zzz/i2p.i2p
1
0
Fork 0
forked from I2P_Developers/i2p.i2p
Code Issues Pull Requests Packages Projects Releases Wiki Activity

new method for sanitizing content to be rendered on a web page (specifically, the routerInfo options can be hacked to contain evil html)

Browse Source 
thanks for finding and suggesting the fix oOo!
This commit is contained in:
jrandom
2004-08-11 04:42:04 +00:00
committed by zzz
parent 007194d674
commit fbe9fe1ba8
2 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
core/java/src/net/i2p/data/DataHelper.java
View File

@@ -528,6 +528,16 @@ public class DataHelper {
return (ms / (24 * 60 * 60 * 1000)) + "d"; return (ms / (24 * 60 * 60 * 1000)) + "d";
} }
} }
/**
* Strip out any HTML (simply removing any less than / greater than symbols)
*/
public static String stripHTML(String orig) {
if (orig == null) return "";
String t1 = orig.replace('<', ' ');
String rv = t1.replace('>', ' ');
return rv;
}
/** compress the data and return a new GZIP compressed array */ /** compress the data and return a new GZIP compressed array */
public static byte[] compress(byte orig[]) { public static byte[] compress(byte orig[]) {

12
router/java/src/net/i2p/router/networkdb/kademlia/KademliaNetworkDatabaseFacade.java
View File

@@ -507,8 +507,8 @@ public class KademliaNetworkDatabaseFacade extends NetworkDatabaseFacade {
+ new Date(routerInfo.getPublished())); + new Date(routerInfo.getPublished()));
} }
} else if (routerInfo.getPublished() > start + Router.CLOCK_FUDGE_FACTOR) { } else if (routerInfo.getPublished() > start + Router.CLOCK_FUDGE_FACTOR) {
if (_log.shouldLog(Log.ERROR)) if (_log.shouldLog(Log.WARN))
_log.error("Peer " + key.toBase64() + " published their leaseSet in the future?! [" _log.warn("Peer " + key.toBase64() + " published their leaseSet in the future?! ["
+ new Date(routerInfo.getPublished()) + "]"); + new Date(routerInfo.getPublished()) + "]");
return null; return null;
} }
@@ -721,8 +721,8 @@ public class KademliaNetworkDatabaseFacade extends NetworkDatabaseFacade {
for (Iterator routerIter = routerVersions.keySet().iterator(); routerIter.hasNext(); ) { for (Iterator routerIter = routerVersions.keySet().iterator(); routerIter.hasNext(); ) {
String routerVersion = (String)routerIter.next(); String routerVersion = (String)routerIter.next();
Integer num = (Integer)routerVersions.get(routerVersion); Integer num = (Integer)routerVersions.get(routerVersion);
buf.append("<tr><td>").append(coreVersion); buf.append("<tr><td>").append(DataHelper.stripHTML(coreVersion));
buf.append("</td><td>").append(routerVersion); buf.append("</td><td>").append(DataHelper.stripHTML(routerVersion));
buf.append("</td><td>").append(num.intValue()).append("</td></tr>\n"); buf.append("</td><td>").append(num.intValue()).append("</td></tr>\n");
} }
} }
@@ -752,7 +752,7 @@ public class KademliaNetworkDatabaseFacade extends NetworkDatabaseFacade {
for (Iterator optIter = addr.getOptions().keySet().iterator(); optIter.hasNext(); ) { for (Iterator optIter = addr.getOptions().keySet().iterator(); optIter.hasNext(); ) {
String name = (String)optIter.next(); String name = (String)optIter.next();
String val = addr.getOptions().getProperty(name); String val = addr.getOptions().getProperty(name);
buf.append('[').append(name).append('=').append(val).append("] "); buf.append('[').append(DataHelper.stripHTML(name)).append('=').append(DataHelper.stripHTML(val)).append("] ");
} }
} }
buf.append("</i><br />\n"); buf.append("</i><br />\n");
@@ -760,7 +760,7 @@ public class KademliaNetworkDatabaseFacade extends NetworkDatabaseFacade {
for (Iterator iter = info.getOptions().keySet().iterator(); iter.hasNext(); ) { for (Iterator iter = info.getOptions().keySet().iterator(); iter.hasNext(); ) {
String key = (String)iter.next(); String key = (String)iter.next();
String val = info.getOptions().getProperty(key); String val = info.getOptions().getProperty(key);
buf.append(key).append(" = ").append(val).append("<br />\n"); buf.append(DataHelper.stripHTML(key)).append(" = ").append(DataHelper.stripHTML(val)).append("<br />\n");
} }
buf.append("</code></i><hr />\n"); buf.append("</code></i><hr />\n");
} }