Skip to content

Commit 206c9fa

Browse files
vrubezhnymickaelistria
vrubezhny
authored and
mickaelistria
committed
Cross site scripting in Angular #2
Package @angular/core (npm) < 11.0.5 The upstream issue is fixed in `@anhular/language-server/14.0.1, so the solution is to start using the fixed version of Angular LS. The test project vulnerabilities are fixed The `TestAngular` JUnit test case is re-worked splitting it into a separate project setup and two testcases sharing the same project. Signed-off-by: Victor Rubezhny <[email protected]>
1 parent 8c834d7 commit 206c9fa

File tree

3 files changed

+97
-31
lines changed

3 files changed

+97
-31
lines changed

‎org.eclipse.wildwebdeveloper.tests/src/org/eclipse/wildwebdeveloper/tests/TestAngular.java‎

Lines changed: 81 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2019 Red Hat Inc. and others.
2+
* Copyright (c) 2019, 2022 Red Hat Inc. and others.
33
*
44
* This program and the accompanying materials are made
55
* available under the terms of the Eclipse Public License 2.0
@@ -16,7 +16,10 @@
1616
import static org.junit.jupiter.api.Assertions.assertEquals;
1717
import static org.junit.jupiter.api.Assertions.assertTrue;
1818

19+
import java.io.BufferedReader;
20+
import java.io.InputStreamReader;
1921
import java.util.Arrays;
22+
import java.util.stream.Collectors;
2023

2124
import org.eclipse.core.resources.IFile;
2225
import org.eclipse.core.resources.IFolder;
@@ -25,29 +28,90 @@
2528
import org.eclipse.core.resources.IResource;
2629
import org.eclipse.core.runtime.CoreException;
2730
import org.eclipse.core.runtime.NullProgressMonitor;
31+
import org.eclipse.core.runtime.preferences.InstanceScope;
2832
import org.eclipse.jface.text.IDocument;
2933
import org.eclipse.jface.text.contentassist.ICompletionProposal;
3034
import org.eclipse.lsp4e.operations.completion.LSContentAssistProcessor;
35+
import org.eclipse.ui.IViewReference;
36+
import org.eclipse.ui.IWorkbenchPage;
3137
import org.eclipse.ui.PlatformUI;
3238
import org.eclipse.ui.editors.text.TextEditor;
3339
import org.eclipse.ui.ide.IDE;
40+
import org.eclipse.ui.intro.IIntroPart;
41+
import org.eclipse.ui.preferences.ScopedPreferenceStore;
3442
import org.eclipse.ui.tests.harness.util.DisplayHelper;
3543
import org.eclipse.wildwebdeveloper.embedder.node.NodeJSManager;
44+
import org.junit.jupiter.api.AfterAll;
45+
import org.junit.jupiter.api.BeforeAll;
46+
import org.junit.jupiter.api.BeforeEach;
3647
import org.junit.jupiter.api.Test;
37-
import org.junit.jupiter.api.extension.ExtendWith;
3848

39-
@ExtendWith(AllCleanRule.class)
4049
public class TestAngular {
50+
static IProject project;
51+
static IFolder appFolder;
52+
53+
@BeforeAll
54+
public static void setUp() throws Exception {
55+
// The following is a copy of new AllCleanRule().afterEach(null);`
56+
// excluding a call to clean the projects - we need to share the project
57+
// between the existing testcases
58+
//
59+
IIntroPart intro = PlatformUI.getWorkbench().getIntroManager().getIntro();
60+
if (intro != null) {
61+
PlatformUI.getWorkbench().getIntroManager().closeIntro(intro);
62+
}
63+
IWorkbenchPage activePage = PlatformUI.getWorkbench().getActiveWorkbenchWindow().getActivePage();
64+
for (IViewReference ref : activePage.getViewReferences()) {
65+
activePage.hideView(ref);
66+
}
67+
enableLogging();
68+
// End of note
69+
70+
project = Utils.provisionTestProject("angular-app");
71+
ProcessBuilder builder = new ProcessBuilder(NodeJSManager.getNpmLocation().getAbsolutePath(), "install",
72+
"--no-bin-links", "--ignore-scripts").directory(project.getLocation().toFile());
73+
Process process = builder.start();
74+
System.out.println(builder.command().toString());
75+
String result = new BufferedReader(new InputStreamReader(process.getErrorStream())).lines()
76+
.collect(Collectors.joining("\n"));
77+
System.out.println("Error Stream: >>>\n" + result + "\n<<<");
78+
79+
result = new BufferedReader(new InputStreamReader(process.getInputStream())).lines()
80+
.collect(Collectors.joining("\n"));
81+
System.out.println("Output Stream: >>>\n" + result + "\n<<<");
4182

