Hi Jacques,
I am getting following exception on 14.12:
{code}
java.lang.NoClassDefFoundError: Could not initialize class
org.owasp.html.Sanitizers
[java] at
org.ofbiz.content.content.ContentWorker.renderContentAsText(ContentWorker.java:354)
~[ofbiz-content.jar:?]
[java] at
org.ofbiz.content.content.ContentMapFacade.renderThis(ContentMapFacade.java:343)
~[ofbiz-content.jar:?]
[java] at
org.ofbiz.content.content.ContentMapFacade.toString(ContentMapFacade.java:355)
~[ofbiz-content.jar:?]
[java] at
freemarker.ext.beans.StringModel.getAsString(StringModel.java:61)
~[freemarker-2.3.22.jar:2.3.22]
[java] at freemarker.core.EvalUtil.modelToString(EvalUtil.java:55)
~[freemarker-2.3.22.jar:2.3.22]
[java] at
freemarker.core.EvalUtil.coerceModelToString(EvalUtil.java:340)
~[freemarker-2.3.22.jar:2.3.22]
{code}
Thanks & Regards
--
Deepak Dixit
www.hotwaxsystems.com
On Tue, Oct 13, 2015 at 6:15 AM, <jler...@apache.org> wrote:
> Author: jleroux
> Date: Tue Oct 13 00:45:31 2015
> New Revision: 1708275
>
> URL: http://svn.apache.org/viewvc?rev=1708275&view=rev
> Log:
> "Applied fix from trunk for revision: 1708274 " (handled conflicts on
> .classpath by hand)
> ------------------------------------------------------------------------
> r1708274 | jleroux | 2015-10-13 02:40:47 +0200 (mar. 13 oct. 2015) | 1
> ligne
>
> Fix for ContentWorker at OFBIZ-6669. For that I have added
> owasp-java-html-sanitizer-r239.jar and put a "content.sanitize=true"
> property in content.properties with some explanations. The reason I put
> this property is because the sanitizer does some (safe) changes which might
> be unwanted in a context where you are "sure" no one can inject/exploit
> your DB, see the JIra issue for details. Note that this does not affect the
> *ContentWrapper.java classes where we use OWASP encoding and not sanitizer.
> The reason we need the sanitizer here is because we are no only handling
> content but also HTML code...
> ------------------------------------------------------------------------
>
>
> Added:
>
> ofbiz/branches/release14.12/framework/base/lib/owasp-java-html-sanitizer-r239.jar
> - copied unchanged from r1708274,
> ofbiz/trunk/framework/base/lib/owasp-java-html-sanitizer-r239.jar
> Modified:
> ofbiz/branches/release14.12/ (props changed)
> ofbiz/branches/release14.12/.classpath
> ofbiz/branches/release14.12/LICENSE
>
> ofbiz/branches/release14.12/applications/content/config/content.properties
>
> ofbiz/branches/release14.12/applications/content/src/org/ofbiz/content/content/ContentWorker.java
>
> ofbiz/branches/release14.12/specialpurpose/cmssite/data/CmsSiteDemoData.xml
>
> Propchange: ofbiz/branches/release14.12/
>
> ------------------------------------------------------------------------------
> --- svn:mergeinfo (original)
> +++ svn:mergeinfo Tue Oct 13 00:45:31 2015
> @@ -8,4 +8,4 @@
> /ofbiz/branches/json-integration-refactoring:1634077-1635900
> /ofbiz/branches/multitenant20100310:921280-927264
> /ofbiz/branches/release13.07:1547657
>
