Skip to content

Commit d48c3b5

Browse files
jhoellerjhoeller
committed
HtmlUtils properly escapes single quotes as well
1 parent b122cf8 commit d48c3b5

File tree

5 files changed

+41
-32
lines changed

5 files changed

+41
-32
lines changed

‎org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/tags/HtmlEscapeTagTests.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
/*
2-
* Copyright 2002-2005 the original author or authors.
3-
*
2+
* Copyright 2002-2011 the original author or authors.
3+
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
66
* You may obtain a copy of the License at
7-
*
7+
*
88
* http://www.apache.org/licenses/LICENSE-2.0
9-
*
9+
*
1010
* Unless required by applicable law or agreed to in writing, software
1111
* distributed under the License is distributed on an "AS IS" BASIS,
1212
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -18,8 +18,8 @@
1818

1919
import javax.servlet.jsp.JspException;
2020
import javax.servlet.jsp.PageContext;
21-
import javax.servlet.jsp.tagext.Tag;
2221
import javax.servlet.jsp.tagext.BodyTag;
22+
import javax.servlet.jsp.tagext.Tag;
2323

2424
import org.springframework.mock.web.MockServletContext;
2525
import org.springframework.web.util.WebUtils;
@@ -176,7 +176,7 @@ protected void writeBodyContent(String content) {
176176
tag.setJavaScriptEscape("true");
177177
assertEquals(BodyTag.EVAL_BODY_BUFFERED, tag.doStartTag());
178178
assertEquals(Tag.SKIP_BODY, tag.doAfterBody());
179-
assertEquals("Correct content", "\\' test & text \\\\", result.toString());
179+
assertEquals("Correct content", "' test & text \\\\", result.toString());
180180
}
181181

182182
}

‎org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/tags/MessageTagTests.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2007 the original author or authors.
2+
* Copyright 2002-2011 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -19,7 +19,6 @@
1919
import java.util.Arrays;
2020
import java.util.List;
2121
import java.util.Locale;
22-
2322
import javax.servlet.ServletException;
2423
import javax.servlet.http.HttpServletRequest;
2524
import javax.servlet.jsp.JspException;
@@ -347,7 +346,7 @@ protected void writeMessage(String msg) {
347346
tag.setHtmlEscape("true");
348347
tag.setJavaScriptEscape("true");
349348
assertTrue("Correct doStartTag return value", tag.doStartTag() == Tag.EVAL_BODY_INCLUDE);
350-
assertEquals("Correct message", "\\' test & text \\\\", message.toString());
349+
assertEquals("Correct message", "' test & text \\\\", message.toString());
351350
}
352351

353352
public void testMessageWithVarAndScope() throws JspException {

‎org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/tags/form/FormTagTests.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2008 the original author or authors.
2+
* Copyright 2002-2011 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -174,7 +174,7 @@ public void testXSSScriptingExploitWhenActionIsResolvedFromQueryString() throws
174174
String xssQueryString = QUERY_STRING + "&stuff=\"><script>alert('XSS!')</script>";
175175
request.setQueryString(xssQueryString);
176176
tag.doStartTag();
177-
assertEquals("<form id=\"command\" action=\"/my/form?foo=bar&amp;stuff=&quot;&gt;&lt;script&gt;alert('XSS!')&lt;/script&gt;\" method=\"post\">",
177+
assertEquals("<form id=\"command\" action=\"/my/form?foo=bar&amp;stuff=&quot;&gt;&lt;script&gt;alert(&#39;XSS!&#39;)&lt;/script&gt;\" method=\"post\">",
178178
getOutput());
179179
}
180180

‎org.springframework.web/src/test/java/org/springframework/web/bind/EscapedErrorsTests.java

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2006 the original author or authors.
2+
* Copyright 2002-2011 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,20 +16,23 @@
1616

1717
package org.springframework.web.bind;
1818

19-
import junit.framework.TestCase;
19+
import org.junit.Test;
2020

2121
import org.springframework.beans.TestBean;
2222
import org.springframework.validation.BindException;
2323
import org.springframework.validation.Errors;
2424
import org.springframework.validation.FieldError;
2525
import org.springframework.validation.ObjectError;
2626

