This is an automated email from the ASF dual-hosted git repository.
solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git
The following commit(s) were added to refs/heads/master by this push:
new b75379287 [OPENMEETINGS-2825] Appointment description is sanitized
during CalDAV import
b75379287 is described below
commit b753792878b7801c6dcaaf6f6cabd1000234ab43
Author: Maxim Solodovnik <[email protected]>
AuthorDate: Tue Aug 25 14:32:07 2026 +0700
[OPENMEETINGS-2825] Appointment description is sanitized during CalDAV
import
---
.../org/apache/openmeetings/db/mapper/CalendarMapper.java | 14 +++-----------
.../java/org/apache/openmeetings/db/util/FormatHelper.java | 13 +++++++++++++
.../openmeetings/service/calendar/caldav/IcalUtils.java | 4 ++--
3 files changed, 18 insertions(+), 13 deletions(-)
diff --git
a/openmeetings-db/src/main/java/org/apache/openmeetings/db/mapper/CalendarMapper.java
b/openmeetings-db/src/main/java/org/apache/openmeetings/db/mapper/CalendarMapper.java
index af2533672..ce69bcacd 100644
---
a/openmeetings-db/src/main/java/org/apache/openmeetings/db/mapper/CalendarMapper.java
+++
b/openmeetings-db/src/main/java/org/apache/openmeetings/db/mapper/CalendarMapper.java
@@ -18,6 +18,8 @@
*/
package org.apache.openmeetings.db.mapper;
+import static org.apache.openmeetings.db.util.FormatHelper.sanitize;
+
import java.util.ArrayList;
import java.util.List;
@@ -30,8 +32,6 @@ import org.apache.openmeetings.db.entity.calendar.Appointment;
import org.apache.openmeetings.db.entity.calendar.MeetingMember;
import org.apache.openmeetings.db.entity.user.User;
import org.apache.wicket.util.string.Strings;
-import org.owasp.html.HtmlPolicyBuilder;
-import org.owasp.html.PolicyFactory;
import org.springframework.stereotype.Component;
import jakarta.inject.Inject;
@@ -48,21 +48,13 @@ public class CalendarMapper {
private RoomMapper rMapper;
public Appointment get(AppointmentDTO dto, User u) {
- PolicyFactory pf = new HtmlPolicyBuilder()
- .allowCommonInlineFormattingElements()
- .allowCommonBlockElements()
- .allowElements("a").allowStandardUrlProtocols()
- .allowAttributes("href",
"target").onElements("a")
- .allowAttributes("size").onElements("font")
- .allowAttributes("class", "style").globally()
- .toFactory();
Appointment a = dto.getId() == null ? new Appointment() :
appointmentDao.get(dto.getId());
a.setId(dto.getId());
a.setTitle(dto.getTitle());
a.setLocation(dto.getLocation());
a.setStart(dto.getStart().getTime());
a.setEnd(dto.getEnd().getTime());
- a.setDescription(pf.sanitize(dto.getDescription()));
+ a.setDescription(sanitize(dto.getDescription()));
a.setOwner(dto.getOwner() == null ? u :
userDao.get(dto.getOwner().getId()));
a.setInserted(dto.getInserted());
a.setUpdated(dto.getUpdated());
diff --git
a/openmeetings-db/src/main/java/org/apache/openmeetings/db/util/FormatHelper.java
b/openmeetings-db/src/main/java/org/apache/openmeetings/db/util/FormatHelper.java
index e2900cc9e..43ae27a1b 100644
---
a/openmeetings-db/src/main/java/org/apache/openmeetings/db/util/FormatHelper.java
+++
b/openmeetings-db/src/main/java/org/apache/openmeetings/db/util/FormatHelper.java
@@ -24,6 +24,7 @@ import static
org.apache.openmeetings.db.util.TimezoneUtil.getTimeZone;
import org.apache.commons.lang3.time.FastDateFormat;
import org.apache.openmeetings.db.entity.user.User;
+import org.owasp.html.HtmlPolicyBuilder;
public class FormatHelper {
private FormatHelper() {}
@@ -56,4 +57,16 @@ public class FormatHelper {
public static FastDateFormat getDateTimeFormat(User u) {
return FastDateFormat.getDateTimeInstance(SHORT, SHORT,
getTimeZone(u), LocaleHelper.getLocale(u));
}
+
+ public static String sanitize(String str) {
+ return new HtmlPolicyBuilder()
+ .allowCommonInlineFormattingElements()
+ .allowCommonBlockElements()
+ .allowElements("a").allowStandardUrlProtocols()
+ .allowAttributes("href",
"target").onElements("a")
+ .allowAttributes("size").onElements("font")
+ .allowAttributes("class", "style").globally()
+ .toFactory()
+ .sanitize(str);
+ }
}
diff --git
a/openmeetings-service/src/main/java/org/apache/openmeetings/service/calendar/caldav/IcalUtils.java
b/openmeetings-service/src/main/java/org/apache/openmeetings/service/calendar/caldav/IcalUtils.java
index 395fb685b..84b8db4be 100644
---
a/openmeetings-service/src/main/java/org/apache/openmeetings/service/calendar/caldav/IcalUtils.java
+++
b/openmeetings-service/src/main/java/org/apache/openmeetings/service/calendar/caldav/IcalUtils.java
@@ -19,6 +19,7 @@
package org.apache.openmeetings.service.calendar.caldav;
import static java.util.UUID.randomUUID;
+import static org.apache.openmeetings.db.util.FormatHelper.sanitize;
import static org.apache.openmeetings.db.util.TimezoneUtil.getTimeZone;
import static org.apache.openmeetings.util.CalendarHelper.getZoneDateTime;
import static org.apache.openmeetings.util.mail.IcalHandler.TZ_REGISTRY;
@@ -164,7 +165,6 @@ public class IcalUtils {
return getDate(event.getProperty(prop).orElse(null));
}
- @SuppressWarnings("unchecked")
private Date getDate(Property prop) {
return prop == null ? null :
Date.from(Instant.from(((DateProperty<? extends Temporal>)prop).getDate()));
}
@@ -186,7 +186,7 @@ public class IcalUtils {
event.getProperty(Property.DTSTAMP).ifPresent(dtstamp ->
a.setInserted(getDate(dtstamp)));
event.getProperty(Property.LAST_MODIFIED).ifPresent(lastmod ->
a.setUpdated(getDate(lastmod)));
- event.getProperty(Property.DESCRIPTION).ifPresent(description
-> a.setDescription(description.getValue()));
+ event.getProperty(Property.DESCRIPTION).ifPresent(description
-> a.setDescription(sanitize(description.getValue())));
event.getProperty(Property.SUMMARY).ifPresent(summary ->
a.setTitle(summary.getValue()));
event.getProperty(Property.LOCATION).ifPresent(location ->
a.setLocation(location.getValue()));
