fix #282

src/main/java/jp/sf/fess/action/admin/dict/SynonymAction.java

@@ -187,12 +187,22 @@ public class SynonymAction {
     @Token(save = false, validate = true, keep = true)
     @Execute(validator = true, input = "edit.jsp")
     public String confirmfromcreate() {
+        final String[] newInputs = splitLine(synonymForm.inputs);
+        validateSynonymString(newInputs);
+        final String[] newOutputs = splitLine(synonymForm.outputs);
+        validateSynonymString(newOutputs);
+
         return "confirm.jsp";
     }
 
     @Token(save = false, validate = true, keep = true)
     @Execute(validator = true, input = "edit.jsp")
     public String confirmfromupdate() {
+        final String[] newInputs = splitLine(synonymForm.inputs);
+        validateSynonymString(newInputs);
+        final String[] newOutputs = splitLine(synonymForm.outputs);
+        validateSynonymString(newOutputs);
+
         return "confirm.jsp";
     }
 
@@ -413,13 +423,29 @@ public class SynonymAction {
         }
 
         final String[] newInputs = splitLine(synonymForm.inputs);
+        validateSynonymString(newInputs);
         synonymItem.setNewInputs(newInputs);
         final String[] newOutputs = splitLine(synonymForm.outputs);
+        validateSynonymString(newOutputs);
         synonymItem.setNewOutputs(newOutputs);
 
         return synonymItem;
     }
 
+    private void validateSynonymString(String[] values) {
+        if (values.length == 0) {
+            return;
+        }
+        for (String value : values) {
+            if (value.indexOf(",") >= 0) {
+                throw new SSCActionMessagesException("errors.invalid_str_is_included", value, ",");
+            }
+            if (value.indexOf("=>") >= 0) {
+                throw new SSCActionMessagesException("errors.invalid_str_is_included", value, "=>");
+            }
+        }
+    }
+
     private String[] splitLine(final String value) {
         if (StringUtil.isBlank(value)) {
             return StringUtil.EMPTY_STRINGS;

src/main/resources/application.properties

@@ -80,6 +80,7 @@ errors.failed_to_upload_synonym_file=Failed to upload the Synonym file.
 errors.userdict_file_is_not_found=Synonym file is not found
 errors.failed_to_download_userdict_file=Failed to download the UserDict file.
 errors.failed_to_upload_userdict_file=Failed to upload the UserDict file.
+errors.invalid_str_is_included="{1}" in "{0}" is invalid.
 
 errors.invalid_query_unknown=The given query is invalid.
 errors.invalid_query_quoted=An invalid quote character is used.

src/main/resources/application_en.properties

@@ -80,6 +80,7 @@ errors.failed_to_upload_synonym_file=Failed to upload the Synonym file.
 errors.userdict_file_is_not_found=Synonym file is not found
 errors.failed_to_download_userdict_file=Failed to download the UserDict file.
 errors.failed_to_upload_userdict_file=Failed to upload the UserDict file.
+errors.invalid_str_is_included="{1}" in "{0}" is invalid.
 
 errors.invalid_query_unknown=The given query is invalid.
 errors.invalid_query_quoted=An invalid quote character is used.

src/main/resources/application_ja.properties

@@ -80,6 +80,7 @@ errors.failed_to_upload_synonym_file=\u540c\u7fa9\u8a9e\u30d5\u30a1\u30a4\u30eb\
 errors.userdict_file_is_not_found=\u30e6\u30fc\u30b6\u30fc\u8f9e\u66f8\u30d5\u30a1\u30a4\u30eb\u304c\u898b\u3064\u304b\u308a\u307e\u305b\u3093\u3002
 errors.failed_to_download_userdict_file=\u30e6\u30fc\u30b6\u30fc\u8f9e\u66f8\u30d5\u30a1\u30a4\u30eb\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u306b\u5931\u6557\u3057\u307e\u3057\u305f\u3002
 errors.failed_to_upload_userdict_file=\u30e6\u30fc\u30b6\u30fc\u8f9e\u66f8\u30d5\u30a1\u30a4\u30eb\u306e\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306b\u5931\u6557\u3057\u307e\u3057\u305f\u3002
+errors.invalid_str_is_included=\u300c{1}\u300d\u306f\u5229\u7528\u3067\u304d\u307e\u305b\u3093\u3002\u300c{0}\u300d\u306b\u300c{1}\u300d\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002
 
 errors.invalid_query_unknown=\u691c\u7d22\u30af\u30a8\u30ea\u304c\u6b63\u3057\u304f\u3042\u308a\u307e\u305b\u3093\u3002
 errors.invalid_query_quoted=\u30af\u30aa\u30fc\u30c8\u6587\u5b57(")\u306e\u5229\u7528\u65b9\u6cd5\u304c\u6b63\u3057\u304f\u3042\u308a\u307e\u305b\u3093\u3002