hiifong/pmd
1
0
Fork 0
forked from phoedos/pmd
Code Pull Requests Activity

Fallback for JS arrays and defs

Browse Source
This commit is contained in:
Sergey
2017-03-02 17:28:54 -08:00
parent 1942e94cec
commit 81c67a5df2
2 changed files with 28 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java
View File

@ -94,6 +94,10 @@ public class VfUnescapeElRule extends AbstractVfRule {
private boolean isUnbalanced(String image, String pattern) {
int occurance = 0;
int index = image.indexOf("=");
if (index < 0) {
index = image.indexOf(":");
}
index = image.indexOf(pattern, index + 1);
while (index >= 0) {
occurance++;
@ -227,6 +231,8 @@ public class VfUnescapeElRule extends AbstractVfRule {
case "$site":
case "$page":
case "$action":
case "casesafeid":
case "$remoteaction":
return true;
}

24
pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml
View File

@ -3,7 +3,27 @@
<test-code>
<description><![CDATA[
No XSS in safe commands quoted context
Safe escaped value in repeat
]]></description>
<expected-problems>0</expected-problems>
<code><![CDATA[
<apex:page>
<apex:repeat value="{!emailTemplates}" var="template">
emailTemplates.push({
id: '{!template.id}',
name: "{!JSENCODE(HTMLENCODE(template.name))}"
});
</apex:repeat>
</apex:page>
]]></code>
<source-type>vf</source-type>
</test-code>
<test-code>
<description><![CDATA[
Safe case id in script
]]></description>
<expected-problems>0</expected-problems>
<code><![CDATA[
@ -19,7 +39,7 @@ No XSS in safe commands quoted context
<test-code>
<description><![CDATA[
No XSS in safe commands quoted context
No XSS in safe script commands quoted context
]]></description>
<expected-problems>0</expected-problems>
<code><![CDATA[