root
/
spring-framework
mirror of https://github.com/spring-projects/spring-framework.git
1
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

HtmlUtils properly escapes single quotes as well

This commit is contained in:
Juergen Hoeller 2011-07-27 21:22:04 +00:00
parent 38837eddfd
commit 2c504012ad
5 changed files with 41 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/tags/HtmlEscapeTagTests.java
View File

@ -1,12 +1,12 @@
/* /*
* Copyright 2002-2005 the original author or authors. * Copyright 2002-2011 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * http://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@ -18,8 +18,8 @@ package org.springframework.web.servlet.tags;
import javax.servlet.jsp.JspException; import javax.servlet.jsp.JspException;
import javax.servlet.jsp.PageContext; import javax.servlet.jsp.PageContext;
import javax.servlet.jsp.tagext.Tag;
import javax.servlet.jsp.tagext.BodyTag; import javax.servlet.jsp.tagext.BodyTag;
import javax.servlet.jsp.tagext.Tag;
import org.springframework.mock.web.MockServletContext; import org.springframework.mock.web.MockServletContext;
import org.springframework.web.util.WebUtils; import org.springframework.web.util.WebUtils;
@ -176,7 +176,7 @@ public class HtmlEscapeTagTests extends AbstractTagTests {
tag.setJavaScriptEscape("true"); tag.setJavaScriptEscape("true");
assertEquals(BodyTag.EVAL_BODY_BUFFERED, tag.doStartTag()); assertEquals(BodyTag.EVAL_BODY_BUFFERED, tag.doStartTag());
assertEquals(Tag.SKIP_BODY, tag.doAfterBody()); assertEquals(Tag.SKIP_BODY, tag.doAfterBody());
assertEquals("Correct content", "\\' test & text \\\\", result.toString()); assertEquals("Correct content", "' test & text \\\\", result.toString());
} }
} }

5
org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/tags/MessageTagTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2007 the original author or authors. * Copyright 2002-2011 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -19,7 +19,6 @@ package org.springframework.web.servlet.tags;
import java.util.Arrays; import java.util.Arrays;
import java.util.List; import java.util.List;
import java.util.Locale; import java.util.Locale;
import javax.servlet.ServletException; import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import javax.servlet.jsp.JspException; import javax.servlet.jsp.JspException;
@ -347,7 +346,7 @@ public class MessageTagTests extends AbstractTagTests {
tag.setHtmlEscape("true"); tag.setHtmlEscape("true");
tag.setJavaScriptEscape("true"); tag.setJavaScriptEscape("true");
assertTrue("Correct doStartTag return value", tag.doStartTag() == Tag.EVAL_BODY_INCLUDE); assertTrue("Correct doStartTag return value", tag.doStartTag() == Tag.EVAL_BODY_INCLUDE);
assertEquals("Correct message", "\\' test & text \\\\", message.toString()); assertEquals("Correct message", "' test & text \\\\", message.toString());
} }
public void testMessageWithVarAndScope() throws JspException { public void testMessageWithVarAndScope() throws JspException {

4
org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/tags/form/FormTagTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2008 the original author or authors. * Copyright 2002-2011 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -174,7 +174,7 @@ public class FormTagTests extends AbstractHtmlElementTagTests {
String xssQueryString = QUERY_STRING + "&stuff=\"><script>alert('XSS!')</script>"; String xssQueryString = QUERY_STRING + "&stuff=\"><script>alert('XSS!')</script>";
request.setQueryString(xssQueryString); request.setQueryString(xssQueryString);
tag.doStartTag(); tag.doStartTag();
assertEquals("<form id=\"command\" action=\"/my/form?foo=bar&amp;stuff=&quot;&gt;&lt;script&gt;alert('XSS!')&lt;/script&gt;\" method=\"post\">", assertEquals("<form id=\"command\" action=\"/my/form?foo=bar&amp;stuff=&quot;&gt;&lt;script&gt;alert(&#39;XSS!&#39;)&lt;/script&gt;\" method=\"post\">",
getOutput()); getOutput());
} }

