doortts doortts 2017-04-16
sanitize: Apply sanitization and fix vulnerability
@645f6f116feaf45fdeea10d9dca7043852e3c6cb
app/controllers/UserApp.java
--- app/controllers/UserApp.java
+++ app/controllers/UserApp.java
@@ -51,6 +51,7 @@
 import static play.data.Form.form;
 import static play.libs.Json.toJson;
 import static utils.HtmlUtil.defaultSanitize;
+import org.apache.commons.lang3.StringEscapeUtils;
 
 public class UserApp extends Controller {
     public static final String SESSION_USERID = "userId";
@@ -843,7 +844,7 @@
             return badRequest(edit.render(userForm, user));
         }
         user.email = newEmail;
-        user.name = newName;
+        user.name = HtmlUtil.defaultSanitize(newName);
 
         try {
             Long avatarId = Long.valueOf(userForm.data().get("avatarId"));
app/views/common/partial_history.scala.html
--- app/views/common/partial_history.scala.html
+++ app/views/common/partial_history.scala.html
@@ -7,6 +7,7 @@
 @(posting:models.AbstractPosting)
 
 @import utils.TemplateHelper._
+@import utils.HtmlUtil
 
 <div id="-yona-posting-history" class="modal hide">
     <div class="modal-header">
@@ -15,7 +16,7 @@
     </div>
     <div class="modal-body">
         <p>
-            @Html(posting.history)
+            @Html(HtmlUtil.defaultSanitize(posting.history))
         </p>
     </div>
     <div class="modal-footer">
app/views/common/select2.scala.html
--- app/views/common/select2.scala.html
+++ app/views/common/select2.scala.html
@@ -1,22 +1,8 @@
 @**
-* Yobi, Project Hosting SW
+* Yona, 21st Century Project Hosting SW
 *
-* Copyright 2013 NAVER Corp.
-* http://yobi.io
-*
-* @author JiHan Kim
-*
-* Licensed under the Apache License, Version 2.0 (the "License");
-* you may not use this file except in compliance with the License.
-* You may obtain a copy of the License at
-*
-*   http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
+* Copyright Yona & Yobi Authors & NAVER Corp.
+* https://yona.io
 **@
 
 <script src="@routes.Assets.at("javascripts/lib/select2/select2.js")"></script>
app/views/index/partial_notifications.scala.html
--- app/views/index/partial_notifications.scala.html
+++ app/views/index/partial_notifications.scala.html
@@ -1,27 +1,14 @@
 @**
-* Yobi, Project Hosting SW
+* Yona, 21st Century Project Hosting SW
 *
-* Copyright 2013 NAVER Corp.
-* http://yobi.io
-*
-* @author Yi EungJun
-*
-* Licensed under the Apache License, Version 2.0 (the "License");
-* you may not use this file except in compliance with the License.
-* You may obtain a copy of the License at
-*
-*   http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
+* Copyright Yona & Yobi Authors & NAVER Corp.
+* https://yona.io
 **@
 @(from: Integer, size: Integer)
 
 @import utils.TemplateHelper._
 @import utils.JodaDateUtil
+@import utils.HtmlUtil
 
 @notifycationIcon(notifytype: EventType, state: String) = @{
     notifytype match {
@@ -80,7 +67,7 @@
                     }
                 </div>
                 <div class="message-wrap nowrap" id="message-@noti.id">
-                    <div class="message">@Html(noti.getMessage.replaceAll("\n", "<br/>\n"))</div>
+                    <div class="message">@Html(HtmlUtil.defaultSanitize(noti.getMessage.replaceAll("\n", "<br/>\n")))</div>
                 </div>
                 <div class="meta">
                     @if(user != null){
app/views/issue/partial_searchform.scala.html
--- app/views/issue/partial_searchform.scala.html
+++ app/views/issue/partial_searchform.scala.html
@@ -1,22 +1,8 @@
 @**
-* Yobi, Project Hosting SW
+* Yona, 21st Century Project Hosting SW
 *
-* Copyright 2014 NAVER Corp.
-* http://yobi.io
-*
-* @author Jihan Kim
-*
-* Licensed under the Apache License, Version 2.0 (the "License");
-* you may not use this file except in compliance with the License.
-* You may obtain a copy of the License at
-*
-*   http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
+* Copyright Yona & Yobi Authors & NAVER Corp.
+* https://yona.io
 **@
 @(param:models.support.SearchCondition, project:Project)
 
app/views/user/edit.scala.html
--- app/views/user/edit.scala.html
+++ app/views/user/edit.scala.html
@@ -1,27 +1,14 @@
 @**
-* Yobi, Project Hosting SW
+* Yona, 21st Century Project Hosting SW
 *
-* Copyright 2012 NAVER Corp.
-* http://yobi.io
-*
-* @author Ahn Hyeok Jun
-*
-* Licensed under the Apache License, Version 2.0 (the "License");
-* you may not use this file except in compliance with the License.
-* You may obtain a copy of the License at
-*
-*   http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
+* Copyright Yona & Yobi Authors & NAVER Corp.
+* https://yona.io
 **@
 @(userForm: play.data.Form[User], user:User)
 
