Revision 8792
Added by ben leinfelder over 10 years ago
| src/edu/ucsb/nceas/metacat/MetaCatServlet.java | ||
|---|---|---|
| 48 | 48 |
import javax.servlet.http.HttpServletResponse; |
| 49 | 49 |
import javax.servlet.http.HttpSession; |
| 50 | 50 |
|
| 51 |
import org.apache.commons.lang.StringEscapeUtils; |
|
| 51 | 52 |
import org.apache.log4j.Logger; |
| 52 | 53 |
import org.apache.log4j.PropertyConfigurator; |
| 53 | 54 |
|
| ... | ... | |
| 927 | 928 |
response.setContentType("text/xml");
|
| 928 | 929 |
out.println("<?xml version=\"1.0\"?>");
|
| 929 | 930 |
out.println("<error>");
|
| 930 |
out.println("Permission denied for user " + userName + " " + action);
|
|
| 931 |
String cleanMessage = StringEscapeUtils.escapeXml("Permission denied for user " + userName + " " + action);
|
|
| 932 |
out.println(cleanMessage); |
|
| 931 | 933 |
out.println("</error>");
|
| 932 | 934 |
} |
| 933 | 935 |
out.close(); |
| ... | ... | |
| 940 | 942 |
response.setContentType("text/xml");
|
| 941 | 943 |
out.println("<?xml version=\"1.0\"?>");
|
| 942 | 944 |
out.println("<error>");
|
| 943 |
out.println("Permission denied for " + action);
|
|
| 945 |
String cleanMessage = StringEscapeUtils.escapeXml("Permission denied for " + action);
|
|
| 946 |
out.println(cleanMessage); |
|
| 944 | 947 |
out.println("</error>");
|
| 945 | 948 |
} |
| 946 | 949 |
out.close(); |
| ... | ... | |
| 1121 | 1124 |
PrintWriter out = response.getWriter(); |
| 1122 | 1125 |
out.println("<?xml version=\"1.0\"?>");
|
| 1123 | 1126 |
out.println("<error>");
|
| 1124 |
out.println("Error: action: " + action + " not registered. Please report this error.");
|
|
| 1127 |
String cleanMessage = StringEscapeUtils.escapeXml("Error: action: " + action + " not registered. Please report this error.");
|
|
| 1128 |
out.println(cleanMessage); |
|
| 1125 | 1129 |
out.println("</error>");
|
| 1126 | 1130 |
out.close(); |
| 1127 | 1131 |
} |
| src/edu/ucsb/nceas/metacat/MetacatHandler.java | ||
|---|---|---|
| 72 | 72 |
import org.apache.commons.fileupload.servlet.ServletFileUpload; |
| 73 | 73 |
import org.apache.commons.io.IOUtils; |
| 74 | 74 |
import org.apache.commons.io.input.XmlStreamReader; |
| 75 |
import org.apache.commons.lang.StringEscapeUtils; |
|
| 75 | 76 |
import org.apache.log4j.Logger; |
| 76 | 77 |
import org.dataone.service.types.v1.AccessPolicy; |
| 77 | 78 |
import org.dataone.service.types.v1.Event; |
| ... | ... | |
| 2098 | 2099 |
|
| 2099 | 2100 |
} catch (NullPointerException npe) {
|
| 2100 | 2101 |
|
| 2101 |
out.println("<error>Error getting document ID: " + docid
|
|
| 2102 |
out.println("<error>Error getting document ID: " + StringEscapeUtils.escapeXml(docid)
|
|
| 2102 | 2103 |
+ "</error>"); |
| 2103 | 2104 |
//if ( conn != null ) { util.returnConnection(conn); }
|
| 2104 | 2105 |
return; |
| ... | ... | |
| 2355 | 2356 |
|
| 2356 | 2357 |
out.println("<?xml version=\"1.0\"?>");
|
| 2357 | 2358 |
out.println("<isRegistered>");
|
| 2358 |
out.println("<docid>" + id + "</docid>");
|
|
| 2359 |
