Skip to content

Commit 99d8a49

Browse files
nahsranahsra
committed
added codeql test
1 parent 91641d2 commit 99d8a49

File tree

6 files changed

+153718
-3
lines changed

6 files changed

+153718
-3
lines changed

‎core-codemods/src/main/java/io/codemodder/codemods/codeql/CodeQLLogInjectionCodemod.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,6 @@ public CodemodFileScanningResult visit(
4949
r ->
5050
Optional.ofNullable(
5151
r.getLocations().get(0).getPhysicalLocation().getRegion().getEndLine()),
52-
r ->
53-
Optional.ofNullable(
54-
r.getLocations().get(0).getPhysicalLocation().getRegion().getStartColumn()));
52+
r -> Optional.empty());
5553
}
5654
}

‎core-codemods/src/test/java/io/codemodder/codemods/codeql/CodeQLJEXLInjectionCodemodTest.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,6 @@
66
@Metadata(
77
codemodType = CodeQLJEXLInjectionCodemod.class,
88
testResourceDir = "jexl-expression-injection",
9+
doRetransformTest = false,
910
dependencies = {})
1011
final class CodeQLJEXLInjectionCodemodTest implements CodemodTestMixin {}

‎core-codemods/src/test/java/io/codemodder/codemods/codeql/CodeQLLogInjectionCodemodTest.java‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package io.codemodder.codemods.codeql;
2+
3+
import io.codemodder.testutils.CodemodTestMixin;
4+
import io.codemodder.testutils.Metadata;
5+
6+
@Metadata(
7+
codemodType = CodeQLLogInjectionCodemod.class,
8+
testResourceDir = "codeql-log-injection",
9+
renameTestFile =
10+
"app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Templates.java",
11+
doRetransformTest = false,
12+
expectingFixesAtLines = {124},
13+
dependencies = {})
14+
final class CodeQLLogInjectionCodemodTest implements CodemodTestMixin {}