> -/ofbiz/trunk:1649072,1649083-1649084,1649086,1649090,1649096,1649230,1649238-1649239,1649248,1649272,1649275,1649280-1649281,1649283,1649285-1649286,1649291,1649329,1649331,1649384,1649393,1649666,1649742,1650240,1650348,1650357,1650583,1650642,1650678,1650821,1650882,1650887,1650938,1651593,1652312,1652361,1652638,1652641,1652672,1652688,1652706,1652725,1652731,1652739,1652852,1653248,1653296,1653456,1653597,1653614,1654175,1654273,1654509,1654670,1654672-1654673,1654683-1654684,1654824,1655046,1655668,1655979,1656014,1656185,1656198,1656445,1656983,1657323,1657506-1657507,1657514,1657714,1657790,1657848,1658364,1658662,1658882,1659224,1659965,1660031,1660053,1660389,1660444,1660579,1661303,1661328,1661760,1661778,1661853,1661862,1661873,1661940,1661951,1661977,1662119-1662120,1662361,1662500,1662812,1662919,1663202,1663912,1663979,1664602,1664604,1664696,1665154,1665162,1665535,1666404,1666511,1666633,1666836,1666939,1666949,1666958,1667055,1667253,1667483,1667492,1667774,1668207,
>
>
> 1668214,1668236,1668246,1668258,1668263,1668265,1668270,1668277,1668314,1668657,1669317,1669588,1672427,1672430,1672846,1672853,1672856,1672862,1672873,1673764,1674447,1674464,1674491,1674496,1674908,1676674,1677123,1677597,1677769-1677770,1678294,1678882,1678911,1679689,1679697,1679709,1679720,1679728,1679732,1679957,1680155,1680288,1680304,1680671,1680675,1680733,1680840,1680881,1682272,1682295,1682415,1682633,1683998,1684094,1686360,1686536,1686545,1686566,1686569,1686574,1686583,1686635,1686651,1686970,1687427,1688772,1690086,1690581,1692357,1692458,1692600,1692604,1693393,1693579,1695017,1696018,1696234,1697590,1697647,1697993,1698259,1698261,1698263,1701164,1701441,1701819,1701825,1701936,1702002,1702548,1702704,1703121,1703586,1703945,1703954,1703965,1703971,1703976-1703977,1703981,1704000,1704014,1704018,1704036,1704043,1704052,1704082,1704140,1704230,1705004,1705329,1705405,1705412,1705417,1705427,1705532,1706159,1706162,1706316,1706531,1706549,1706553,1706561,1706569,17065
> 77,1706591,1706694,1707837,1707857
>
> +/ofbiz/trunk:1649072,1649083-1649084,1649086,1649090,1649096,1649230,1649238-1649239,1649248,1649272,1649275,1649280-1649281,1649283,1649285-1649286,1649291,1649329,1649331,1649384,1649393,1649666,1649742,1650240,1650348,1650357,1650583,1650642,1650678,1650821,1650882,1650887,1650938,1651593,1652312,1652361,1652638,1652641,1652672,1652688,1652706,1652725,1652731,1652739,1652852,1653248,1653296,1653456,1653597,1653614,1654175,1654273,1654509,1654670,1654672-1654673,1654683-1654684,1654824,1655046,1655668,1655979,1656014,1656185,1656198,1656445,1656983,1657323,1657506-1657507,1657514,1657714,1657790,1657848,1658364,1658662,1658882,1659224,1659965,1660031,1660053,1660389,1660444,1660579,1661303,1661328,1661760,1661778,1661853,1661862,1661873,1661940,1661951,1661977,1662119-1662120,1662361,1662500,1662812,1662919,1663202,1663912,1663979,1664602,1664604,1664696,1665154,1665162,1665535,1666404,1666511,1666633,1666836,1666939,1666949,1666958,1667055,1667253,1667483,1667492,1667774,1668207,
>
>