 @import helper._
 @import utils.TemplateHelper._
+@import utils.HtmlUtil
 
 @siteLayout(user.loginId, utils.MenuType.USER) {
 <div class="site-breadcrumb-outer">
@@ -41,7 +28,7 @@
             </dd>
           <dt>@Messages("user.name")</dt>
           <dd class="mt10">
-            <input type="text" name="name" class="text" value="@user.name">
+            <input type="text" name="name" class="text" value="@HtmlUtil.defaultSanitize(user.name)">
           </dd>
           <dt>@Messages("user.email")</dt>
           <dd class="mt10">
public/javascripts/common/yobi.ui.Dialog.js
--- public/javascripts/common/yobi.ui.Dialog.js
+++ public/javascripts/common/yobi.ui.Dialog.js
@@ -101,7 +101,7 @@
             var aButtonStyles = htOptions.aButtonStyles || [];
 
             for(var i = 0, nLength = aButtonLabels.length; i < nLength; i++){
-                aButtonsHTML.push($yobi.tmpl(htVar.sTplCustomButton, {
+                aButtonsHTML.push($.tmpl(htVar.sTplCustomButton, {
                     "text" : aButtonLabels[i],
                     "class": aButtonStyles[i] || (aButtonStyles.length === 0 && i === nLength-1 ? "ybtn-primary" : "ybtn-default")
                 }));
public/javascripts/common/yobi.ui.Select2.js
--- public/javascripts/common/yobi.ui.Select2.js
+++ public/javascripts/common/yobi.ui.Select2.js
@@ -51,18 +51,18 @@
                 }
 
                 if(_doesntHaveProjectAvatar()){
-                    return $yobi.tmpl($("#tplSelect2ProjectsWithoutAvatar").text(), {
+                    return $.tmpl($("#tplSelect2ProjectsWithoutAvatar").text(), {
                         "name"     : itemObject.text
                     });
                 } else {
-                    return $yobi.tmpl($("#tplSelect2Projects").text(), {
+                    return $.tmpl($("#tplSelect2Projects").text(), {
                         "avatarURL": avatarURL,
                         "name"     : itemObject.text.trim()
                     });
                 }
             },
             "issues": function(itemObject){
-                return $yobi.tmpl($("#tplSelect2FormatIssues").text(), {
+                return $.tmpl($("#tplSelect2FormatIssues").text(), {
                     "name"     : itemObject.text
                 });
             },
@@ -82,7 +82,7 @@
 
                 var loginId = itemElement.data("loginId") ? "@" + itemElement.data("loginId") : "";
 
-                var formattedResult = $yobi.tmpl(tplUserItem, {
+                var formattedResult = $.tmpl(tplUserItem, {
                     "avatarURL": avatarURL,
                     "name"     : itemObject.text.trim(),
                     "loginId"  : loginId
@@ -103,7 +103,7 @@
                 var tplMilestoneItem = $("#tplSElect2FormatMilestone").text()
                                     || '<div title="[${stateLabel}] ${name}">${name}</div>';
 
-                var formattedResult = $yobi.tmpl(tplMilestoneItem, {
+                var formattedResult = $.tmpl(tplMilestoneItem, {
                     "name" : itemObject.text.trim().replace('<', '&lt;'),
                     "state": milestoneState,
                     "stateLabel": milestoneStateLabel
@@ -128,7 +128,7 @@
                     };
                     var tpl = '<i class="${css}" data-toggle="tooltip" data-html="true" data-placement="right" title="${title}"></i><span>${text}</span>';
 
-                    return $yobi.tmpl(tpl, data);
+                    return $.tmpl(tpl, data);
                 }
 
                 return '<a class="label issue-label active static" data-label-id="' + labelId + '">' + text + '</a>';
@@ -157,7 +157,7 @@
 
                 // branchType will be "unknown"
                 // if selected branch name doesn't starts with /refs
-                var formattedResult = $yobi.tmpl(tplBranchItem, {
+                var formattedResult = $.tmpl(tplBranchItem, {
                     "branchType": branchType,
                     "branchName": branchName
                 });
public/javascripts/service/yobi.code.Browser.js
--- public/javascripts/service/yobi.code.Browser.js
+++ public/javascripts/service/yobi.code.Browser.js
@@ -245,7 +245,7 @@
                 if(htSortedData[sType] instanceof Array){
                     htSortedData[sType].forEach(function(htFile){
                         htFile = _getFileInfoForTpl(htFile, sTargetPath);
-                        aHTML.push($yobi.tmpl(htVar.sTplListItem, htFile));
+                        aHTML.push($.tmpl(htVar.sTplListItem, htFile));
                     });
                 }
             });
public/javascripts/service/yobi.code.Diff.js
--- public/javascripts/service/yobi.code.Diff.js
+++ public/javascripts/service/yobi.code.Diff.js
@@ -651,7 +651,7 @@
                 waTargets.each(function(i, el){
                     welTarget = $(el);
 