‎core-codemods/src/test/resources/codeql-log-injection/Templates.java.after‎

Lines changed: 343 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,343 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. The ASF licenses this file to You
4+
* under the Apache License, Version 2.0 (the "License"); you may not
5+
* use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License. For additional information regarding
15+
* copyright in this work, please see the NOTICE file in the top level
16+
* directory of this distribution.
17+
*/
18+
19+
package org.apache.roller.weblogger.ui.struts2.editor;
20+
21+
import static io.github.pixee.security.Newlines.stripNewLines;
22+
import org.apache.commons.lang3.StringUtils;
23+
import org.apache.commons.logging.Log;
24+
import org.apache.commons.logging.LogFactory;
25+
import org.apache.roller.util.RollerConstants;
26+
import org.apache.roller.weblogger.WebloggerException;
27+
import org.apache.roller.weblogger.business.WeblogManager;
28+
import org.apache.roller.weblogger.business.WebloggerFactory;
29+
import org.apache.roller.weblogger.pojos.*;
30+
import org.apache.roller.weblogger.pojos.TemplateRendition.RenditionType;
31+
import org.apache.roller.weblogger.pojos.TemplateRendition.TemplateLanguage;
32+
import org.apache.roller.weblogger.pojos.ThemeTemplate.ComponentType;
33+
import org.apache.roller.weblogger.ui.struts2.util.UIAction;
34+
import org.apache.roller.weblogger.util.cache.CacheManager;
35+
import org.apache.struts2.convention.annotation.AllowedMethods;
36+
37+
import java.util.ArrayList;
38+
import java.util.Collections;
39+
import java.util.Date;
40+
import java.util.EnumMap;
41+
import java.util.List;
42+
import java.util.Map;
43+
44+
/**
45+
* Templates listing page.
46+
*/
47+
// TODO: make this work @AllowedMethods({"execute","add"})
48+
public class Templates extends UIAction {
49+
50+
private static final Log log = LogFactory.getLog(Templates.class);
51+
52+
// list of templates to display
53+
private List<WeblogTemplate> templates = Collections.emptyList();
54+
55+
// list of template action types user is allowed to create
56+
private Map<ComponentType, String> availableActions = Collections.emptyMap();
57+
58+
// name and action of new template if we are adding a template
59+
private String newTmplName = null;
60+
private ComponentType newTmplAction = null;
61+
62+
// id of template to remove
63+
private String removeId = null;
64+
65+
public Templates() {
66+
this.actionName = "templates";
67+
this.desiredMenu = "editor";
68+
this.pageTitle = "pagesForm.title";
69+
}
70+
71+
@Override
72+
public String execute() {
73+
74+
// query for templates list
75+
try {
76+
77+
// get current list of templates, minus custom stylesheet
78+
List<WeblogTemplate> raw = WebloggerFactory.getWeblogger()
79+
.getWeblogManager().getTemplates(getActionWeblog());
80+
List<WeblogTemplate> pages = new ArrayList<>(raw);
81+
82+
// Remove style sheet from list so not to show when theme is
83+
// selected in shared theme mode
84+
if (getActionWeblog().getTheme().getStylesheet() != null) {
85+
pages.remove(WebloggerFactory.getWeblogger().getWeblogManager()
86+
.getTemplateByLink(getActionWeblog(), getActionWeblog().getTheme().getStylesheet().getLink()));
87+
}
88+
setTemplates(pages);
89+
90+
// build list of action types that may be added
91+
Map<ComponentType, String> actionsMap = new EnumMap<>(ComponentType.class);
92+
addComponentTypeToMap(actionsMap, ComponentType.CUSTOM);
93+
94+
if (WeblogTheme.CUSTOM.equals(getActionWeblog().getEditorTheme())) {
95+
96+
// if the weblog is using a custom theme then determine which
97+
// action templates are still available to be created
98+
addComponentTypeToMap(actionsMap, ComponentType.PERMALINK);
99+
addComponentTypeToMap(actionsMap, ComponentType.SEARCH);
100+
addComponentTypeToMap(actionsMap, ComponentType.WEBLOG);
101+
addComponentTypeToMap(actionsMap, ComponentType.TAGSINDEX);
102+
103+
for (WeblogTemplate tmpPage : getTemplates()) {
104+
if (!ComponentType.CUSTOM.equals(tmpPage.getAction())) {
105+
actionsMap.remove(tmpPage.getAction());
106+
}
107+
}
108+
} else {
109+
// Make sure we have an option for the default web page
110+
addComponentTypeToMap(actionsMap, ComponentType.WEBLOG);
111+
if (getNewTmplAction() == null) {
112+
setNewTmplAction(ComponentType.WEBLOG);
113+
}
114+
for (WeblogTemplate tmpPage : getTemplates()) {
115+
if (ComponentType.WEBLOG.equals(tmpPage.getAction())) {
116+
actionsMap.remove(ComponentType.WEBLOG);
117+
setNewTmplAction(null);
118+
break;
119+
}
120+
}
121+
}
122+
setAvailableActions(actionsMap);
123+
124+
} catch (WebloggerException ex) {
125+
log.error("Error getting templates for weblog - "
126+
+ stripNewLines(getActionWeblog().getHandle()), ex);
127+
addError("Error getting template list - check Roller logs");
128+
}
129+
130+
return LIST;
131+
}
132+
133+
private void addComponentTypeToMap(Map<ComponentType, String> map, ComponentType component) {
134+
map.put(component, component.getReadableName());
135+
}
136+
137+
/**
138+
* Save a new template.
139+
*/
140+
public String add() {
141+
142+
// validation
143+
myValidate();
144+
145+
if (!hasActionErrors()) {
146+
try {
147+
148+
WeblogTemplate newTemplate = new WeblogTemplate();
149+
newTemplate.setWeblog(getActionWeblog());
150+
newTemplate.setAction(getNewTmplAction());
151+
newTemplate.setName(getNewTmplName());
152+
newTemplate.setHidden(false);
153+
newTemplate.setNavbar(false);
154+
newTemplate.setLastModified(new Date());
155+
156+
if (ComponentType.CUSTOM.equals(getNewTmplAction())) {
157+
newTemplate.setLink(getNewTmplName());
158+
}
159+
160+
// Make sure we have always have a Weblog main page. Stops
161+
// deleting main page in custom theme mode also.
