) All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU Lesser General Public License as published by the Free
+ * Software Foundation; either version 2.1 of the License, or (at your option)
+ * any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
+ * details.
+ */
+package org.entando.entando.ent.util;
+
+import java.util.ArrayList;
+import com.agiletec.aps.util.ApsProperties;
+
+/**
+ * Neutralizes stored XSS in short free-text <em>label</em> fields (titles, names,
+ * descriptions) by removing the characters that allow HTML element injection.
+ */
+public final class LabelSanitizer {
+
+    private LabelSanitizer() {
+    }
+
+    /**
+     * The single quote is intentionally preserved, being legitimate and common in
+     * titles/descriptions; all known attribute sinks for these fields are double-quoted.
+     * Null-safe and idempotent.
+     */
+    public static String stripMarkup(String value) {
+        return (value == null) ? null
+                : value.replace("<", "").replace(">", "").replace("\"", "");
+    }
+
+    /**
+     * Applies {@link #stripMarkup(String)} to every String value of the given properties
+     * in place (e.g. the per-language titles/names maps).
+     */
+    public static void stripMarkup(ApsProperties properties) {
+        if (null == properties) {
+            return;
+        }
+        for (Object key : new ArrayList<>(properties.keySet())) {
+            Object value = properties.get(key);
+            if (value instanceof String s) {
+                properties.put(key, stripMarkup(s));
+            }
+        }
+    }
+}