Merge pull request #995 from GwtMaterialDesign/release_2.4.2

(Security Fixes) Fixed XSS Vulnerability and Bump junit from 4.12 to 4.13.1

Author: kevzlou7979

.travis.yml

@@ -8,7 +8,7 @@ cache:
   - $HOME/.m2
 before_install:
 # install the gwt-material-jquery because it will depends on built in jquery
-- git clone -b release_2.4.1 https://github.com/GwtMaterialDesign/gwt-material-jquery.git
+- git clone -b release_2.4.2 https://github.com/GwtMaterialDesign/gwt-material-jquery.git
 - cd gwt-material-jquery
 - mvn install -DskipTests=true -DdryRun=true
 - cd ..

.utility/deploy.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 set -ev
-if [ "$TRAVIS_JDK_VERSION" == "oraclejdk8" ] && [ "$TRAVIS_PULL_REQUEST" == "false" ] && [ "$TRAVIS_BRANCH" == "release_2.4.1" ]; then
+if [ "$TRAVIS_JDK_VERSION" == "oraclejdk8" ] && [ "$TRAVIS_PULL_REQUEST" == "false" ] && [ "$TRAVIS_BRANCH" == "release_2.4.2" ]; then
   echo "<settings><servers><server><id>ossrh</id><username>\${env.OSSRH_USER}</username><password>\${env.OSSRH_PASS}</password></server></servers></settings>" > ~/settings.xml
   mvn deploy -DskipTests --settings ~/settings.xml
 fi

README.md

@@ -20,12 +20,12 @@ We created <a href="http://gwtmaterialdesign.github.io/gwt-material-demo/apidocs
 
 
 ## Maven
-### Current Version 2.4.1
+### Current Version 2.4.2
 ```xml
 <dependency>
     <groupId>com.github.gwtmaterialdesign</groupId>
     <artifactId>gwt-material</artifactId>
-    <version>2.4.1</version>
+    <version>2.4.2</version>
 </dependency>
 ```
 ### Snapshot Version 2.5.0-SNAPSHOT

gwt-material/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>gwt-material-parent</artifactId>
         <groupId>com.github.gwtmaterialdesign</groupId>
-        <version>2.4.1</version>
+        <version>2.4.2</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 

gwt-material/src/main/java/gwt/material/design/client/base/AbstractButton.java

@@ -24,6 +24,8 @@
 import com.google.gwt.event.logical.shared.ValueChangeEvent;
 import com.google.gwt.event.logical.shared.ValueChangeHandler;
 import com.google.gwt.event.shared.HandlerRegistration;
+import com.google.gwt.safehtml.shared.HtmlSanitizer;
+import com.google.gwt.safehtml.shared.SafeHtml;
 import com.google.gwt.user.client.History;
 import com.google.gwt.user.client.ui.HasValue;
 import gwt.material.design.client.base.mixin.ActivatesMixin;
@@ -36,7 +38,7 @@
  * @author Ben Dol
  */
 public abstract class AbstractButton extends MaterialWidget implements HasHref, HasGrid, HasActivates,
-        HasTargetHistoryToken, HasType<ButtonType>, HasValue<String> {
+    HasTargetHistoryToken, HasType<ButtonType>, HasValue<String>, HasSafeText {
 
     private String targetHistoryToken;
     private Span span = new Span();
@@ -169,6 +171,21 @@ public void setText(String text) {
         }
     }
 
+    @Override
+    public void setHtml(SafeHtml html) {
+        span.setHtml(html);
+    }
+
+    @Override
+    public void setSanitizer(HtmlSanitizer sanitizer) {
+        span.setSanitizer(sanitizer);
+    }
+
+    @Override
+    public HtmlSanitizer getSanitizer() {
+        return span.getSanitizer();
+    }
+
     /**
      * Set the target history token for the widget. Note, that you should use either
      * {@link #setTargetHistoryToken(String)} or {@link #setHref(String)}, but not both as

gwt-material/src/main/java/gwt/material/design/client/base/AbstractValueWidget.java