> 1668214,1668236,1668246,1668258,1668263,1668265,1668270,1668277,1668314,1668657,1669317,1669588,1672427,1672430,1672846,1672853,1672856,1672862,1672873,1673764,1674447,1674464,1674491,1674496,1674908,1676674,1677123,1677597,1677769-1677770,1678294,1678882,1678911,1679689,1679697,1679709,1679720,1679728,1679732,1679957,1680155,1680288,1680304,1680671,1680675,1680733,1680840,1680881,1682272,1682295,1682415,1682633,1683998,1684094,1686360,1686536,1686545,1686566,1686569,1686574,1686583,1686635,1686651,1686970,1687427,1688772,1690086,1690581,1692357,1692458,1692600,1692604,1693393,1693579,1695017,1696018,1696234,1697590,1697647,1697993,1698259,1698261,1698263,1701164,1701441,1701819,1701825,1701936,1702002,1702548,1702704,1703121,1703586,1703945,1703954,1703965,1703971,1703976-1703977,1703981,1704000,1704014,1704018,1704036,1704043,1704052,1704082,1704140,1704230,1705004,1705329,1705405,1705412,1705417,1705427,1705532,1706159,1706162,1706316,1706531,1706549,1706553,1706561,1706569,17065
> 77,1706591,1706694,1707837,1707857,1708274
>
> Modified: ofbiz/branches/release14.12/.classpath
> URL:
> http://svn.apache.org/viewvc/ofbiz/branches/release14.12/.classpath?rev=1708275&r1=1708274&r2=1708275&view=diff
>
> ==============================================================================
> --- ofbiz/branches/release14.12/.classpath (original)
> +++ ofbiz/branches/release14.12/.classpath Tue Oct 13 00:45:31 2015
> @@ -41,6 +41,7 @@
> <classpathentry kind="lib"
> path="framework/base/lib/log4j-api-2.3.jar"/>
> <classpathentry kind="lib" path="framework/base/lib/mail-1.5.1.jar"/>
> <classpathentry kind="lib"
> path="framework/base/lib/nekohtml-1.9.16.jar"/>
> + <classpathentry kind="lib"
> path="framework/base/lib/owasp-java-html-sanitizer-r239.jar"/>
> <classpathentry kind="lib" path="framework/base/lib/esapi-2.1.0.jar"/>
> <classpathentry kind="lib"
> path="framework/base/lib/resolver-2.9.1.jar"/>
> <classpathentry kind="lib"
> path="framework/base/lib/serializer-2.9.1.jar"/>
>
> Modified: ofbiz/branches/release14.12/LICENSE
> URL:
> http://svn.apache.org/viewvc/ofbiz/branches/release14.12/LICENSE?rev=1708275&r1=1708274&r2=1708275&view=diff
>
> ==============================================================================
> --- ofbiz/branches/release14.12/LICENSE (original)
> +++ ofbiz/branches/release14.12/LICENSE Tue Oct 13 00:45:31 2015
> @@ -67,6 +67,7 @@ framework/base/lib/j2eespecs/annotations
> framework/base/lib/j2eespecs/el-api-2.2.jar
> framework/base/lib/j2eespecs/jsp-api-2.2.jar
> framework/base/lib/j2eespecs/servlet-api-3.0.jar
> +framework/base/lib/owasp-java-html-sanitizer-r239.jar
> framework/base/lib/scripting/bsf-2.4.0.jar
> framework/base/lib/scripting/jakarta-oro-2.0.8.jar
> framework/base/lib/scripting/groovy-all-2.2.1.jar
>
> Modified:
> ofbiz/branches/release14.12/applications/content/config/content.properties
> URL:
> http://svn.apache.org/viewvc/ofbiz/branches/release14.12/applications/content/config/content.properties?rev=1708275&r1=1708274&r2=1708275&view=diff
>
> ==============================================================================
> ---
> ofbiz/branches/release14.12/applications/content/config/content.properties
> (original)
> +++
> ofbiz/branches/release14.12/applications/content/config/content.properties
> Tue Oct 13 00:45:31 2015
> @@ -35,3 +35,7 @@ content.upload.always.local.file=true
>
> # content output folder (relative to ofbiz.home)
> content.output.path=runtime/output
> +
> +#Should we sanitize generic content by default (specific contents -
> order, party, category, product, configured product, product promo and work
> effort - are always encoded)
> +# This has a slightly impact on the code rendered, see . True By default!
