[jira] [Commented] (GROOVY-12277) improve groovydoc encoding edge cases

[ASF GitHub Bot (Jira)]

    [ 
https://issues.apache.org/jira/browse/GROOVY-12277?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105736#comment-18105736
 ] 

ASF GitHub Bot commented on GROOVY-12277:
-----------------------------------------

Copilot commented on code in PR #2814:
URL: https://github.com/apache/groovy/pull/2814#discussion_r3809191208


##########
subprojects/groovy-groovydoc/src/test/groovy/org/codehaus/groovy/tools/groovydoc/GroovyDocToolTest.java:
##########
@@ -326,6 +326,52 @@ private String renderSingle(Path sourcePath, String pkg, 
String simpleName) thro
         return output.getText(MOCK_DIR + "/" + pkg + "/" + simpleName + 
".html");
     }
 
+    // GROOVY-12277: a {@link} label and target are doc-comment text that 
groovydoc puts into
+    // the href and title of an anchor it builds itself, so they must be 
encoded for those
+    // contexts. This is groovydoc's own construction, not the documented 
raw-HTML passthrough
+    // of a comment body.
+    public void testLinkTagCannotBreakOutOfTheAnchorItBuilds() throws 
Exception {
+        String pkg = "org/codehaus/groovy/tools/groovydoc/testfiles/docfiles";
+        Path tmp = Files.createTempDirectory("linktag-");
+        Path pkgDir = tmp.resolve(pkg);
+        Files.createDirectories(pkgDir);
+        Files.writeString(pkgDir.resolve("Helper.groovy"),
+                "package " + pkg.replace('/', '.') + "\nclass Helper { void 
go() {} }\n");
+        Files.writeString(pkgDir.resolve("LinkTag.groovy"),
+                "package " + pkg.replace('/', '.') + "\n" +
+                "/**\n" +
+                " * See {@link Helper x'><img src=q 
onerror='alert(1)}\n" +

Review Comment:
   The payload in the {@link Helper ...} label uses HTML entities 
(`><img`), but `getDocUrl`/`buildUrl` appear to treat the label as plain 
text and don’t decode entities. As a result, this assertion can pass even on 
the vulnerable implementation because the generated HTML would still contain 
`&lt;img...` rather than a literal `<img...>` tag.
   
   To make this a reliable regression test for escaping in `title`/anchor text, 
use a payload with literal `'><img ...>` so it would have produced an actual 
`<img` tag in the generated HTML before the fix.





> improve groovydoc encoding edge cases
> -------------------------------------
>
>                 Key: GROOVY-12277
>                 URL: https://issues.apache.org/jira/browse/GROOVY-12277
>             Project: Groovy
>          Issue Type: Improvement
>            Reporter: Paul King
>            Assignee: Paul King
>            Priority: Major
>




--
This message was sent by Atlassian Jira
(v8.20.10#820010)