@@ -86,9 +86,6 @@ public void setValue(V value, boolean fireEvents, boolean reload) {
         }
     }
 
-    //TODO:
-    //setSanitizer();
-
     @Override
     public void setErrorText(String errorText) {
         getStatusTextMixin().setErrorText(errorText);

gwt-material/src/main/java/gwt/material/design/client/base/DefaultHtmlSanitizer.java

@@ -0,0 +1,35 @@
+/*
+ * #%L
+ * GwtMaterial
+ * %%
+ * Copyright (C) 2015 - 2020 GwtMaterialDesign
+ * %%
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * #L%
+ */
+package gwt.material.design.client.base;
+
+import com.google.gwt.safehtml.shared.HtmlSanitizer;
+import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.SafeHtmlUtils;
+
+/**
+ * HTML-escapes its argument and returns the result wrapped as a SafeHtml.
+ */
+public class DefaultHtmlSanitizer implements HtmlSanitizer {
+
+    @Override
+    public SafeHtml sanitize(String html) {
+        return SafeHtmlUtils.fromString(html);
+    }
+}

gwt-material/src/main/java/gwt/material/design/client/base/HasSafeText.java

@@ -0,0 +1,32 @@
+/*
+ * #%L
+ * GwtMaterial
+ * %%
+ * Copyright (C) 2015 - 2020 GwtMaterialDesign
+ * %%
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * #L%
+ */
+package gwt.material.design.client.base;
+
+import com.google.gwt.safehtml.shared.HtmlSanitizer;
+import com.google.gwt.safehtml.shared.SafeHtml;
+
+public interface HasSafeText {
+
+    void setHtml(SafeHtml html);
+
+    void setSanitizer(HtmlSanitizer sanitizer);
+
+    HtmlSanitizer getSanitizer();
+}

gwt-material/src/main/java/gwt/material/design/client/base/TextWidget.java

@@ -20,13 +20,15 @@
 package gwt.material.design.client.base;
 
 import com.google.gwt.dom.client.Element;
+import com.google.gwt.safehtml.shared.HtmlSanitizer;
+import com.google.gwt.safehtml.shared.SafeHtml;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.ui.HasText;
 import gwt.material.design.client.base.mixin.TextMixin;
 
-public class TextWidget extends MaterialWidget implements HasText {
+public class TextWidget extends MaterialWidget implements HasSafeText, HasText {
 
-    private final TextMixin<TextWidget> textMixin = new TextMixin<>(this);
+    private TextMixin<TextWidget> textMixin;
 
     public TextWidget() {
         super(DOM.createDiv());
@@ -42,11 +44,33 @@ public TextWidget(Element element, String... initialClass) {
 
     @Override
     public String getText() {
-        return textMixin.getText();
+        return getTextMixin().getText();
     }
 
     @Override
     public void setText(String text) {
-        textMixin.setText(text);
+        getTextMixin().setText(text);
     }
-}
+
+    @Override
+    public void setHtml(SafeHtml html) {
+        getTextMixin().setHtml(html);
+    }
+
+    @Override
+    public void setSanitizer(HtmlSanitizer sanitizer) {
+        getTextMixin().setSanitizer(sanitizer);
+    }
+
+    @Override
+    public HtmlSanitizer getSanitizer() {
+        return getTextMixin().getSanitizer();
+    }
+
+    public TextMixin<TextWidget> getTextMixin() {
+        if (textMixin == null) {
+            textMixin = new TextMixin<>(this);
+        }
+        return textMixin;
+    }
+}

gwt-material/src/main/java/gwt/material/design/client/base/mixin/AbstractMixin.java

@@ -26,7 +26,7 @@
 /**
  * @author Sven Jacobs
  */
-abstract class AbstractMixin<T extends UIObject> {
+public abstract class AbstractMixin<T extends UIObject> {
 
     T uiObject;
 
@@ -37,4 +37,8 @@ abstract class AbstractMixin<T extends UIObject> {
     public void setUiObject(T uiObject) {
         this.uiObject = uiObject;
     }
+
+    public T getUiObject() {
+        return uiObject;
+    }
 }