Re: svn commit: r1859877 - in /ofbiz/ofbiz-framework/trunk: applications/accounting/servicedef/ applications/content/servicedef/ applications/marketing/servicedef/ applications/order/servicedef/ applications/party/servicedef/ applications/product/servicede...

[Mathieu Lirzin]

Hello Jacques,

[hidden email] writes:

> Author: jleroux
> Date: Fri May 24 13:47:08 2019
> New Revision: 1859877
>
> URL: http://svn.apache.org/viewvc?rev=1859877&view=rev
> Log:
> Fixed: Services allow arbitrary HTML for parameters with allow-html set to "safe"
> (OFBIZ-5254)
>
> This was reopened after discussion at
> https://markmail.org/message/jnaitmwahjcjmdn5
>
> This is a new solution which follows the work done with and OFBIZ-10187
> Roughly said, it uses org.owasp.html.PolicyFactory and org.owasp.html.Sanitizers
>
> Thanks: Christoph Neuroth for report

This commit breaks the “custrequesttests” test suite with a vanilla
framework after ‘loadAll’. If the issue can not be solved tomorrow
please revert.

Thanks.

--
Mathieu Lirzin
GPG: F2A3 8D7E EB2B 6640 5761  070D 0ADE E100 9460 4D37

[Jacques Le Roux]

Hi Mathieu,

You mean when ran isolated, right?

Because https://ci.apache.org/builders/ofbizTrunkFrameworkPlugins is OK

Thanks

Jacques

Le 24/05/2019 à 23:50, Mathieu Lirzin a écrit :

> Hello Jacques,
>
> [hidden email] writes:
>
>> Author: jleroux
>> Date: Fri May 24 13:47:08 2019
>> New Revision: 1859877
>>
>> URL: http://svn.apache.org/viewvc?rev=1859877&view=rev
>> Log:
>> Fixed: Services allow arbitrary HTML for parameters with allow-html set to "safe"
>> (OFBIZ-5254)
>>
>> This was reopened after discussion at
>> https://markmail.org/message/jnaitmwahjcjmdn5
>>
>> This is a new solution which follows the work done with and OFBIZ-10187
>> Roughly said, it uses org.owasp.html.PolicyFactory and org.owasp.html.Sanitizers
>>
>> Thanks: Christoph Neuroth for report
> This commit breaks the “custrequesttests” test suite with a vanilla
> framework after ‘loadAll’. If the issue can not be solved tomorrow
> please revert.
>
> Thanks.
>

[Jacques Le Roux]

Le 25/05/2019 à 08:54, Jacques Le Roux a écrit :
> You mean when ran isolated, right?

OK, got it, it's a framework only issue

https://ci.apache.org/projects/ofbiz/logs/trunk/framework/html/

Looking at it...

Jacques

[Jacques Le Roux]

Le 25/05/2019 à 09:07, Jacques Le Roux a écrit :

> Le 25/05/2019 à 08:54, Jacques Le Roux a écrit :
>> You mean when ran isolated, right?
>
> OK, got it, it's a framework only issue
>
> https://ci.apache.org/projects/ofbiz/logs/trunk/framework/html/
>
> Looking at it...
>
> Jacques

This is due to the simple quote in

subject="OFBiz - Your Request is received: '${custRequestName}' #CR${custRequestId}"/>

in OrderTypeData.xml

I have yet not idea why the CustomSafePolicy class (based on Slashdot policy) rejects it, seems weird to me.

It's also (even more) weird that when the plugins data are loaded the issue does not exist

Jacques

[Mathieu Lirzin]

Hello,

Jacques Le Roux <[hidden email]> writes:

> Le 25/05/2019 à 09:07, Jacques Le Roux a écrit :
>> Le 25/05/2019 à 08:54, Jacques Le Roux a écrit :
>>> You mean when ran isolated, right?
>>
>> OK, got it, it's a framework only issue
>>
>> https://ci.apache.org/projects/ofbiz/logs/trunk/framework/html/
>>
>> Looking at it...
>>
>> Jacques
>
> This is due to the simple quote in
>
> subject="OFBiz - Your Request is received: '${custRequestName}' #CR${custRequestId}"/>
>
> in OrderTypeData.xml
>
> I have yet not idea why the CustomSafePolicy class (based on Slashdot policy) rejects it, seems weird to me.
>
> It's also (even more) weird that when the plugins data are loaded the issue does not exist

Indeed this is weird, thanks for investigating!

--
Mathieu Lirzin
GPG: F2A3 8D7E EB2B 6640 5761  070D 0ADE E100 9460 4D37

[Jacques Le Roux]

Le 25/05/2019 à 11:01, Mathieu Lirzin a écrit :

> Hello,
>
> Jacques Le Roux <[hidden email]> writes:
>
>> Le 25/05/2019 à 09:07, Jacques Le Roux a écrit :
>>> Le 25/05/2019 à 08:54, Jacques Le Roux a écrit :
>>>> You mean when ran isolated, right?
>>> OK, got it, it's a framework only issue
>>>
>>> https://ci.apache.org/projects/ofbiz/logs/trunk/framework/html/
>>>
>>> Looking at it...
>>>
>>> Jacques
>> This is due to the simple quote in
>>
>> subject="OFBiz - Your Request is received: '${custRequestName}' #CR${custRequestId}"/>
>>
>> in OrderTypeData.xml
>>
>> I have yet not idea why the CustomSafePolicy class (based on Slashdot policy) rejects it, seems weird to me.
>>
>> It's also (even more) weird that when the plugins data are loaded the issue does not exist
> Indeed this is weird, thanks for investigating!

This was a peculiar case that could be generalised to all escapable characters. The general solution is to compare the original value with the
filtered value unescaped in UtilCodec::checkStringForHtmlSafe.
BTW, weirdly enough StringEscapeUtils::escapeHtml4 does not escape single quote.

Another weirdness is the test was passing with plugins data loaded. This is due to duplicated demo data in scrumTypeData.xml (which is actually not
only type data)

As ever the scrum component is a mess, that's not new and I always wonder if we should not get rid of it! I guess there are plenty of good tools
outside...

Jacques