27+
import static org.junit.Assert.*;
28+
2729
/**
2830
* @author Juergen Hoeller
2931
* @since 02.05.2003
3032
*/
31-
public class EscapedErrorsTests extends TestCase {
33+
public class EscapedErrorsTests {
3234

35+
@Test
3336
public void testEscapedErrors() {
3437
TestBean tb = new TestBean();
3538
tb.setName("empty &");
@@ -47,11 +50,11 @@ public void testEscapedErrors() {
4750
assertTrue("Correct global errors flag", errors.hasGlobalErrors());
4851
assertTrue("Correct number of global errors", errors.getGlobalErrorCount() == 1);
4952
ObjectError globalError = errors.getGlobalError();
50-
assertTrue("Global error message escaped", "message: &quot; '".equals(globalError.getDefaultMessage()));
53+
assertTrue("Global error message escaped", "message: &quot; &#39;".equals(globalError.getDefaultMessage()));
5154
assertTrue("Global error code not escaped", "GENERAL_ERROR \" '".equals(globalError.getCode()));
52-
ObjectError globalErrorInList = (ObjectError) errors.getGlobalErrors().get(0);
55+
ObjectError globalErrorInList = errors.getGlobalErrors().get(0);
5356
assertTrue("Same global error in list", globalError.getDefaultMessage().equals(globalErrorInList.getDefaultMessage()));
54-
ObjectError globalErrorInAllList = (ObjectError) errors.getAllErrors().get(3);
57+
ObjectError globalErrorInAllList = errors.getAllErrors().get(3);
5558
assertTrue("Same global error in list", globalError.getDefaultMessage().equals(globalErrorInAllList.getDefaultMessage()));
5659

5760
assertTrue("Correct field errors flag", errors.hasFieldErrors());
@@ -60,7 +63,7 @@ public void testEscapedErrors() {
6063
FieldError fieldError = errors.getFieldError();
6164
assertTrue("Field error code not escaped", "NAME_EMPTY &".equals(fieldError.getCode()));
6265
assertTrue("Field value escaped", "empty &amp;".equals(errors.getFieldValue("name")));
63-
FieldError fieldErrorInList = (FieldError) errors.getFieldErrors().get(0);
66+
FieldError fieldErrorInList = errors.getFieldErrors().get(0);
6467
assertTrue("Same field error in list", fieldError.getDefaultMessage().equals(fieldErrorInList.getDefaultMessage()));
6568

6669
assertTrue("Correct name errors flag", errors.hasFieldErrors("name"));
@@ -70,7 +73,7 @@ public void testEscapedErrors() {
7073
assertTrue("Name error message escaped", "message: &amp;".equals(nameError.getDefaultMessage()));
7174
assertTrue("Name error code not escaped", "NAME_EMPTY &".equals(nameError.getCode()));
7275
assertTrue("Name value escaped", "empty &amp;".equals(errors.getFieldValue("name")));
73-
FieldError nameErrorInList = (FieldError) errors.getFieldErrors("name").get(0);
76+
FieldError nameErrorInList = errors.getFieldErrors("name").get(0);
7477
assertTrue("Same name error in list", nameError.getDefaultMessage().equals(nameErrorInList.getDefaultMessage()));
7578

7679
assertTrue("Correct age errors flag", errors.hasFieldErrors("age"));
@@ -80,9 +83,9 @@ public void testEscapedErrors() {
8083
assertTrue("Age error message escaped", "message: &lt;tag&gt;".equals(ageError.getDefaultMessage()));
8184
assertTrue("Age error code not escaped", "AGE_NOT_SET <tag>".equals(ageError.getCode()));
8285
assertTrue("Age value not escaped", (new Integer(0)).equals(errors.getFieldValue("age")));
83-
FieldError ageErrorInList = (FieldError) errors.getFieldErrors("age").get(0);
86+
FieldError ageErrorInList = errors.getFieldErrors("age").get(0);
8487
assertTrue("Same name error in list", ageError.getDefaultMessage().equals(ageErrorInList.getDefaultMessage()));
85-
FieldError ageError2 = (FieldError) errors.getFieldErrors("age").get(1);
88+
FieldError ageError2 = errors.getFieldErrors("age").get(1);
8689
assertTrue("Age error 2 message escaped", "message: &lt;tag&gt;".equals(ageError2.getDefaultMessage()));
8790
assertTrue("Age error 2 code not escaped", "AGE_NOT_32 <tag>".equals(ageError2.getCode()));
8891
}