-                    aLinks.push($yobi.tmpl(htVar.sTplMiniMapLink, {
+                    aLinks.push($.tmpl(htVar.sTplMiniMapLink, {
                         "id"    : welTarget.attr("id"),
                         "top"   : Math.ceil(welTarget.offset().top * htVar.nMiniMapRatio),
                         "height": Math.ceil(welTarget.height() * htVar.nMiniMapRatio)
public/javascripts/service/yobi.code.SvnDiff.js
--- public/javascripts/service/yobi.code.SvnDiff.js
+++ public/javascripts/service/yobi.code.SvnDiff.js
@@ -515,7 +515,7 @@
                 waTargets.each(function(i, el){
                     welTarget = $(el);
 
-                    aLinks.push($yobi.tmpl(htVar.sTplMiniMapLink, {
+                    aLinks.push($.tmpl(htVar.sTplMiniMapLink, {
                         "id"    : welTarget.attr("id"),
                         "top"   : Math.ceil(welTarget.offset().top * htVar.nMiniMapRatio),
                         "height": Math.ceil(welTarget.height() * htVar.nMiniMapRatio)
public/javascripts/service/yobi.issue.MassUpdate.js
--- public/javascripts/service/yobi.issue.MassUpdate.js
+++ public/javascripts/service/yobi.issue.MassUpdate.js
@@ -226,7 +226,7 @@
                 // Label
                 for(sLabelId in htLabels[sCategory]){
                     htLabel = htLabels[sCategory][sLabelId];
-                    aHTML.push($yobi.tmpl(sTpl, htLabel));
+                    aHTML.push($.tmpl(sTpl, htLabel));
                 }
 
