Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-11 01:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #430 from salcho/post-ww-5083

Browse Source 
WW-5084: Add Content Security Policy support to Struts
This commit is contained in:
Aleksandr Mashchenko
2020-08-30 23:37:16 +03:00
committed by GitHub
parent 87e7b2b680 bf802542c6
commit 6210afa747
28 changed files with 2727 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/javatemplates/src/main/java/org/apache/struts2/views/java/simple/LinkHandler.java
+50
View File
@@ -0,0 +1,50 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.struts2.views.java.simple;
import org.apache.struts2.views.java.Attributes;
import org.apache.struts2.views.java.TagGenerator;
import java.io.IOException;
import java.util.Map;
public class LinkHandler extends AbstractTagHandler implements TagGenerator {
@Override
public void generate() throws IOException {
Map<String, Object> params = context.getParameters();
Attributes attrs = new Attributes();
attrs.add("nonce", (String) params.get("nonce"))
.addIfExists("href", params.get(("href")))
.addIfExists("hreflang", params.get("hreflang"))
.addIfExists("rel", params.get("rel"))
.addIfExists("media", params.get("media"))
.addIfExists("sizes", params.get("sizes"))
.addIfExists("crossorigin", params.get("crossorigin"))
.addIfExists("referrerpolicy", params.get("referrerpolicy"))
.addIfExists("type", params.get("type"))
.addIfExists("as", params.get("as"))
.addIfExists("disabled", params.get("disabled"))
.addIfExists("title", params.get("title"));
start("link", attrs);
end("link");
}
}
plugins/javatemplates/src/main/java/org/apache/struts2/views/java/simple/ScriptHandler.java
+61
View File
@@ -0,0 +1,61 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.struts2.views.java.simple;
import org.apache.commons.lang3.StringUtils;
import org.apache.struts2.views.java.Attributes;
import org.apache.struts2.views.java.TagGenerator;
import java.io.IOException;
import java.util.Map;
public class ScriptHandler extends AbstractTagHandler implements TagGenerator {
@Override
public void generate() throws IOException {
Map<String, Object> params = context.getParameters();
Attributes attrs = new Attributes();
attrs.add("nonce", (String) params.get("nonce"))
.addIfExists("async", params.get("async"))
.addIfExists("charset", params.get("charset"))
.addIfExists("defer", params.get("defer"))
.addIfExists("src", params.get("src"))
.addIfExists("type", params.get("type"))
.addIfExists("name", params.get("name"))
.addIfExists("referrerpolicy", params.get("referrerpolicy"))
.addIfExists("nomodule", params.get("nomodule"))
.addIfExists("integrity", params.get("integrity"))
.addIfExists("crossorigin", params.get("crossorigin"));
start("script", attrs);
}
public static class CloseHandler extends AbstractTagHandler implements TagGenerator {
public void generate() throws IOException {
Map<String, Object> params = context.getParameters();
String body = (String) params.get("body");
if (StringUtils.isNotEmpty(body))
characters(body, false); // false means no HTML encoding
end("script");
}
}
}
plugins/javatemplates/src/main/java/org/apache/struts2/views/java/simple/SimpleTheme.java
+3
View File
@@ -50,6 +50,9 @@ public class SimpleTheme extends DefaultTheme {
put("textarea", new FactoryList(TextAreaHandler.class, ScriptingEventsHandler.class, CommonAttributesHandler.class, DynamicAttributesHandler.class));
put("radiomap", new FactoryList(RadioHandler.class, ScriptingEventsHandler.class, CommonAttributesHandler.class, DynamicAttributesHandler.class));
put("checkboxlist", new FactoryList(CheckboxListHandler.class, ScriptingEventsHandler.class, CommonAttributesHandler.class, DynamicAttributesHandler.class));
put("script", new FactoryList(ScriptHandler.class, CommonAttributesHandler.class, DynamicAttributesHandler.class));
put("script-close", new FactoryList(ScriptHandler.CloseHandler.class));
put("link", new FactoryList(LinkHandler.class, CommonAttributesHandler.class, DynamicAttributesHandler.class));
put("actionerror", new FactoryList(ActionErrorHandler.class));
put("token", new FactoryList(TokenHandler.class));
put("actionmessage", new FactoryList(ActionMessageHandler.class));
plugins/javatemplates/src/test/java/org/apache/struts2/views/java/simple/LinkTest.java
+86
View File
@@ -0,0 +1,86 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.struts2.views.java.simple;