42-
@Test
43-
public void testAngular() throws Exception {
44-
IProject project = Utils.provisionTestProject("angular-app");
45-
Process process = new ProcessBuilder(NodeJSManager.getNpmLocation().getAbsolutePath(), "install",
46-
"--no-bin-links", "--ignore-scripts").directory(project.getLocation().toFile()).start();
4783
assertEquals(0, process.waitFor(), "npm install didn't complete property");
84+
4885
project.refreshLocal(IResource.DEPTH_INFINITE, new NullProgressMonitor());
49-
IFolder appFolder = project.getFolder("src").getFolder("app");
86+
assertTrue(project.exists());
87+
appFolder = project.getFolder("src").getFolder("app");
88+
assertTrue(appFolder.exists());
89+
}
90+
91+
@BeforeEach
92+
public void setUpTestCase() {
93+
enableLogging();
94+
}
95+
96+
@AfterAll
97+
public static void tearDown() throws Exception {
98+
new AllCleanRule().afterEach(null);
99+
}
100+
101+
private static void enableLogging() {
102+
ScopedPreferenceStore prefs = new ScopedPreferenceStore(InstanceScope.INSTANCE, "org.eclipse.lsp4e");
103+
prefs.putValue("org.eclipse.wildwebdeveloper.angular.file.logging.enabled", Boolean.toString(true));
104+
prefs.putValue("org.eclipse.wildwebdeveloper.jsts.file.logging.enabled", Boolean.toString(true));
105+
prefs.putValue("org.eclipse.wildwebdeveloper.css.file.logging.enabled", Boolean.toString(true));
106+
prefs.putValue("org.eclipse.wildwebdeveloper.html.file.logging.enabled", Boolean.toString(true));
107+
prefs.putValue("org.eclipse.wildwebdeveloper.json.file.logging.enabled", Boolean.toString(true));
108+
prefs.putValue("org.eclipse.wildwebdeveloper.xml.file.logging.enabled", Boolean.toString(true));
109+
prefs.putValue("org.eclipse.wildwebdeveloper.yaml.file.logging.enabled", Boolean.toString(true));
110+
prefs.putValue("org.eclipse.wildwebdeveloper.eslint.file.logging.enabled", Boolean.toString(true));
111+
}
50112

113+
@Test
114+
public void testAngularTs() throws Exception {
51115
IFile appComponentFile = appFolder.getFile("app.component.ts");
52116
TextEditor editor = (TextEditor) IDE
53117
.openEditor(PlatformUI.getWorkbench().getActiveWorkbenchWindow().getActivePage(), appComponentFile);
@@ -67,13 +131,15 @@ protected boolean condition() {
67131
return false;
68132
}
69133
}
70-
// The timeout is increased to 150 seconds due to the slow compilation of an
71-
// angular project.
72-
}.waitForCondition(PlatformUI.getWorkbench().getDisplay(), 150000),
134+
}.waitForCondition(editor.getSite().getShell().getDisplay(), 30000),
73135
"Diagnostic not published in standalone component file");
74136
editor.close(false);
137+
}
75138

76-
editor = (TextEditor) IDE.openEditor(PlatformUI.getWorkbench().getActiveWorkbenchWindow().getActivePage(),
139+
@Test
140+
public void testAngularHtml() throws Exception {
141+
TextEditor editor = (TextEditor) IDE.openEditor(
142+
PlatformUI.getWorkbench().getActiveWorkbenchWindow().getActivePage(),
77143
appFolder.getFile("app.componentWithHtml.ts"));
78144
DisplayHelper.sleep(4000); // Give time for LS to initialize enough before making edit and sending a
79145
// didChange
@@ -94,10 +160,11 @@ protected boolean condition() {
94160
return Arrays.stream(markers)
95161
.anyMatch(marker -> marker.getAttribute(IMarker.MESSAGE, "").contains("not exist"));
96162
} catch (CoreException e) {
163+
e.printStackTrace();
97164
return false;
98165
}
99166
}
100-
}.waitForCondition(editor.getSite().getShell().getDisplay(), 150000),
167+
}.waitForCondition(editor.getSite().getShell().getDisplay(), 30000),
101168
"No error found on erroneous HTML component file");
102169
// test completion
103170
LSContentAssistProcessor contentAssistProcessor = new LSContentAssistProcessor();
@@ -106,5 +173,4 @@ protected boolean condition() {
106173
proposals[0].apply(document);
107174
assertEquals("<h1>{{title}}</h1>\n", document.get(), "Incorrect completion insertion");
108175
}
109-
110176
}

‎org.eclipse.wildwebdeveloper.tests/testProjects/angular-app/package.json‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,19 @@
1111
},
1212
"private": true,
1313
"dependencies": {
14-
"@angular/animations": "~8.2.14",
15-
"@angular/cli": "^8.2.14",
16-
"@angular/common": "~8.2.14",
17-
"@angular/compiler": "~8.2.14",
18-
"@angular/core": "~8.2.14",
19-
"@angular/forms": "~8.2.14",
20-
"@angular/platform-browser": "~8.2.14",
21-
"@angular/platform-browser-dynamic": "~8.2.14",
22-
"@angular/router": "~8.2.14",
23-
"@angular-devkit/build-angular": "0.801.1",
24-
"core-js": "^2.5.4",
25-
"rxjs": "~6.4.0",
26-
"tslib": "^1.9.0",
27-
"zone.js": "~0.9.1"
14+
"@angular-devkit/build-angular": "13.3.7",
15+
"@angular/animations": "~13.3.11",
16+
"@angular/cli": "^13.3.7",
17+
"@angular/common": "~13.3.11",
18+
"@angular/compiler": "~13.3.11",
19+
"@angular/core": "~13.3.11",
20+
"@angular/forms": "~13.3.11",
21+
"@angular/platform-browser": "~13.3.11",
22+
"@angular/platform-browser-dynamic": "~13.3.11",
23+
"@angular/router": "~13.3.11",
24+
"core-js": "^3.22.8",
25+
"rxjs": "~6.5.3",
26+
"tslib": "^2.4.0",
27+
"zone.js": "~0.11.4"
2828
}
29-
}
29+
}

‎org.eclipse.wildwebdeveloper/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@
192192
<arg>[email protected]</arg>
193193
<arg>${project.build.directory}/debugger-for-chrome-4.13.0.tgz</arg>
194194
<arg>${project.build.directory}/eslint-server-2.1.25.tgz</arg>
195-
<arg>@angular/language-server@13.3.2</arg>
195+
<arg>@angular/language-server@14.0.1</arg>
196196
</arguments>
197197
<workingDirectory>${project.basedir}</workingDirectory>
198198
</configuration>

0 commit comments

Comments
 (0)