svn commit: r1494948 - in /cocoon/site/site: 2.1/apidocs/ 2.2/maven-plugins/it-fw/1.0/apidocs/ 2.2/maven-plugins/maven-plugin/1.0/apidocs/ 3.0/apidocs/ subprojects/servlet-service/servlet-service-impl/apidocs/ subprojects/servlet-service/servlet-servic...

[email protected]
Newsgroups gmane.text.xml.cocoon.cvs
Message-ID <[email protected]> 
Author: ilgrosso
Date: Thu Jun 20 12:09:40 2013
New Revision: 1494948

URL: http://svn.apache.org/r1494948
Log:
Fixing 'Frame injection vulnerability in published Javadoc'

Modified:
    cocoon/site/site/2.1/apidocs/index.html
    cocoon/site/site/2.2/maven-plugins/it-fw/1.0/apidocs/index.html
    cocoon/site/site/2.2/maven-plugins/maven-plugin/1.0/apidocs/index.html
    cocoon/site/site/3.0/apidocs/index.html
    cocoon/site/site/subprojects/servlet-service/servlet-service-impl/apidocs/index.html
    cocoon/site/site/subprojects/servlet-service/servlet-service-impl/testapidocs/index.html

Modified: cocoon/site/site/2.1/apidocs/index.html
URL: http://svn.apache.org/viewvc/cocoon/site/site/2.1/apidocs/index.html?rev=1494948&r1=1494947&r2=1494948&view=diff
==============================================================================
--- cocoon/site/site/2.1/apidocs/index.html (original)
+++ cocoon/site/site/2.1/apidocs/index.html Thu Jun 20 12:09:40 2013
@@ -12,6 +12,42 @@ Cocoon API 2.1.12-dev [March 20 2012]
         targetPage = targetPage.substring(1);
     if (targetPage.indexOf(":") != -1)
         targetPage = "undefined";
+    if (targetPage != "" && !validURL(targetPage))
+        targetPage = "undefined";
+    function validURL(url) {
+        var pos = url.indexOf(".html");
+        if (pos == -1 || pos != url.length - 5)
+            return false;
+        var allowNumber = false;
+        var allowSep = false;
+        var seenDot = false;
+        for (var i = 0; i < url.length - 5; i++) {
+            var ch = url.charAt(i);
+            if ('a' <= ch && ch <= 'z' ||
+                    'A' <= ch && ch <= 'Z' ||
+                    ch == '$' ||
+                    ch == '_') {
+                allowNumber = true;
+                allowSep = true;
+            } else if ('0' <= ch && ch <= '9'
+                    || ch == '-') {
+                if (!allowNumber)
+                     return false;
+            } else if (ch == '/' || ch == '.') {
+                if (!allowSep)
+                    return false;
+                allowNumber = false;
+                allowSep = false;
+                if (ch == '.')
+                     seenDot = true;
+                if (ch == '/' && seenDot)
+                     return false;
+            } else {
+                return false;
+            }
+        }
+        return true;
+    }
     function loadFrames() {
         if (targetPage != "" && targetPage != "undefined")
              top.classFrame.location = top.targetPage;

Modified: cocoon/site/site/2.2/maven-plugins/it-fw/1.0/apidocs/index.html
URL: http://svn.apache.org/viewvc/cocoon/site/site/2.2/maven-plugins/it-fw/1.0/apidocs/index.html?rev=1494948&r1=1494947&r2=1494948&view=diff
==============================================================================
--- cocoon/site/site/2.2/maven-plugins/it-fw/1.0/apidocs/index.html (original)
+++ cocoon/site/site/2.2/maven-plugins/it-fw/1.0/apidocs/index.html Thu Jun 20 12:09:40 2013
@@ -13,6 +13,42 @@ Cocoon Integration Test Framework [maven
         targetPage = targetPage.substring(1);
     if (targetPage.indexOf(":") != -1)
         targetPage = "undefined";
+    if (targetPage != "" && !validURL(targetPage))
+        targetPage = "undefined";
+    function validURL(url) {
+        var pos = url.indexOf(".html");
+        if (pos == -1 || pos != url.length - 5)
+            return false;
+        var allowNumber = false;
+        var allowSep = false;
+        var seenDot = false;
+        for (var i = 0; i < url.length - 5; i++) {
+            var ch = url.charAt(i);
+            if ('a' <= ch && ch <= 'z' ||
+                    'A' <= ch && ch <= 'Z' ||
+                    ch == '$' ||
+                    ch == '_') {
+                allowNumber = true;
+                allowSep = true;
+            } else if ('0' <= ch && ch <= '9'
+                    || ch == '-') {
+                if (!allowNumber)
+                     return false;
+            } else if (ch == '/' || ch == '.') {
+                if (!allowSep)
+                    return false;
+                allowNumber = false;
+                allowSep = false;
+                if (ch == '.')
+                     seenDot = true;
+                if (ch == '/' && seenDot)
+                     return false;
+            } else {
+                return false;
+            }
+        }
+        return true;
+    }
     function loadFrames() {
         if (targetPage != "" && targetPage != "undefined")
              top.classFrame.location = top.targetPage;