‎org.springframework.web/src/test/java/org/springframework/web/util/HtmlCharacterEntityReferencesTests.java

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2005 the original author or authors.
2+
* Copyright 2002-2011 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -24,16 +24,19 @@
2424
import java.util.HashMap;
2525
import java.util.Map;
2626

27-
import junit.framework.TestCase;
27+
import org.junit.Test;
28+
29+
import static org.junit.Assert.*;
2830

2931
/**
3032
* @author Martin Kersten
3133
* @author Juergen Hoeller
3234
*/
33-
public class HtmlCharacterEntityReferencesTests extends TestCase {
35+
public class HtmlCharacterEntityReferencesTests {
3436

3537
private static final String DTD_FILE = "HtmlCharacterEntityReferences.dtd";
3638

39+
@Test
3740
public void testSupportsAllCharacterEntityReferencesDefinedByHtml() {
3841
HtmlCharacterEntityReferences entityReferences = new HtmlCharacterEntityReferences();
3942
Map referenceCharactersMap = getReferenceCharacterMap();
@@ -49,8 +52,12 @@ public void testSupportsAllCharacterEntityReferencesDefinedByHtml() {
4952
entityReferences.isMappedToReference((char) character));
5053
assertEquals("The reference of unicode character " + character + " should be entity " + referenceName,
5154
fullReference, entityReferences.convertToReference((char) character));
52-
assertEquals("The entity reference [" + referenceName + "] should be mapped to unicode character " + character,
53-
(char) character, entityReferences.convertToCharacter(referenceName));
55+
assertEquals("The entity reference [" + referenceName + "] should be mapped to unicode character " +
56+
character, (char) character, entityReferences.convertToCharacter(referenceName));
57+
}
58+
else if (character == 39) {
59+
assertTrue(entityReferences.isMappedToReference((char) character));
60+
assertEquals("&#39;", entityReferences.convertToReference((char) character));
5461
}
5562
else {
5663
assertFalse("The unicode character " + character + " should not be mapped to a reference",
@@ -61,17 +68,17 @@ public void testSupportsAllCharacterEntityReferencesDefinedByHtml() {
6168
}
6269

6370
assertEquals("The registered entity count of entityReferences should match the number of entity references",
64-
referenceCharactersMap.size(), entityReferences.getSupportedReferenceCount());
65-
assertEquals("The HTML 4.0 Standard defines 252 entity references so do entityReferences",
66-
252, entityReferences.getSupportedReferenceCount());
71+
referenceCharactersMap.size() + 1, entityReferences.getSupportedReferenceCount());
72+
assertEquals("The HTML 4.0 Standard defines 252+1 entity references so do entityReferences",
73+
252 + 1, entityReferences.getSupportedReferenceCount());
6774

68-
assertEquals("Invalid entity reference names should not be convertable",
75+
assertEquals("Invalid entity reference names should not be convertible",
6976
(char) -1, entityReferences.convertToCharacter("invalid"));
7077
}
7178

7279
private Map getReferenceCharacterMap() {
7380
CharacterEntityResourceIterator entityIterator = new CharacterEntityResourceIterator();
74-
Map referencedCharactersMap = new HashMap();
81+
Map<Integer, String> referencedCharactersMap = new HashMap<Integer, String>();
7582
while (entityIterator.hasNext()) {
7683
int character = entityIterator.getReferredCharacter();
7784
String entityName = entityIterator.nextEntry();
@@ -103,7 +110,7 @@ public CharacterEntityResourceIterator() {
103110
}
104111

105112
public boolean hasNext() {
106-
return (currentEntityName != null ? true : readNextEntity());
113+
return (currentEntityName != null || readNextEntity());
107114
}
108115

109116
public String nextEntry() {

0 commit comments

Comments
 (0)