23
org.springframework.web/src/test/java/org/springframework/web/bind/EscapedErrorsTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2006 the original author or authors. * Copyright 2002-2011 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -16,7 +16,7 @@
package org.springframework.web.bind; package org.springframework.web.bind;
import junit.framework.TestCase; import org.junit.Test;
import org.springframework.beans.TestBean; import org.springframework.beans.TestBean;
import org.springframework.validation.BindException; import org.springframework.validation.BindException;
@ -24,12 +24,15 @@ import org.springframework.validation.Errors;
import org.springframework.validation.FieldError; import org.springframework.validation.FieldError;
import org.springframework.validation.ObjectError; import org.springframework.validation.ObjectError;
import static org.junit.Assert.*;
/** /**
* @author Juergen Hoeller * @author Juergen Hoeller
* @since 02.05.2003 * @since 02.05.2003
*/ */
public class EscapedErrorsTests extends TestCase { public class EscapedErrorsTests {
@Test
public void testEscapedErrors() { public void testEscapedErrors() {
TestBean tb = new TestBean(); TestBean tb = new TestBean();
tb.setName("empty &"); tb.setName("empty &");
@ -47,11 +50,11 @@ public class EscapedErrorsTests extends TestCase {
assertTrue("Correct global errors flag", errors.hasGlobalErrors()); assertTrue("Correct global errors flag", errors.hasGlobalErrors());
assertTrue("Correct number of global errors", errors.getGlobalErrorCount() == 1); assertTrue("Correct number of global errors", errors.getGlobalErrorCount() == 1);
ObjectError globalError = errors.getGlobalError(); ObjectError globalError = errors.getGlobalError();
assertTrue("Global error message escaped", "message: &quot; '".equals(globalError.getDefaultMessage())); assertTrue("Global error message escaped", "message: &quot; &#39;".equals(globalError.getDefaultMessage()));
assertTrue("Global error code not escaped", "GENERAL_ERROR \" '".equals(globalError.getCode())); assertTrue("Global error code not escaped", "GENERAL_ERROR \" '".equals(globalError.getCode()));
ObjectError globalErrorInList = (ObjectError) errors.getGlobalErrors().get(0); ObjectError globalErrorInList = errors.getGlobalErrors().get(0);
assertTrue("Same global error in list", globalError.getDefaultMessage().equals(globalErrorInList.getDefaultMessage())); assertTrue("Same global error in list", globalError.getDefaultMessage().equals(globalErrorInList.getDefaultMessage()));
ObjectError globalErrorInAllList = (ObjectError) errors.getAllErrors().get(3); ObjectError globalErrorInAllList = errors.getAllErrors().get(3);
assertTrue("Same global error in list", globalError.getDefaultMessage().equals(globalErrorInAllList.getDefaultMessage())); assertTrue("Same global error in list", globalError.getDefaultMessage().equals(globalErrorInAllList.getDefaultMessage()));
assertTrue("Correct field errors flag", errors.hasFieldErrors()); assertTrue("Correct field errors flag", errors.hasFieldErrors());
@ -60,7 +63,7 @@ public class EscapedErrorsTests extends TestCase {
FieldError fieldError = errors.getFieldError(); FieldError fieldError = errors.getFieldError();
assertTrue("Field error code not escaped", "NAME_EMPTY &".equals(fieldError.getCode())); assertTrue("Field error code not escaped", "NAME_EMPTY &".equals(fieldError.getCode()));
