Merge pull request payara#6943 from kalinchan/FISH-9553

FISH-9553 Sanitise properties in admin console
Pandrex247 · Sep 16, 2024 · e873b39 · e873b39
1 parent b22ad0e
commit e873b39
Show file tree

Hide file tree

Showing 5 changed files with 26 additions and 8 deletions.
diff --git a/...er/admingui/common/src/main/java/org/glassfish/admingui/common/handlers/UtilHandlers.java b/...er/admingui/common/src/main/java/org/glassfish/admingui/common/handlers/UtilHandlers.java
@@ -37,7 +37,7 @@
  * only if the new code is made subject to such option by the copyright
  * holder.
  */
-// Portions Copyright 2018-2022 Payara Foundation and/or affiliates
+// Portions Copyright 2018-2024 Payara Foundation and/or affiliates
 
 /*
  * UtilHandlers.java
@@ -1164,4 +1164,16 @@ public static String escapePropertyValue(String str){
     }
 
     private static final String PATH_SEPARATOR = "${path.separator}";
+
+    @Handler(id = "gf.sanitiseProperty",
+            input = {
+                    @HandlerInput(name = "systemProperty", type = String.class, required = true)
+            },
+            output = {
+                    @HandlerOutput(name = "result", type = String.class)
+            }
+    )
+    public static void sanitiseProperty(HandlerContext handlerCtx) {
+        handlerCtx.setOutputValue("result", escapePropertyValue(((String)handlerCtx.getInputValue("systemProperty"))));
+    }
 }
diff --git a/appserver/admingui/common/src/main/resources/configuration/sysInstanceValues.jsf b/appserver/admingui/common/src/main/resources/configuration/sysInstanceValues.jsf
@@ -38,7 +38,7 @@
     only if the new code is made subject to such option by the copyright
     holder.
 
-    Portions Copyright [2020] [Payara Foundation and/or its affiliates]
+    Portions Copyright [2020-2024] [Payara Foundation and/or its affiliates]
 -->
 
 <!initPage
@@ -59,8 +59,8 @@
             setPageSessionAttribute(key="selfUrl", value="#{pageSession.parentUrl}/system-properties");
             gf.restRequest(endpoint="#{sessionScope.REST_URL}/configs/config/#{pageSession.configName}/system-property/#{pageSession.propName}", 
             method="get", result="#{requestScope.result}");
-            setPageSessionAttribute(key="defaultValue", value="#{requestScope.result.data.extraProperties.entity.value}");
-
+            gf.sanitiseProperty(systemProperty="#{requestScope.result.data.extraProperties.entity.value}", result="#{currentVal}");
+            setPageSessionAttribute(key="defaultValue", value="#{currentVal}");
             // Get instance to cluster mapping
             createMap(result="#{requestScope.instanceMapping}");
             gf.restRequest(endpoint="#{sessionScope.REST_URL}/clusters/cluster", method="get", result="#{requestScope.clusterResult}");

diff --git a/appserver/admingui/common/src/main/resources/configuration/systemProperties.jsf b/appserver/admingui/common/src/main/resources/configuration/systemProperties.jsf
@@ -38,6 +38,7 @@
     only if the new code is made subject to such option by the copyright
     holder.
 
+    Portions Copyright [2018-2024] [Payara Foundation and/or its affiliates]
 -->
 
 <sun:table id="sysPropsTable" style="padding: 10pt" title="$resource{i18n.common.AdditionalProperties}"
@@ -62,7 +63,8 @@
         foreach(var="prop", list="#{pageSession.sysProps}") {
             createMap(result="#{row}");
             mapPut(map="#{row}", key="name", value="#{prop.name}");
-            mapPut(map="#{row}", key="currentValue", value="#{!empty prop.value ? prop.value : prop.defaultValue}");
+            gf.sanitiseProperty(systemProperty="#{!empty prop.value ? prop.value : prop.defaultValue}", result="#{currentVal}");
+            mapPut(map="#{row}", key="currentValue", value="#{currentVal}");
             mapPut(map="#{row}", key="overrideValue", value="#{!empty prop.value ? prop.value : ''}");
             listAdd(list="#{pageSession.tableList}", value="#{row}");
         }

diff --git a/appserver/admingui/corba/src/main/resources/iiopServerPageNode.jsf b/appserver/admingui/corba/src/main/resources/iiopServerPageNode.jsf
@@ -38,6 +38,7 @@
     only if the new code is made subject to such option by the copyright
     holder.
 
+    Portions Copyright [2018-2024] [Payara Foundation and/or its affiliates]
 -->
 
 <!-- iiopServerPageNode.jsf -->
@@ -59,6 +60,8 @@
             listAdd(value="#{pageSession.iiopListenerAttrs.data.extraProperties.entity['port']}" list="#{pageSession.iiopPortsList}");
         }
         gf.resolveTokens(tokens="#{pageSession.iiopPortsList}" endPoint="#{sessionScope.REST_URL}/servers/server/#{pageSession.instanceName}" resolvedTokens="#{pageSession.iiopResolvedPortsList}");
-        convertListToCommaString(list="#{pageSession.iiopResolvedPortsList}" commaString="#{pageSession.iiopPorts}");
+        convertListToCommaString(list="#{pageSession.iiopResolvedPortsList}" commaString="#{iiopPorts}");
+        gf.sanitiseProperty(systemProperty="#{iiopPorts}", result="#{pageSession.iiopPorts}");
+
     />
 </sun:property> 
diff --git a/appserver/admingui/web/src/main/resources/serverPageNode.jsf b/appserver/admingui/web/src/main/resources/serverPageNode.jsf
@@ -38,7 +38,7 @@
     only if the new code is made subject to such option by the copyright
     holder.
 
-    Portions Copyright [2018] [Payara Foundation and/or its affiliates]
+    Portions Copyright [2018-2024] [Payara Foundation and/or its affiliates]
 -->
 
 <!-- serverPageNode.jsf -->
@@ -60,6 +60,7 @@
             listAdd(value="#{pageSession.tmpPort}" list="#{pageSession.httpPortsList}");
         }
         gf.resolveTokens(tokens="#{pageSession.httpPortsList}" endPoint="#{sessionScope.REST_URL}/servers/server/#{pageSession.instanceName}" resolvedTokens="#{pageSession.httpResolvedPortsList}");
-        convertListToCommaString(list="#{pageSession.httpResolvedPortsList}" commaString="#{pageSession.httpPorts}");
+        convertListToCommaString(list="#{pageSession.httpResolvedPortsList}" commaString="#{portList}");
+        gf.sanitiseProperty(systemProperty="#{portList}", result="#{pageSession.httpPorts}");
     />
 </sun:property>