162+
if (ComponentType.WEBLOG.equals(getNewTmplAction())) {
163+
newTemplate.setName(WeblogTemplate.DEFAULT_PAGE);
164+
}
165+
166+
// save the new Template
167+
WebloggerFactory.getWeblogger().getWeblogManager().saveTemplate(newTemplate);
168+
169+
// Create weblog template renditions for available types.
170+
CustomTemplateRendition standardRendition =
171+
new CustomTemplateRendition( newTemplate, RenditionType.STANDARD);
172+
standardRendition.setTemplate(getText("pageForm.newTemplateContent"));
173+
standardRendition.setTemplateLanguage(TemplateLanguage.VELOCITY);
174+
WebloggerFactory.getWeblogger().getWeblogManager().saveTemplateRendition(standardRendition);
175+
176+
/* TODO: need a way for user to specify dual or single template via UI
177+
CustomTemplateRendition mobileRendition = new CustomTemplateRendition(
178+
newTemplate.getId(), RenditionType.MOBILE);
179+
mobileRendition.setTemplate(newTemplate.getContents());
180+
mobileRendition.setTemplateLanguage(TemplateLanguage.VELOCITY);
181+
WebloggerFactory.getWeblogger().getWeblogManager()
182+
.saveTemplateRendition(mobileRendition);
183+
*/
184+
185+
// if this person happened to create a Weblog template from
186+
// scratch then make sure and set the defaultPageId.
187+
if (WeblogTemplate.DEFAULT_PAGE.equals(newTemplate.getName())) {
188+
WebloggerFactory.getWeblogger().getWeblogManager().saveWeblog(getActionWeblog());
189+
}
190+
191+
// flush results to db
192+
WebloggerFactory.getWeblogger().flush();
193+
194+
// reset form fields
195+
setNewTmplName(null);
196+
setNewTmplAction(null);
197+
198+
} catch (WebloggerException ex) {
199+
log.error("Error adding new template for weblog - " + stripNewLines(getActionWeblog().getHandle()), ex);
200+
addError("Error adding new template - check Roller logs");
201+
}
202+
}
203+
204+
return execute();
205+
}
206+
207+
/**
208+
* Remove a new template.
209+
*/
210+
public String remove() {
211+
212+
WeblogTemplate template = null;
213+
try {
214+
template = WebloggerFactory.getWeblogger().getWeblogManager().getTemplate(getRemoveId());
215+
} catch (WebloggerException e) {
216+
addError("Error deleting template - check Roller logs");
217+
}
218+
219+
if (template != null) {
220+
try {
221+
if (!template.isRequired()
222+
|| !WeblogTheme.CUSTOM.equals(getActionWeblog().getEditorTheme())) {
223+
224+
WeblogManager mgr = WebloggerFactory.getWeblogger().getWeblogManager();
225+
226+
// if weblog template remove custom style sheet also
227+
if (template.getName().equals(WeblogTemplate.DEFAULT_PAGE)) {
228+
229+
ThemeTemplate stylesheet = getActionWeblog().getTheme().getStylesheet();
230+
231+
// Delete style sheet if the same name
232+
if (stylesheet != null
233+
&& getActionWeblog().getTheme().getStylesheet() != null
234+
&& stylesheet.getLink().equals(
235+
getActionWeblog().getTheme().getStylesheet().getLink())) {
236+
237+
// Same so OK to delete
238+
WeblogTemplate css =
239+
mgr.getTemplateByLink(getActionWeblog(), stylesheet.getLink());
240+
241+
if (css != null) {
242+
mgr.removeTemplate(css);
243+
}
244+
}
245+
}
246+
247+
// notify cache
248+
CacheManager.invalidate(template);
249+
mgr.removeTemplate(template);
250+
WebloggerFactory.getWeblogger().flush();
251+
252+
} else {
253+
addError("editPages.remove.requiredTemplate");
254+
}
255+
256+
} catch (Exception ex) {
257+
log.error("Error removing page - " + stripNewLines(getRemoveId()), ex);
258+
addError("editPages.remove.error");
259+
}
260+
} else {
261+
addError("editPages.remove.error");
262+
}
263+
264+
return execute();
265+
}
266+
267+
// validation when adding a new template
268+
private void myValidate() {
269+
270+
// make sure name is non-null and within proper size
271+
if (StringUtils.isEmpty(getNewTmplName())) {
272+
addError("Template.error.nameNull");
273+
} else if (getNewTmplName().length() > RollerConstants.TEXTWIDTH_255) {
274+
addError("Template.error.nameSize");
275+
}
276+
277+
// make sure action is a valid
278+
if (getNewTmplAction() == null) {
279+
addError("Template.error.actionNull");
280+
}
281+
282+
// check if template by that name already exists
283+
try {
284+
WeblogTemplate existingPage = WebloggerFactory.getWeblogger().getWeblogManager()
285+
.getTemplateByName(getActionWeblog(), getNewTmplName());
286+
if (existingPage != null) {
287+
addError("pagesForm.error.alreadyExists", getNewTmplName());
288+
}
289+
} catch (WebloggerException ex) {
290+
log.error("Error checking for existing template", ex);
291+
}
292+
293+
}
294+
295+
/**
296+
* Checks if is custom theme.
297+
*
298+
* @return true, if is custom theme
299+
*/
300+
public boolean isCustomTheme() {
301+
return (WeblogTheme.CUSTOM.equals(getActionWeblog().getEditorTheme()));
302+
}
303+
304+
public List<WeblogTemplate> getTemplates() {
305+
return templates;
306+
}
307+
308+
public void setTemplates(List<WeblogTemplate> templates) {
309+
this.templates = templates;
310+
}
311+
312+
public Map<ComponentType, String> getAvailableActions() {
313+
return availableActions;
314+
}
315+
316+
public void setAvailableActions(Map<ComponentType, String> availableActions) {
317+
this.availableActions = availableActions;
318+
}
319+
320+
public String getNewTmplName() {
321+
return newTmplName;
322+
}
323+
324+
public void setNewTmplName(String newTmplName) {
325+
this.newTmplName = newTmplName;
326+
}
327+
328+
public ComponentType getNewTmplAction() {
329+
return newTmplAction;
330+
}
331+
332+
public void setNewTmplAction(ComponentType newTmplAction) {
333+
this.newTmplAction = newTmplAction;
334+
}
335+
336+
public String getRemoveId() {
337+
return removeId;
338+
}
339+
340+
public void setRemoveId(String removeId) {
341+
this.removeId = removeId;
342+
}
343+
}

0 commit comments

Comments
 (0)