assertTrue("Field value escaped", "empty &amp;".equals(errors.getFieldValue("name"))); assertTrue("Field value escaped", "empty &amp;".equals(errors.getFieldValue("name")));
FieldError fieldErrorInList = (FieldError) errors.getFieldErrors().get(0); FieldError fieldErrorInList = errors.getFieldErrors().get(0);
assertTrue("Same field error in list", fieldError.getDefaultMessage().equals(fieldErrorInList.getDefaultMessage())); assertTrue("Same field error in list", fieldError.getDefaultMessage().equals(fieldErrorInList.getDefaultMessage()));
assertTrue("Correct name errors flag", errors.hasFieldErrors("name")); assertTrue("Correct name errors flag", errors.hasFieldErrors("name"));
@ -70,7 +73,7 @@ public class EscapedErrorsTests extends TestCase {
assertTrue("Name error message escaped", "message: &amp;".equals(nameError.getDefaultMessage())); assertTrue("Name error message escaped", "message: &amp;".equals(nameError.getDefaultMessage()));
assertTrue("Name error code not escaped", "NAME_EMPTY &".equals(nameError.getCode())); assertTrue("Name error code not escaped", "NAME_EMPTY &".equals(nameError.getCode()));
assertTrue("Name value escaped", "empty &amp;".equals(errors.getFieldValue("name"))); assertTrue("Name value escaped", "empty &amp;".equals(errors.getFieldValue("name")));
FieldError nameErrorInList = (FieldError) errors.getFieldErrors("name").get(0); FieldError nameErrorInList = errors.getFieldErrors("name").get(0);
assertTrue("Same name error in list", nameError.getDefaultMessage().equals(nameErrorInList.getDefaultMessage())); assertTrue("Same name error in list", nameError.getDefaultMessage().equals(nameErrorInList.getDefaultMessage()));
assertTrue("Correct age errors flag", errors.hasFieldErrors("age")); assertTrue("Correct age errors flag", errors.hasFieldErrors("age"));
@ -80,9 +83,9 @@ public class EscapedErrorsTests extends TestCase {
assertTrue("Age error message escaped", "message: &lt;tag&gt;".equals(ageError.getDefaultMessage())); assertTrue("Age error message escaped", "message: &lt;tag&gt;".equals(ageError.getDefaultMessage()));
assertTrue("Age error code not escaped", "AGE_NOT_SET <tag>".equals(ageError.getCode())); assertTrue("Age error code not escaped", "AGE_NOT_SET <tag>".equals(ageError.getCode()));
assertTrue("Age value not escaped", (new Integer(0)).equals(errors.getFieldValue("age"))); assertTrue("Age value not escaped", (new Integer(0)).equals(errors.getFieldValue("age")));
FieldError ageErrorInList = (FieldError) errors.getFieldErrors("age").get(0); FieldError ageErrorInList = errors.getFieldErrors("age").get(0);
assertTrue("Same name error in list", ageError.getDefaultMessage().equals(ageErrorInList.getDefaultMessage())); assertTrue("Same name error in list", ageError.getDefaultMessage().equals(ageErrorInList.getDefaultMessage()));
FieldError ageError2 = (FieldError) errors.getFieldErrors("age").get(1); FieldError ageError2 = errors.getFieldErrors("age").get(1);
assertTrue("Age error 2 message escaped", "message: &lt;tag&gt;".equals(ageError2.getDefaultMessage())); assertTrue("Age error 2 message escaped", "message: &lt;tag&gt;".equals(ageError2.getDefaultMessage()));
assertTrue("Age error 2 code not escaped", "AGE_NOT_32 <tag>".equals(ageError2.getCode())); assertTrue("Age error 2 code not escaped", "AGE_NOT_32 <tag>".equals(ageError2.getCode()));
} }

