Skip to content

ESB-1144 Sanitize entity type labels #345

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ffalqui merged 1 commit into from
Jul 2, 2026
Merged

ESB-1144 Sanitize entity type labels #345

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile.tomcat
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.hub.docker.com/entando/entando-tomcat-base:7.5.0
FROM registry.hub.docker.com/entando/entando-tomcat-base:v7.5.1-ESB-1170-PR-37-BB-release-2F-7.5
ARG VERSION

### Required OpenShift Labels
Expand Down
4 changes: 2 additions & 2 deletions admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
<%@ taglib prefix="s" uri="/struts-tags" %>
<s:if test="#lang.default">
<s:property value="%{#attribute.getText()}" />
<s:property value="%{#attribute.getText()}" escapeHtml="true" />
</s:if>
<s:else>
<s:if test="#attributeTracer.listElement">
<s:property value="%{#attribute.getText()}" />
<s:property value="%{#attribute.getText()}" escapeHtml="true" />
</s:if>
<s:else>
<s:text name="EntityAttribute.monolang.defaultValue" />
Expand Down
8 changes: 4 additions & 4 deletions admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/enumeratorMapAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,16 @@
<s:if test="#lang.default">
<s:if test="%{null == #attribute.getMapKey()}" >&ndash;</s:if>
<s:else>
<p><label><s:text name="label.key" /></label>:&#32;<s:property value="%{#attribute.getMapKey()}" /></p>
<p><label><s:text name="label.value" /></label>:&#32;<s:property value="%{#attribute.getMapValue()}" /></p>
<p><label><s:text name="label.key" /></label>:&#32;<s:property value="#attribute.getMapKey()" escapeHtml="true" /></p>
<p><label><s:text name="label.value" /></label>:&#32;<s:property value="#attribute.getMapValue()" escapeHtml="true" /></p>
</s:else>
</s:if>
<s:else>
<s:if test="#attributeTracer.listElement">
<s:if test="%{null == #attribute.getMapKey()}" >&ndash;</s:if>
<s:else>
<p><label><s:text name="label.key" /></label>:&#32;<s:property value="%{#attribute.getMapKey()}" /></p>
<p><label><s:text name="label.value" /></label>:&#32;<s:property value="%{#attribute.getMapValue()}" /></p>
<p><label><s:text name="label.key" /></label>:&#32;<s:property value="#attribute.getMapKey()" escapeHtml="true" /></p>
<p><label><s:text name="label.value" /></label>:&#32;<s:property value="#attribute.getMapValue()" escapeHtml="true" /></p>
</s:else>
</s:if>
<s:else>
Expand Down
2 changes: 1 addition & 1 deletion admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/hypertextAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
<%@ taglib prefix="s" uri="/struts-tags" %>
<s:property value="#attribute.getTextForLang(#lang.code)" escapeHtml="false" />
<s:property value="#attribute.getTextForLang(#lang.code)" escapeHtml="true" />
2 changes: 1 addition & 1 deletion admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/longtextAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
<%@ taglib prefix="s" uri="/struts-tags" %>
<s:property value="%{#attribute.getTextForLang(#lang.code)}" />
<s:property value="#attribute.getTextForLang(#lang.code)" escapeHtml="true" />
2 changes: 1 addition & 1 deletion admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/view/textAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
<%@ taglib prefix="s" uri="/struts-tags" %>
<s:property value="%{#attribute.getTextForLang(#lang.code)}" />
<s:property value="#attribute.getTextForLang(#lang.code)" escapeHtml="true" />
2 changes: 1 addition & 1 deletion cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/contentDetails.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,7 +328,7 @@
</s:if>
<s:else>
<div class="text-muted">
<s:property value="#attribute.getText()" />
<s:property value="#attribute.getText()" escapeHtml="true" />
</div>
</s:else>
</s:else>
Expand Down
6 changes: 3 additions & 3 deletions ...plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/imageAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
<img
class="img-thumbnail"
src="<s:property value="#defaultResource.getImagePath('1')"/>"
alt="<s:property value="#defaultResource.descr"/>" />
alt="<s:property value="#defaultResource.descr"/>" escapeHtml="true" />
<span class="sr-only">
<abbr
title="<s:text name="label.img.text.long" />">
Expand All @@ -27,7 +27,7 @@
</s:if>
<s:else>
<s:if test="#currentResource != null">
<img class="img-thumbnail" src="<s:property value="#currentResource.getImagePath('1')"/>" alt="<s:property value="#currentResource.descr"/>" />
<img class="img-thumbnail" src="<s:property value="#currentResource.getImagePath('1')"/>" alt="<s:property value="#currentResource.descr" escapeHtml="true" />" />
<span class="sr-only">
<abbr title="<s:text name="label.img.text.long" />"> <s:text name="label.img.text.short" /></abbr>:&#32;
</span>
Expand All @@ -36,7 +36,7 @@
<img
class="img-thumbnail"
src="<s:property value="#defaultResource.getImagePath('1')"/>"
alt="<s:property value="#defaultResource.descr"/>" />
alt="<s:property value="#defaultResource.descr" escapeHtml="true" />" />
<span class="sr-only">
<abbr
title="<s:text name="label.img.text.long" />">
Expand Down
4 changes: 2 additions & 2 deletions cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/apsadmin/jsp/content/view/linkAttribute.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,10 @@
<s:set var="linkDestination" value="%{getText('note.contentLinkTo') + ': ' + #linkToEdit.contentDestination + ' - ' + #linkedContent.descr + ', ' + getText('note.contentOnPageLinkTo') + ': ' + #linkedPage.titles[currentLang.code]}" />
</s:elseif>
<%-- link icon --%>
<a href="<s:property value="#linkToEdit.contentDestination" />" class="<s:property value="#statusIconVar" />" title="<s:property value="#linkDestination" />"><span class="sr-only"><s:property value="#linkDestination" /></span></a>
<a href="<s:property value="#linkToEdit.contentDestination" />" class="<s:property value="#statusIconVar" />" title="<s:property value="#linkDestination" escapeHtml="true" />"><span class="sr-only"><s:property value="#linkDestination" escapeHtml="true" /></span></a>
<%-- text of the link --%>
<s:if test="%{#attribute.getTextForLang(#lang.code)==null}">
<span class="text-muted">&#32;<s:property value="#attribute.getText()" /></span>
<span class="text-muted">&#32;<s:property value="#attribute.getText()" escapeHtml="true" /></span>
</s:if>
<s:else>
&#32;<s:include value="/WEB-INF/apsadmin/jsp/entity/view/textAttribute.jsp" />
Expand Down
1 change: 1 addition & 0 deletions engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,6 +255,7 @@ public void addEntityPrototype(IApsEntity entityType) throws EntException {
if (null == entityType) {
throw new EntException("Invalid entity type to add");
}
this.sanitizeEntityTypeLabels(entityType);
Map<String, IApsEntity> newEntityTypes = this.getEntityTypes();
newEntityTypes.put(entityType.getTypeCode(), entityType);
this.updateEntityPrototypes(newEntityTypes);
Expand Down
7 changes: 6 additions & 1 deletion engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,12 @@ private LabelSanitizer() {
*/
public static String stripMarkup(String value) {
return (value == null) ? null
: value.replace("<", "").replace(">", "").replace("\"", "");
: value.replace("<", "")
.replace(">", "")
.replace("\"", "")
.replace("&lt;", "")
.replace("&gt;", "")
.replace("&quot;", "");
}

/**
Expand Down
Loading