From ce2e71955ffba7e8e8968c4221813c82f2c07a71 Mon Sep 17 00:00:00 2001 From: LMRob Date: Thu, 31 Jan 2019 18:29:00 +0800 Subject: [PATCH] MNT-20202 Improper Neutralization of CRLF Sequences in HTTP Headers A function call contains an HTTP response splitting flaw. Writing untrusted input into an HTTP header allows an attacker to manipulate the HTTP response rendered by the browser, leading to cache poisoning and cross-site scripting attacks. - encoded user input in site-index.jsp with encodeForURL method from ESAPI *NOTE: java class is created in alfresco/surf project, branch MNT-20202 --- share/src/main/webapp/site-index.jsp | 61 ++++++++++++++++------------ 1 file changed, 35 insertions(+), 26 deletions(-) diff --git a/share/src/main/webapp/site-index.jsp b/share/src/main/webapp/site-index.jsp index 46670858b8..3db518e2ac 100644 --- a/share/src/main/webapp/site-index.jsp +++ b/share/src/main/webapp/site-index.jsp @@ -1,36 +1,42 @@ -<%-- - #%L - Alfresco Share WAR - %% - Copyright (C) 2005 - 2016 Alfresco Software Limited - %% - This file is part of the Alfresco software. - If the software was purchased under a paid Alfresco license, the terms of - the paid license agreement will prevail. Otherwise, the software is - provided under the following open source license terms: - - Alfresco is free software: you can redistribute it and/or modify - it under the terms of the GNU Lesser General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - Alfresco is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public License - along with Alfresco. If not, see . - #L% - --%> +<%-- + #%L + Alfresco Share WAR + %% + Copyright (C) 2005 - 2016 Alfresco Software Limited + %% + This file is part of the Alfresco software. + If the software was purchased under a paid Alfresco license, the terms of + the paid license agreement will prevail. Otherwise, the software is + provided under the following open source license terms: + + Alfresco is free software: you can redistribute it and/or modify + it under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + Alfresco is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with Alfresco. If not, see . + #L% + --%> <%@ page import="org.alfresco.web.site.*" %> <%@ page import="org.springframework.extensions.surf.*" %> <%@ page import="org.springframework.extensions.surf.site.*" %> <%@ page import="org.springframework.extensions.surf.util.*" %> <%@ page import="java.util.*" %> + +<%@ page import="org.owasp.esapi.ESAPI" %> <% // retrieve user name from the session String userid = (String)session.getAttribute(SlingshotUserFactory.SESSION_ATTRIBUTE_KEY_USER_ID); + + // MNT-20202: neutralize redirect url that contains user input + // LM_2019-01-30 + userid = UserInputValidator.validateRedirectUrl(userid); // test user dashboard page exists? RequestContext context = (RequestContext)request.getAttribute(RequestContext.ATTR_REQUEST_CONTEXT); @@ -54,7 +60,10 @@ } else { + // MNT-20202: neutralize redirect url that contains user input + // LM_2019-01-30 + siteName = UserInputValidator.validateRedirectUrl(siteName); // forward to site specific dashboard page response.sendRedirect(request.getContextPath() + "/page/site/" + URLEncoder.encode(siteName)); - } + } %> \ No newline at end of file