Modified: cocoon/site/site/2.2/maven-plugins/maven-plugin/1.0/apidocs/index.html
URL: http://svn.apache.org/viewvc/cocoon/site/site/2.2/maven-plugins/maven-plugin/1.0/apidocs/index.html?rev=1494948&r1=1494947&r2=1494948&view=diff
==============================================================================
--- cocoon/site/site/2.2/maven-plugins/maven-plugin/1.0/apidocs/index.html (original)
+++ cocoon/site/site/2.2/maven-plugins/maven-plugin/1.0/apidocs/index.html Thu Jun 20 12:09:40 2013
@@ -13,6 +13,42 @@ Cocoon Maven Plugin 1.0.2 API
         targetPage = targetPage.substring(1);
     if (targetPage.indexOf(":") != -1)
         targetPage = "undefined";
+    if (targetPage != "" && !validURL(targetPage))
+        targetPage = "undefined";
+    function validURL(url) {
+        var pos = url.indexOf(".html");
+        if (pos == -1 || pos != url.length - 5)
+            return false;
+        var allowNumber = false;
+        var allowSep = false;
+        var seenDot = false;
+        for (var i = 0; i < url.length - 5; i++) {
+            var ch = url.charAt(i);
+            if ('a' <= ch && ch <= 'z' ||
+                    'A' <= ch && ch <= 'Z' ||
+                    ch == '$' ||
+                    ch == '_') {
+                allowNumber = true;
+                allowSep = true;
+            } else if ('0' <= ch && ch <= '9'
+                    || ch == '-') {
+                if (!allowNumber)
+                     return false;
+            } else if (ch == '/' || ch == '.') {
+                if (!allowSep)
+                    return false;
+                allowNumber = false;
+                allowSep = false;
+                if (ch == '.')
+                     seenDot = true;
+                if (ch == '/' && seenDot)
+                     return false;
+            } else {
+                return false;
+            }
+        }
+        return true;
+    }
     function loadFrames() {
         if (targetPage != "" && targetPage != "undefined")
              top.classFrame.location = top.targetPage;

Modified: cocoon/site/site/3.0/apidocs/index.html
URL: http://svn.apache.org/viewvc/cocoon/site/site/3.0/apidocs/index.html?rev=1494948&r1=1494947&r2=1494948&view=diff
==============================================================================
--- cocoon/site/site/3.0/apidocs/index.html (original)
+++ cocoon/site/site/3.0/apidocs/index.html Thu Jun 20 12:09:40 2013
@@ -13,6 +13,42 @@ Apache Cocoon 3: Parent 3.0.0-beta-1-SNA
         targetPage = targetPage.substring(1);
     if (targetPage.indexOf(":") != -1)
         targetPage = "undefined";
+    if (targetPage != "" && !validURL(targetPage))
+        targetPage = "undefined";
+    function validURL(url) {
+        var pos = url.indexOf(".html");
+        if (pos == -1 || pos != url.length - 5)
+            return false;
+        var allowNumber = false;
+        var allowSep = false;
+        var seenDot = false;
+        for (var i = 0; i < url.length - 5; i++) {
+            var ch = url.charAt(i);
+            if ('a' <= ch && ch <= 'z' ||
+                    'A' <= ch && ch <= 'Z' ||
+                    ch == '$' ||
+                    ch == '_') {
+                allowNumber = true;
+                allowSep = true;
+            } else if ('0' <= ch && ch <= '9'
+                    || ch == '-') {
+                if (!allowNumber)
+                     return false;
+            } else if (ch == '/' || ch == '.') {
+                if (!allowSep)
+                    return false;
+                allowNumber = false;
+                allowSep = false;
+                if (ch == '.')
+                     seenDot = true;
+                if (ch == '/' && seenDot)
+                     return false;
+            } else {
+                return false;
+            }
+        }
+        return true;
+    }
     function loadFrames() {
         if (targetPage != "" && targetPage != "undefined")
              top.classFrame.location = top.targetPage;