29
org.springframework.web/src/test/java/org/springframework/web/util/HtmlCharacterEntityReferencesTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2005 the original author or authors. * Copyright 2002-2011 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -24,16 +24,19 @@ import java.io.StreamTokenizer;
import java.util.HashMap; import java.util.HashMap;
import java.util.Map; import java.util.Map;
import junit.framework.TestCase; import org.junit.Test;
import static org.junit.Assert.*;
/** /**
* @author Martin Kersten * @author Martin Kersten
* @author Juergen Hoeller * @author Juergen Hoeller
*/ */
public class HtmlCharacterEntityReferencesTests extends TestCase { public class HtmlCharacterEntityReferencesTests {
private static final String DTD_FILE = "HtmlCharacterEntityReferences.dtd"; private static final String DTD_FILE = "HtmlCharacterEntityReferences.dtd";
@Test
public void testSupportsAllCharacterEntityReferencesDefinedByHtml() { public void testSupportsAllCharacterEntityReferencesDefinedByHtml() {
HtmlCharacterEntityReferences entityReferences = new HtmlCharacterEntityReferences(); HtmlCharacterEntityReferences entityReferences = new HtmlCharacterEntityReferences();
Map referenceCharactersMap = getReferenceCharacterMap(); Map referenceCharactersMap = getReferenceCharacterMap();
@ -49,8 +52,12 @@ public class HtmlCharacterEntityReferencesTests extends TestCase {
entityReferences.isMappedToReference((char) character)); entityReferences.isMappedToReference((char) character));
assertEquals("The reference of unicode character " + character + " should be entity " + referenceName, assertEquals("The reference of unicode character " + character + " should be entity " + referenceName,
fullReference, entityReferences.convertToReference((char) character)); fullReference, entityReferences.convertToReference((char) character));
assertEquals("The entity reference [" + referenceName + "] should be mapped to unicode character " + character, assertEquals("The entity reference [" + referenceName + "] should be mapped to unicode character " +
(char) character, entityReferences.convertToCharacter(referenceName)); character, (char) character, entityReferences.convertToCharacter(referenceName));
}
else if (character == 39) {
assertTrue(entityReferences.isMappedToReference((char) character));
assertEquals("&#39;", entityReferences.convertToReference((char) character));
} }
else { else {
assertFalse("The unicode character " + character + " should not be mapped to a reference", assertFalse("The unicode character " + character + " should not be mapped to a reference",
@ -61,17 +68,17 @@ public class HtmlCharacterEntityReferencesTests extends TestCase {
} }
assertEquals("The registered entity count of entityReferences should match the number of entity references", assertEquals("The registered entity count of entityReferences should match the number of entity references",
referenceCharactersMap.size(), entityReferences.getSupportedReferenceCount()); referenceCharactersMap.size() + 1, entityReferences.getSupportedReferenceCount());
assertEquals("The HTML 4.0 Standard defines 252 entity references so do entityReferences", assertEquals("The HTML 4.0 Standard defines 252+1 entity references so do entityReferences",
252, entityReferences.getSupportedReferenceCount()); 252 + 1, entityReferences.getSupportedReferenceCount());
assertEquals("Invalid entity reference names should not be convertable", assertEquals("Invalid entity reference names should not be convertible",
(char) -1, entityReferences.convertToCharacter("invalid")); (char) -1, entityReferences.convertToCharacter("invalid"));
} }
private Map getReferenceCharacterMap() { private Map getReferenceCharacterMap() {
CharacterEntityResourceIterator entityIterator = new CharacterEntityResourceIterator(); CharacterEntityResourceIterator entityIterator = new CharacterEntityResourceIterator();
Map referencedCharactersMap = new HashMap(); Map<Integer, String> referencedCharactersMap = new HashMap<Integer, String>();
while (entityIterator.hasNext()) { while (entityIterator.hasNext()) {
int character = entityIterator.getReferredCharacter(); int character = entityIterator.getReferredCharacter();
String entityName = entityIterator.nextEntry(); String entityName = entityIterator.nextEntry();
@ -103,7 +110,7 @@ public class HtmlCharacterEntityReferencesTests extends TestCase {
} }
public boolean hasNext() { public boolean hasNext() {
return (currentEntityName != null ? true : readNextEntity()); return (currentEntityName != null || readNextEntity());
} }
public String nextEntry() { public String nextEntry() {