out.println("<docid>" + StringEscapeUtils.escapeXml(id) + "</docid>");
|
|
| 2359 | 2360 |
out.println("<exists>" + exists + "</exists>");
|
| 2360 | 2361 |
out.println("</isRegistered>");
|
| 2361 | 2362 |
} |
| ... | ... | |
| 2375 | 2376 |
Vector<String> docids = DBUtil.getAllDocids(scope); |
| 2376 | 2377 |
out.println("<?xml version=\"1.0\"?>");
|
| 2377 | 2378 |
out.println("<idList>");
|
| 2378 |
out.println(" <scope>" + scope + "</scope>");
|
|
| 2379 |
out.println(" <scope>" + StringEscapeUtils.escapeXml(scope) + "</scope>");
|
|
| 2379 | 2380 |
for(int i=0; i<docids.size(); i++) {
|
| 2380 | 2381 |
String docid = docids.elementAt(i); |
| 2381 | 2382 |
out.println(" <docid>" + docid + "</docid>");
|
| ... | ... | |
| 2408 | 2409 |
String lastDocid = dbutil.getMaxDocid(scope); |
| 2409 | 2410 |
out.println("<?xml version=\"1.0\"?>");
|
| 2410 | 2411 |
out.println("<lastDocid>");
|
| 2411 |
out.println(" <scope>" + scope + "</scope>");
|
|
| 2412 |
out.println(" <scope>" + StringEscapeUtils.escapeXml(scope) + "</scope>");
|
|
| 2412 | 2413 |
out.println(" <docid>" + lastDocid + "</docid>");
|
| 2413 | 2414 |
out.println("</lastDocid>");
|
| 2414 | 2415 |
|
| ... | ... | |
| 2837 | 2838 |
try {
|
| 2838 | 2839 |
DocumentImpl doc = new DocumentImpl(docid, false); |
| 2839 | 2840 |
doc.buildIndex(); |
| 2840 |
out.print("<docid>" + docid);
|
|
| 2841 |
out.print("<docid>" + StringEscapeUtils.escapeXml(docid));
|
|
| 2841 | 2842 |
out.println("</docid>");
|
| 2842 | 2843 |
} catch (McdbException me) {
|
| 2843 | 2844 |
out.print("<error>");
|
| ... | ... | |
| 2984 | 2985 |
} else {
|
| 2985 | 2986 |
out.println("<?xml version=\"1.0\"?>");
|
| 2986 | 2987 |
out.println("<error>");
|
| 2987 |
out.println("Permission denied for " + action);
|
|
| 2988 |
|
|
| 2989 |
out.println("Permission denied for upload action");
|
|
| 2988 | 2990 |
out.println("</error>");
|
| 2989 | 2991 |
} |
| 2990 | 2992 |
} else if(action.equals("insertmultipart")) {
|
| ... | ... | |
| 2995 | 2997 |
} else {
|
| 2996 | 2998 |
out.println("<?xml version=\"1.0\"?>");
|
| 2997 | 2999 |
out.println("<error>");
|
| 2998 |
out.println("Permission denied for " + action);
|
|
| 3000 |
out.println("Permission denied for insertmultipart action");
|
|
| 2999 | 3001 |
out.println("</error>");
|
| 3000 | 3002 |
} |
| 3001 | 3003 |
} else {
|
| ... | ... | |
| 3059 | 3061 |
"The docid "+docid +" is not valid since it is null or contians the white space(s)."); |
| 3060 | 3062 |
if (qformat == null || qformat.equals("xml")) {
|
| 3061 | 3063 |
response.setContentType("text/xml");
|
| 3062 |
out.println(output); |
|
| 3064 |
String cleanMessage = StringEscapeUtils.escapeXml(output); |
|
| 3065 |
out.println(cleanMessage); |
|
| 3063 | 3066 |
} else {
|
| 3064 | 3067 |
try {
|
| 3065 | 3068 |
DBTransform trans = new DBTransform(); |
Also available in: Unified diff
prevent js scriptlets from running when we return error messages to the client by escaping any potentially harmful xml blocks. https://projects.ecoinformatics.org/ecoinfo/issues/6224