Modified: cocoon/site/site/subprojects/servlet-service/servlet-service-impl/apidocs/index.html
URL: http://svn.apache.org/viewvc/cocoon/site/site/subprojects/servlet-service/servlet-service-impl/apidocs/index.html?rev=1494948&r1=1494947&r2=1494948&view=diff
==============================================================================
--- cocoon/site/site/subprojects/servlet-service/servlet-service-impl/apidocs/index.html (original)
+++ cocoon/site/site/subprojects/servlet-service/servlet-service-impl/apidocs/index.html Thu Jun 20 12:09:40 2013
@@ -13,6 +13,42 @@ Cocoon Servlet Service Implementation 1.
         targetPage = targetPage.substring(1);
     if (targetPage.indexOf(":") != -1)
         targetPage = "undefined";
+    if (targetPage != "" && !validURL(targetPage))
+        targetPage = "undefined";
+    function validURL(url) {
+        var pos = url.indexOf(".html");
+        if (pos == -1 || pos != url.length - 5)
+            return false;
+        var allowNumber = false;
+        var allowSep = false;
+        var seenDot = false;
+        for (var i = 0; i < url.length - 5; i++) {
+            var ch = url.charAt(i);
+            if ('a' <= ch && ch <= 'z' ||
+                    'A' <= ch && ch <= 'Z' ||
+                    ch == '$' ||
+                    ch == '_') {
+                allowNumber = true;
+                allowSep = true;
+            } else if ('0' <= ch && ch <= '9'
+                    || ch == '-') {
+                if (!allowNumber)
+                     return false;
+            } else if (ch == '/' || ch == '.') {
+                if (!allowSep)
+                    return false;
+                allowNumber = false;
+                allowSep = false;
+                if (ch == '.')
+                     seenDot = true;
+                if (ch == '/' && seenDot)
+                     return false;
+            } else {
+                return false;
+            }
+        }
+        return true;
+    }
     function loadFrames() {
         if (targetPage != "" && targetPage != "undefined")
              top.classFrame.location = top.targetPage;

Modified: cocoon/site/site/subprojects/servlet-service/servlet-service-impl/testapidocs/index.html
URL: http://svn.apache.org/viewvc/cocoon/site/site/subprojects/servlet-service/servlet-service-impl/testapidocs/index.html?rev=1494948&r1=1494947&r2=1494948&view=diff
==============================================================================
--- cocoon/site/site/subprojects/servlet-service/servlet-service-impl/testapidocs/index.html (original)
+++ cocoon/site/site/subprojects/servlet-service/servlet-service-impl/testapidocs/index.html Thu Jun 20 12:09:40 2013
@@ -13,6 +13,42 @@ Cocoon Servlet Service Implementation 1.
         targetPage = targetPage.substring(1);
     if (targetPage.indexOf(":") != -1)
         targetPage = "undefined";
+    if (targetPage != "" && !validURL(targetPage))
+        targetPage = "undefined";
+    function validURL(url) {
+        var pos = url.indexOf(".html");
+        if (pos == -1 || pos != url.length - 5)
+            return false;
+        var allowNumber = false;
+        var allowSep = false;
+        var seenDot = false;
+        for (var i = 0; i < url.length - 5; i++) {
+            var ch = url.charAt(i);
+            if ('a' <= ch && ch <= 'z' ||
+                    'A' <= ch && ch <= 'Z' ||
+                    ch == '$' ||
+                    ch == '_') {
+                allowNumber = true;
+                allowSep = true;
+            } else if ('0' <= ch && ch <= '9'
+                    || ch == '-') {
+                if (!allowNumber)
+                     return false;
+            } else if (ch == '/' || ch == '.') {
+                if (!allowSep)
+                    return false;
+                allowNumber = false;
+                allowSep = false;
+                if (ch == '.')
+                     seenDot = true;
+                if (ch == '/' && seenDot)
+                     return false;
+            } else {
+                return false;
+            }
+        }
+        return true;
+    }
     function loadFrames() {
         if (targetPage != "" && targetPage != "undefined")
              top.classFrame.location = top.targetPage;
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.