import com.opensymphony.xwork2.ActionContext;
import org.apache.struts2.components.Link;
import org.apache.struts2.components.UIBean;
import java.util.HashMap;
import java.util.Map;
public class LinkTest extends AbstractTest{
private Link tag;
private static final String NONCE_VAL = "r4andom";
public void testRenderScriptTag() {
tag.setHref("testhref");
tag.setHreflang("test");
tag.setRel("module");
tag.setMedia("foo");
tag.setReferrerpolicy("test");
tag.setSizes("foo");
tag.setCrossorigin("same-origin");
tag.setType("anonymous");
tag.setAs("test");
tag.setDisabled("disabled_");
tag.setTitle("test");
tag.evaluateParams();
map.putAll(tag.getParameters());
theme.renderTag(getTagName(), context);
String s = writer.getBuffer().toString();
assertTrue("Incorrect href attribute for link tag", s.contains("href=\"testhref\""));
assertTrue("Incorrect hreflang attribute for link tag", s.contains("hreflang=\"test\""));
assertTrue("Incorrect rel attribute for link tag", s.contains("rel=\"module\""));
assertTrue("Incorrect media attribute for link tag", s.contains("media=\"foo\""));
assertTrue("Incorrect referrerpolicy attribute for link tag", s.contains("referrerpolicy=\"test\""));
assertTrue("Incorrect sizes attribute for link tag", s.contains("sizes=\"foo\""));
assertTrue("Incorrect crossorigin attribute for link tag", s.contains("crossorigin=\"same-origin\""));
assertTrue("Incorrect type attribute for link tag", s.contains("type=\"anonymous\""));
assertTrue("Incorrect as attribute for link tag", s.contains("as=\"test\""));
assertTrue("Non-existent disabled attribute for link tag", s.contains("disabled=\"disabled_\""));
assertTrue("Incorrect title attribute for link tag", s.contains("title=\"test\""));
assertTrue("Incorrect nonce attribute for link tag", s.contains("nonce=\"" + NONCE_VAL+"\""));
}
@Override
protected UIBean getUIBean() throws Exception {
return tag;
}
@Override
protected String getTagName() {
return "link";
}
@Override
protected void setUp() throws Exception {
super.setUp();
ActionContext actionContext = stack.getActionContext();
Map<String, Object> session = new HashMap<>();
session.put("nonce", NONCE_VAL);
actionContext.withSession(session);
this.tag = new Link(stack, request, response);
}
}
plugins/javatemplates/src/test/java/org/apache/struts2/views/java/simple/ScriptTest.java
+86
View File
@@ -0,0 +1,86 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.struts2.views.java.simple;
import com.opensymphony.xwork2.ActionContext;
import org.apache.struts2.components.Script;
import org.apache.struts2.components.UIBean;
import java.util.HashMap;
import java.util.Map;
public class ScriptTest extends AbstractTest {
private Script tag;
private static final String NONCE_VAL = "r4andom";
public void testRenderScriptTag() {
tag.setName("name_");
tag.setType("text/javascript");
tag.setSrc("mysrc");
tag.setAsync("false");
tag.setDefer("false");
tag.setCharset("test");
tag.setReferrerpolicy("foo");
tag.setNomodule("bar");
tag.setIntegrity("test");
tag.setCrossorigin("test");
tag.evaluateParams();
map.putAll(tag.getParameters());
theme.renderTag(getTagName(), context);
String output = writer.getBuffer().toString();
assertTrue("Script doesn't have nonce attribute", output.contains("nonce="));
assertTrue("Script doesn't have type attribute", output.contains("type="));
assertTrue("Script doesn't have src attribute", output.contains("src="));
assertTrue("Script doesn't have async attribute", output.contains("async"));
assertTrue("Script doesn't have defer attribute", output.contains("defer"));
assertTrue("Script doesn't have charset attribute", output.contains("charset="));
assertTrue("Script doesn't have referrerpolicy attribute", output.contains("referrerpolicy="));
assertTrue("Script doesn't have nomodule attribute", output.contains("nomodule"));
assertTrue("Script doesn't have integrity attribute", output.contains("integrity="));
assertTrue("Script doesn't have crossorigin attribute", output.contains("crossorigin="));
}
@Override
protected UIBean getUIBean() throws Exception {
return tag;
}
@Override
protected String getTagName() {
return "script";
}
@Override
protected void setUp() throws Exception {
super.setUp();
ActionContext actionContext = stack.getActionContext();
Map<String, Object> session = new HashMap<>();
session.put("nonce", NONCE_VAL);
actionContext.withSession(session);
this.tag = new Script(stack, request, response);
}
}