> +content.sanitize=true
>
> Modified:
> ofbiz/branches/release14.12/applications/content/src/org/ofbiz/content/content/ContentWorker.java
> URL:
> http://svn.apache.org/viewvc/ofbiz/branches/release14.12/applications/content/src/org/ofbiz/content/content/ContentWorker.java?rev=1708275&r1=1708274&r2=1708275&view=diff
>
> ==============================================================================
> ---
> ofbiz/branches/release14.12/applications/content/src/org/ofbiz/content/content/ContentWorker.java
> (original)
> +++
> ofbiz/branches/release14.12/applications/content/src/org/ofbiz/content/content/ContentWorker.java
> Tue Oct 13 00:45:31 2015
> @@ -54,6 +54,7 @@ import org.ofbiz.entity.condition.Entity
> import org.ofbiz.entity.condition.EntityOperator;
> import org.ofbiz.entity.util.EntityQuery;
> import org.ofbiz.entity.util.EntityUtil;
> +import org.ofbiz.entity.util.EntityUtilProperties;
> import org.ofbiz.minilang.MiniLangException;
> import org.ofbiz.minilang.SimpleMapProcessor;
> import org.ofbiz.service.DispatchContext;
> @@ -61,6 +62,8 @@ import org.ofbiz.service.GenericServiceE
> import org.ofbiz.service.LocalDispatcher;
> import org.ofbiz.service.ModelService;
> import org.ofbiz.service.ServiceUtil;
> +import org.owasp.html.PolicyFactory;
> +import org.owasp.html.Sanitizers;
> import org.xml.sax.InputSource;
> import org.xml.sax.SAXException;
>
> @@ -335,7 +338,23 @@ public class ContentWorker implements or
> Locale locale, String mimeTypeId, boolean cache) throws
> GeneralException, IOException {
> Writer writer = new StringWriter();
> renderContentAsText(dispatcher, delegator, contentId, writer,
> templateContext, locale, mimeTypeId, null, null, cache);
> - return writer.toString();
> + String rendered = writer.toString();
> + // According to
> https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#XSS_Prevention_Rules_Summary
> + // Normally head should be protected by X-XSS-Protection Response
> Header by default
> + if
> (EntityUtilProperties.propertyValueEqualsIgnoreCase("content.properties",
> "content.sanitize", "true", delegator)
> + && (rendered.contains("<script>")
> + || rendered.contains("<!--")
> + || rendered.contains("<div")
> + || rendered.contains("<style>")
> + || rendered.contains("<span")
> + || rendered.contains("<input")
> + || rendered.contains("<input")
> + || rendered.contains("<iframe")
> + || rendered.contains("<a"))) {
> + PolicyFactory sanitizer =
> Sanitizers.FORMATTING.and(Sanitizers.BLOCKS).and(Sanitizers.IMAGES).and(Sanitizers.LINKS).and(Sanitizers.STYLES);
> + rendered = sanitizer.sanitize(rendered);
> + }
> + return rendered;
> }
>
> public static String renderContentAsText(LocalDispatcher dispatcher,
> Delegator delegator, String contentId, Appendable out,
>
> Modified:
> ofbiz/branches/release14.12/specialpurpose/cmssite/data/CmsSiteDemoData.xml
> URL:
> http://svn.apache.org/viewvc/ofbiz/branches/release14.12/specialpurpose/cmssite/data/CmsSiteDemoData.xml?rev=1708275&r1=1708274&r2=1708275&view=diff
>
> ==============================================================================
> ---
> ofbiz/branches/release14.12/specialpurpose/cmssite/data/CmsSiteDemoData.xml
> (original)
> +++
> ofbiz/branches/release14.12/specialpurpose/cmssite/data/CmsSiteDemoData.xml
> Tue Oct 13 00:45:31 2015
> @@ -78,7 +78,7 @@ under the License.
> <p>
> This is a site to demonstrate the CMS capabilities of
> OFBiz. Its basic function is the editing of website text
> inside a browser. If you want to edit the text you are
> reading now, logon to the backend system, select the content component
> - click on 'cmssite' in the website list and ten click on the
> 'cms' button. There you see on the left hand side the tree of this website.
> + click on 'cmssite' in the website list and then click on
> the 'cms' button. There you see on the left hand side the tree of this
> website.
> If you click on 'homepage' then you can edit the content of
> this page at the box in the r
> </p>
> <p>
>
>
>
