mirrors/nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus synced 2026-09-05 15:46:55 +00:00
Code Issues Releases Wiki Activity

Do not escape WHOIS output

Browse Source 
Both WhoisAction and WhoisHttpAction set the HTTP response content type to "text/plain". There is no need to defensively escape the content. In fact, by escaping the content, it creates more problems down the line.

When used in a website, the response should be written into a DOM node by setting the textContent of the node, which automatically escapes the content.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=196743398
This commit is contained in:
jianglai
2018-05-17 21:52:35 -04:00
parent f1219120ea
commit 7388958df7
14 changed files with 26 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
javatests/google/registry/whois/WhoisHttpActionTest.java
+3 -24
View File
@@ -49,7 +49,6 @@ import java.io.IOException;
import java.io.Reader;
import org.joda.time.DateTime;
import org.joda.time.Duration;
import org.junit.After;
import org.junit.Before;
import org.junit.Ignore;
import org.junit.Rule;
@@ -92,12 +91,6 @@ public class WhoisHttpActionTest {
inject.setStaticField(Ofy.class, "clock", clock);
}
@After
public void after() throws Exception {
// Extra precaution to ensure HTML escaping is working securely.
assertThat(response.getPayload()).doesNotContain("<script>");
}
@Test
public void testRun_emptyQuery_returns400BadRequestWithPlainTextOutput() throws Exception {
newWhoisHttpAction("").run();
@@ -128,7 +121,7 @@ public class WhoisHttpActionTest {
public void testRun_domainInTestTld_isConsideredNotFound() throws Exception {
persistResource(Registry.get("lol").asBuilder().setTldType(Registry.TldType.TEST).build());
Registrar registrar = persistResource(makeRegistrar(
"evilregistrar", "Yes Virginia <script>", Registrar.State.ACTIVE));
"evilregistrar", "Yes Virginia", Registrar.State.ACTIVE));
persistResource(makeDomainResource(
"cat.lol",
persistResource(makeContactResource("5372808-ERL", "Goblin Market", "lol@cat.lol")),
@@ -147,7 +140,7 @@ public class WhoisHttpActionTest {
@Test
public void testRun_domainQueryIdn_works() throws Exception {
Registrar registrar = persistResource(makeRegistrar(
"evilregistrar", "Yes Virginia <script>", Registrar.State.ACTIVE));
"evilregistrar", "Yes Virginia", Registrar.State.ACTIVE));
persistResource(makeDomainResource(
"cat.みんな",
persistResource(makeContactResource("5372808-ERL", "(◕‿◕)", "lol@cat.みんな")),
@@ -200,20 +193,6 @@ public class WhoisHttpActionTest {
assertThat(response.getPayload()).contains("Domain Name: cat.みんな\r\n");
}
@Test
public void testRun_maliciousHtmlInDatastore_getsPurged() throws Exception {
persistResource(makeDomainResource("cat.みんな",
persistResource(makeContactResource("5372808-ERL", "(◕‿◕)", "lol@cat.みんな")),
persistResource(makeContactResource("5372808-IRL", "Operator", "BOFH@cat.みんな")),
persistResource(
makeContactResource("5372808-TRL", "<script>alert('lol');</script>", "bog@cat.みんな")),
persistResource(makeHostResource("ns1.cat.みんな", "1.2.3.4")),
persistResource(makeHostResource("ns2.cat.みんな", "bad:f00d:cafe::15:beef")),
persistResource(makeRegistrar("example", "Example Registrar", Registrar.State.ACTIVE))));
newWhoisHttpAction("cat.みんな").run();
assertThat(response.getPayload()).doesNotContain("<script>");
}
@Test
public void testRun_hostnameOnly_works() throws Exception {
persistResource(makeHostResource("ns1.cat.みんな", "1.2.3.4"));
@@ -224,7 +203,7 @@ public class WhoisHttpActionTest {
@Test
public void testRun_domainQueryPunycode_works() throws Exception {
Registrar registrar = persistResource(makeRegistrar(
"evilregistrar", "Yes Virginia <script>", Registrar.State.ACTIVE));
"evilregistrar", "Yes Virginia", Registrar.State.ACTIVE));
persistResource(makeDomainResource(
"cat.みんな",
persistResource(makeContactResource("5372808-ERL", "(◕‿◕)", "lol@cat.みんな")),