diff --git a/src/main/java/org/codelibs/fess/app/web/admin/design/AdminDesignAction.java b/src/main/java/org/codelibs/fess/app/web/admin/design/AdminDesignAction.java index 05177e818..2a6e17195 100644 --- a/src/main/java/org/codelibs/fess/app/web/admin/design/AdminDesignAction.java +++ b/src/main/java/org/codelibs/fess/app/web/admin/design/AdminDesignAction.java @@ -22,6 +22,7 @@ import java.net.URLDecoder; import java.util.ArrayList; import java.util.List; import java.util.Locale; +import java.util.regex.Pattern; import org.apache.commons.io.FileUtils; import org.apache.logging.log4j.LogManager; @@ -47,6 +48,10 @@ import org.lastaflute.web.ruts.process.ActionRuntime; */ public class AdminDesignAction extends FessAdminAction { + private static final String CACHE_AND_SESSION_INVALIDATE_STATEMENT = ""; + + private static final String TRY_STATEMENT = ""; + public static final String ROLE = "admin-design"; private static final Logger logger = LogManager.getLogger(AdminDesignAction.class); @@ -237,7 +242,7 @@ public class AdminDesignAction extends FessAdminAction { final String jspType = "view"; final File jspFile = getJspFile(form.fileName, jspType); try { - form.content = new String(FileUtil.readBytes(jspFile), Constants.UTF_8); + form.content = encodeJsp(new String(FileUtil.readBytes(jspFile), Constants.UTF_8)); } catch (final UnsupportedEncodingException e) { throw new FessSystemException("Invalid encoding", e); } @@ -251,7 +256,7 @@ public class AdminDesignAction extends FessAdminAction { final String jspType = "orig/view"; final File jspFile = getJspFile(form.fileName, jspType); try { - form.content = new String(FileUtil.readBytes(jspFile), Constants.UTF_8); + form.content = encodeJsp(new String(FileUtil.readBytes(jspFile), Constants.UTF_8)); } catch (final UnsupportedEncodingException e) { throw new FessSystemException("Invalid encoding", e); } @@ -272,7 +277,7 @@ public class AdminDesignAction extends FessAdminAction { validate(form, messages -> {}, () -> asEditHtml(form)); verifyToken(() -> asEditHtml(form)); try { - write(jspFile.getAbsolutePath(), form.content.getBytes(Constants.UTF_8)); + write(jspFile.getAbsolutePath(), decodeJsp(form.content).getBytes(Constants.UTF_8)); saveInfo(messages -> messages.addSuccessUpdateDesignJspFile(GLOBAL, jspFile.getAbsolutePath())); } catch (final Exception e) { logger.warn("Failed to update {}", form.fileName, e); @@ -351,4 +356,15 @@ public class AdminDesignAction extends FessAdminAction { data.register("displayFileName", getJspFile(form.fileName, "view").getAbsolutePath()); }); } + + public static String decodeJsp(final String value) { + return value.replaceAll("<%(?![@-])([\\s\\S]*?)%>", "<%$1%>").replaceAll("<%=([\\s\\S]*?)%>", "<%=$1%>") + .replaceAll(TRY_STATEMENT, "<% try{ %>") + .replaceAll(CACHE_AND_SESSION_INVALIDATE_STATEMENT, "<% }catch(Exception e){session.invalidate();} %>"); + } + + public static String encodeJsp(final String value) { + return value.replaceAll(Pattern.quote("<% try{ %>"), TRY_STATEMENT) + .replaceAll(Pattern.quote("<% }catch(Exception e){session.invalidate();} %>"), CACHE_AND_SESSION_INVALIDATE_STATEMENT); + } } diff --git a/src/main/resources/fess.xml b/src/main/resources/fess.xml index 310b2b420..e048188de 100644 --- a/src/main/resources/fess.xml +++ b/src/main/resources/fess.xml @@ -95,10 +95,6 @@ "errorSystem" "error/system.jsp" - - "errorRedirect" - "error/redirect.jsp" - "errorBadRequest" "error/badRequest.jsp" diff --git a/src/main/webapp/WEB-INF/view/error/badRequest.jsp b/src/main/webapp/WEB-INF/view/error/badRequest.jsp index 696280940..f204509e1 100644 --- a/src/main/webapp/WEB-INF/view/error/badRequest.jsp +++ b/src/main/webapp/WEB-INF/view/error/badRequest.jsp @@ -24,7 +24,7 @@ - + @@ -32,4 +32,4 @@ -<% }catch(Exception e){ session.invalidate();}%> +<% }catch(Exception e){session.invalidate();} %> diff --git a/src/main/webapp/WEB-INF/view/error/error.jsp b/src/main/webapp/WEB-INF/view/error/error.jsp index 90659d775..273160f09 100644 --- a/src/main/webapp/WEB-INF/view/error/error.jsp +++ b/src/main/webapp/WEB-INF/view/error/error.jsp @@ -28,7 +28,7 @@ - + diff --git a/src/main/webapp/WEB-INF/view/error/notFound.jsp b/src/main/webapp/WEB-INF/view/error/notFound.jsp index a860ab65c..d3238399a 100644 --- a/src/main/webapp/WEB-INF/view/error/notFound.jsp +++ b/src/main/webapp/WEB-INF/view/error/notFound.jsp @@ -26,7 +26,7 @@ - + diff --git a/src/main/webapp/WEB-INF/view/error/system.jsp b/src/main/webapp/WEB-INF/view/error/system.jsp index 134ba7f3d..42a15f777 100644 --- a/src/main/webapp/WEB-INF/view/error/system.jsp +++ b/src/main/webapp/WEB-INF/view/error/system.jsp @@ -24,7 +24,7 @@ - + @@ -32,4 +32,4 @@ -<% }catch(Exception e){ session.invalidate();}%> +<% }catch(Exception e){session.invalidate();} %> diff --git a/src/test/java/org/codelibs/fess/app/web/admin/design/AdminDesignActionTest.java b/src/test/java/org/codelibs/fess/app/web/admin/design/AdminDesignActionTest.java new file mode 100644 index 000000000..c774f4f73 --- /dev/null +++ b/src/test/java/org/codelibs/fess/app/web/admin/design/AdminDesignActionTest.java @@ -0,0 +1,42 @@ +/* + * Copyright 2012-2024 CodeLibs Project and the Others. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language + * governing permissions and limitations under the License. + */ +package org.codelibs.fess.app.web.admin.design; + +import org.codelibs.fess.unit.UnitFessTestCase; + +public class AdminDesignActionTest extends UnitFessTestCase { + public void test_decodeJsp() { + assertEquals("<% a %>", AdminDesignAction.decodeJsp("<% a %>")); + assertEquals("<%= a %>", AdminDesignAction.decodeJsp("<%= a %>")); + assertEquals("<% a\nb %>", AdminDesignAction.decodeJsp("<% a\nb %>")); + assertEquals("<%= a\nb %>", AdminDesignAction.decodeJsp("<%= a\nb %>")); + assertEquals("<% a", AdminDesignAction.decodeJsp("<% a")); + assertEquals("<%= a", AdminDesignAction.decodeJsp("<%= a")); + assertEquals("<% try{ %>", AdminDesignAction.decodeJsp("")); + assertEquals("<% }catch(Exception e){session.invalidate();} %>", + AdminDesignAction.decodeJsp("")); + assertEquals("<% a %> %>", AdminDesignAction.decodeJsp("<% a %> %>")); + assertEquals("<% a %> <%", AdminDesignAction.decodeJsp("<% a %> <%")); + assertEquals("<% <% a %>", AdminDesignAction.decodeJsp("<% <% a %>")); + assertEquals("%> <% a %>", AdminDesignAction.decodeJsp("%> <% a %>")); + } + + public void test_encodeJsp() { + assertEquals("", AdminDesignAction.encodeJsp("<% try{ %>")); + assertEquals("", + AdminDesignAction.encodeJsp("<% }catch(Exception e){session.invalidate();} %>")); + } +}