8000 prevent JS in link to github · github-cloud/github-plugin@159934f · GitHub
[go: up one dir, main page]
Skip to content

Commit 159934f

Browse files
lanwenlanwen
committed
prevent JS in link to github
1 parent 44a8781 commit 159934f

File tree

3 files changed

+66
-4
lines changed

3 files changed

+66
-4
lines changed

‎src/main/java/com/coravy/hudson/plugins/github/GithubLinkAction.java

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
package com.coravy.hudson.plugins.github;
22

3-
import java.util.Collection;
4-
import java.util.Collections;
5-
63
import hudson.Extension;
74
import hudson.model.Action;
85
import hudson.model.Job;
96
import jenkins.model.TransientActionFactory;
7+
import org.jenkinsci.plugins.github.util.XSSApi;
8+
9+
import java.util.Collection;
10+
import java.util.Collections;
1011

1112
/**
1213
* Add the Github Logo/Icon to the sidebar.
@@ -33,7 +34,7 @@ public String getIconFileName() {
3334

3435
@Override
3536
public String getUrlName() {
36-
return projectProperty.getProjectUrl().baseUrl();
37+
return XSSApi.asValidHref(projectProperty.getProjectUrl().baseUrl());
3738
}
3839

3940
@SuppressWarnings("rawtypes")

‎src/main/java/org/jenkinsci/plugins/github/util/XSSApi.java

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
package org.jenkinsci.plugins.github.util;
2+
3+
import java.net.MalformedURLException;
4+
import java.net.URL;
5+
6+
/**
7+
* @author lanwen (Merkushev Kirill)
8+
*/
9+
public final class XSSApi {
10+
private XSSApi() {
11+
}
12+
13+
/**
14+
* Method to filter invalid url for XSS. This url can be inserted to href safely
15+
*
16+
* @param urlString unsafe url
17+
*
18+
* @return safe url
19+
*/
20+
public static String asValidHref(String urlString) {
21+
try {
22+
return new URL(urlString).toExternalForm();
23+
} catch (MalformedURLException e) {
24+
return "";
25+
}
26+
}
27+
}

‎src/test/java/org/jenkinsci/plugins/github/util/XSSApiTest.java

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
package org.jenkinsci.plugins.github.util;
2+
3+
import com.tngtech.java.junit.dataprovider.DataProvider;
4+
import com.tngtech.java.junit.dataprovider.DataProviderRunner;
5+
import com.tngtech.java.junit.dataprovider.UseDataProvider;
6+
import org.junit.Test;
7+
import org.junit.runner.RunWith;
8+
9+
import static org.hamcrest.MatcherAssert.assertThat;
10+
import static org.hamcrest.Matchers.is;
11+
12+
/**
13+
* @author lanwen (Merkushev Kirill)
14+
*/
15+
@RunWith(DataProviderRunner.class)
16+
public class XSSApiTest {
17+
18+
@DataProvider
19+
public static Object[][] links() {
20+
return new Object[][]{
21+
new Object[]{"javascript:alert(1);//", ""},
22+
new Object[]{"http://abcxyz.com?a=b&c=d';alert(1);//", "http://abcxyz.com?a=b&c=d';alert(1);//"},
23+
new Object[]{"http://github.com/bla/bla", "http://github.com/bla/bla"},
24+
new Object[]{"https://github.com/bla/bla", "https://github.com/bla/bla"},
25+
new Object[]{"https://company.com/bla", "https://company.com/bla"}
26+
};
27+
}
28+
29+
@Test
30+
@UseDataProvider("links")
31+
public void shouldSanitizeUrl(String url, String expected) throws Exception {
32+
assertThat(XSSApi.asValidHref(url), is(expected));
33+
}
34+
}

0 commit comments

Comments
 (0)
0