1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
From: Markus Koschany <apo@gambaru.de>
Date: Thu, 23 Jan 2014 00:03:13 +0100
Subject: CVE-2013-6430
Bug: http://bugs.debian.org/735420
---
.../springframework/web/util/JavaScriptUtils.java | 35 ++++++++---
.../web/util/JavaScriptUtilsTests.java | 67 ++++++++++++++++++++++
2 files changed, 95 insertions(+), 7 deletions(-)
create mode 100644 projects/org.springframework.web/src/test/java/org/springframework/web/util/JavaScriptUtilsTests.java
diff --git a/projects/org.springframework.web/src/main/java/org/springframework/web/util/JavaScriptUtils.java b/projects/org.springframework.web/src/main/java/org/springframework/web/util/JavaScriptUtils.java
index b28d398..861b46f 100644
--- a/projects/org.springframework.web/src/main/java/org/springframework/web/util/JavaScriptUtils.java
+++ b/projects/org.springframework.web/src/main/java/org/springframework/web/util/JavaScriptUtils.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2002-2008 the original author or authors.
+ * Copyright 2002-2013 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -21,21 +21,21 @@ package org.springframework.web.util;
* Escapes based on the JavaScript 1.5 recommendation.
*
* <p>Reference:
- * <a href="http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Guide:Literals#String_Literals">
- * Core JavaScript 1.5 Guide
- * </a>
+ * <a href="https://developer.mozilla.org/en-US/docs/JavaScript/Guide/Values,_variables,_and_literals#String_literals">
+ * JavaScript Guide</a> on Mozilla Developer Network.
*
* @author Juergen Hoeller
* @author Rob Harrop
+ * @author Rossen Stoyanchev
* @since 1.1.1
*/
public class JavaScriptUtils {
/**
- * Turn special characters into escaped characters conforming to JavaScript.
- * Handles complete character set defined in HTML 4.01 recommendation.
+ * Turn JavaScript special characters into escaped characters.
+ *
* @param input the input string
- * @return the escaped string
+ * @return the string with escaped characters
*/
public static String javaScriptEscape(String input) {
if (input == null) {
@@ -73,6 +73,27 @@ public class JavaScriptUtils {
else if (c == '\f') {
filtered.append("\\f");
}
+ else if (c == '\b') {
+ filtered.append("\\b");
+ }
+ // No '\v' in Java, use octal value for VT ascii char
+ else if (c == '\013') {
+ filtered.append("\\v");
+ }
+ else if (c == '<') {
+ filtered.append("\\u003C");
+ }
+ else if (c == '>') {
+ filtered.append("\\u003E");
+ }
+ // Unicode for PS (line terminator in ECMA-262)
+ else if (c == '\u2028') {
+ filtered.append("\\u2028");
+ }
+ // Unicode for LS (line terminator in ECMA-262)
+ else if (c == '\u2029') {
+ filtered.append("\\u2029");
+ }
else {
filtered.append(c);
}
diff --git a/projects/org.springframework.web/src/test/java/org/springframework/web/util/JavaScriptUtilsTests.java b/projects/org.springframework.web/src/test/java/org/springframework/web/util/JavaScriptUtilsTests.java
new file mode 100644
index 0000000..182f18e
--- /dev/null
+++ b/projects/org.springframework.web/src/test/java/org/springframework/web/util/JavaScriptUtilsTests.java
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2004-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.web.util;
+
+import static org.junit.Assert.*;
+
+import java.io.UnsupportedEncodingException;
+
+import org.junit.Test;
+
+/**
+ * Test fixture for {@link JavaScriptUtils}.
+ *
+ * @author Rossen Stoyanchev
+ */
+public class JavaScriptUtilsTests {
+
+ @Test
+ public void escape() {
+ StringBuilder sb = new StringBuilder();
+ sb.append('"');
+ sb.append("'");
+ sb.append("\\");
+ sb.append("/");
+ sb.append("\t");
+ sb.append("\n");
+ sb.append("\r");
+ sb.append("\f");
+ sb.append("\b");
+ sb.append("\013");
+ assertEquals("\\\"\\'\\\\\\/\\t\\n\\n\\f\\b\\v", JavaScriptUtils.javaScriptEscape(sb.toString()));
+ }
+
+ // SPR-9983
+
+ @Test
+ public void escapePsLsLineTerminators() {
+ StringBuilder sb = new StringBuilder();
+ sb.append('\u2028');
+ sb.append('\u2029');
+ String result = JavaScriptUtils.javaScriptEscape(sb.toString());
+
+ assertEquals("\\u2028\\u2029", result);
+ }
+
+ // SPR-9983
+
+ @Test
+ public void escapeLessThanGreaterThanSigns() throws UnsupportedEncodingException {
+ assertEquals("\\u003C\\u003E", JavaScriptUtils.javaScriptEscape("<>"));
+ }
+
+}
|