                 aHTML.push('<li class="divider"></li>');
public/javascripts/yona-lib.js
--- public/javascripts/yona-lib.js
+++ public/javascripts/yona-lib.js
@@ -35,7 +35,7 @@
 32:"SPACE",8:"BACKSPACE",9:"TAB",46:"DELETE",33:"PAGEUP",34:"PAGEDOWN",36:"HOME",35:"END",65:"A",66:"B",67:"C",68:"D",69:"E",70:"F",71:"G",72:"H",73:"I",74:"J",75:"K",76:"L",77:"M",78:"N",79:"O",80:"P",81:"Q",82:"R",83:"S",84:"T",85:"U",86:"V",87:"W",88:"X",89:"Y",90:"Z",48:"0",49:"1",50:"2",51:"3",52:"4",53:"5",54:"6",55:"7",56:"8",57:"9",219:"[",221:"]",186:";",222:"'",188:",",190:".",191:"/",189:"-",187:"=",220:"\\",192:"`",112:"F1",113:"F2",114:"F3",115:"F4",116:"F5",117:"F6",118:"F7",119:"F8",
 120:"F9",121:"F10",122:"F11",123:"F12"};$(window).on({keydown:q,beforeunload:l});return{attach:r,detach:u,getHandlers:function(){return e},setKeymapLink:function(c){var b,a=function(a){a.bFormInput||(document.location.href=c[a.sKeyInput])};for(b in c)c[b]?r(b,a):u(b)}}}();(function(h){h=$yobi.createNamespace(h);h.container[h.name]=function(h,r){function u(b){if("function"===typeof e.fOnClickButton&&!1===e.fOnClickButton({weEvt:b,nButtonIndex:$(this).index()}))return!1;k()}function k(){c.welContainer.modal("hide")}function l(){"function"==typeof e.fOnAfterShow&&e.fOnAfterShow();e.bAutoFocusOnLastButton&&c.welButtons.find(".ybtn-primary:last,button:last").focus()}function f(){c.welMessage.html("");"function"==typeof e.fOnAfterHide&&e.fOnAfterHide()}var e={},c={};(function(b,
 a){e.sDefaultButton='<button type="button" class="ybtn ybtn-info" data-dismiss="modal">'+Messages("button.confirm")+"</button>";e.sTplCustomButton='<button type="button" class="ybtn ${class}">${text}</button>';e.bAutoFocusOnLastButton="undefined"!==typeof a.bAutoFocusOnLastButton?a.bAutoFocusOnLastButton:!0;c.welContainer=$(b).clone();c.welMessage=c.welContainer.find(".msg");c.welDescription=c.welContainer.find(".desc");c.welButtons=c.welContainer.find(".buttons");c.welContainer.modal({show:!1});
-c.welContainer.on("shown",l);c.welContainer.on("hidden",f);c.welContainer.on("click","button.ybtn",u)})(h,r||{});return{show:function(b,a,d){e.fOnAfterShow=d.fOnAfterShow;e.fOnAfterHide=d.fOnAfterHide;e.fOnClickButton=d.fOnClickButton;var f;if(d.aButtonLabels){f=[];var k=d.aButtonLabels;d=d.aButtonStyles||[];for(var h=0,l=k.length;h<l;h++)f.push($yobi.tmpl(e.sTplCustomButton,{text:k[h],"class":d[h]||(0===d.length&&h===l-1?"ybtn-primary":"ybtn-default")}));f=f.join("")}else f=e.sDefaultButton;c.welButtons.html(f);
+c.welContainer.on("shown",l);c.welContainer.on("hidden",f);c.welContainer.on("click","button.ybtn",u)})(h,r||{});return{show:function(b,a,d){e.fOnAfterShow=d.fOnAfterShow;e.fOnAfterHide=d.fOnAfterHide;e.fOnClickButton=d.fOnClickButton;var f;if(d.aButtonLabels){f=[];var k=d.aButtonLabels;d=d.aButtonStyles||[];for(var h=0,l=k.length;h<l;h++)f.push($.tmpl(e.sTplCustomButton,{text:k[h],"class":d[h]||(0===d.length&&h===l-1?"ybtn-primary":"ybtn-default")}));f=f.join("")}else f=e.sDefaultButton;c.welButtons.html(f);
 c.welMessage.html($yobi.nl2br(b));c.welDescription.html($yobi.nl2br(a||""));c.welContainer.modal("show")},hide:k}}})("yobi.ui.Dialog");(function(h){h=$yobi.createNamespace(h);h.container[h.name]=function(h){function r(b){if(0<b.originalEvent.deltaY&&a.welList.scrollTop()+a.welList.height()===a.welList.get(0).scrollHeight||0>b.originalEvent.deltaY&&0===a.welList.scrollTop())return b.preventDefault(),b.stopPropagation(),!1}function u(a){var b=$(a.target),b="LI"===a.target.tagName?b:$(b.parents("li")[0]);if(0===b.length||"undefined"===typeof b.attr("data-value"))return a.stopPropagation(),a.preventDefault(),!1;k(b);l(b);f()}function k(b){a.welSelectedLabel.html(b.html());
 a.waItems.removeClass("active");b.addClass("active")}function l(c){c=c.attr("data-value");var e=a.welContainer.attr("data-name");b.sName=e;b.sValue=c;if("undefined"!==typeof e){var f=a.welContainer.find("input[name='"+e+"']");0===f.length&&(f=$('<input type="hidden" name="'+e+'">'),a.welContainer.append(f));f.val(c)}}function f(){"function"==typeof b.fOnChange&&setTimeout(function(){b.fOnChange(e())},0)}function e(){return b.sValue}function c(b){b=a.welContainer.find(b);if(0>=b.length)return!1;b=
 $(b[0]);k(b);l(b);return!0}var b={sValue:""},a={};(function(d){a.welContainer=$(d.elContainer);a.welSelectedLabel=a.welContainer.find(".d-label");a.welList=a.welContainer.find(".dropdown-menu");a.waItems=a.welList.find("li");a.welList.on("click","li",u);a.welList.on("mousewheel",r);b.fOnChange=d.fOnChange;c("li[data-selected=true]")})(h);return{getValue:e,onChange:function(a){b.fOnChange=a;return!0},selectByValue:function(a){return c("li[data-value='"+a+"']")},selectItem:c}}})("yobi.ui.Dropdown");$(document).ready(function(){function h(k,h){var f;h=$("#"+k).find("li > a");(f=localStorage.getItem("yobitab-"+k))&&h[f]&&(f=$(h[f]))&&f.data(!1)&&f.tab("show")}var q,r,u;$(".nav-tabs[id]").each(function(k,l){r=$(l);u=r.attr("id");"undefined"!=typeof u&&(q=r.find("li"),q.click(function(){localStorage.setItem("yobitab-"+u,$(this).index())}),h(u,q))})});(function(h){h=$yobi.createNamespace(h);h.container[h.name]=function(h,r){function u(c){$(this).remove()}function k(c,b){c.bind("webkitTransitionEnd",function(){c.remove()});setTimeout(function(){c.css("opacity",0)},b)}var l,f,e;(function(c,b){b.sTplToast=b.sTplToast.replace("\n","");l=b.sTplToast||'<div class="toast" tabindex="-1">            <div class="btn-dismiss"><button type="button" class="btn-transparent">&times;</button></div>            <div class="center-text msg"></div></div>';f=$(c);
Add a comment
List