phoedos/pmd
1
1
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

JS encoded and parsed JSON is safe

Browse Source
This commit is contained in:
Sergey
2017-04-12 15:53:24 -07:00
parent f2683c6cb4
commit 7a9ccb70df
2 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java
View File

@ -93,10 +93,14 @@ public class VfUnescapeElRule extends AbstractVfRule {
}
} else {
if (!(startsWithSafeResource(elExpression) || containsSafeFields(elExpression))) {
final boolean hasUnscaped = doesElContainAnyUnescapedIdentifiers(elExpression,
EnumSet.of(Escaping.JSENCODE, Escaping.JSINHTMLENCODE));
if (!(jsonParse && !hasUnscaped)) {
addViolation(data, elExpression);
}
}
}
}
private boolean isJsonParse(ASTText prevText) {
final String text = (prevText.getImage().endsWith("'") || prevText.getImage().endsWith("'"))

16
pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml
View File

@ -605,4 +605,20 @@ JSON.parse method evaluates non quoted EL to unsafe XSS
<source-type>vf</source-type>
</test-code>
<test-code>
<description><![CDATA[
JSON.parse method evaluates escaped EL to safe JSON
]]></description>
<expected-problems>0</expected-problems>
<code><![CDATA[
<apex:page>
<script>
var x = JSON.parse({!JSENCODE(yes)});
</script>
</apex:page>
]]></code>
<source-type>vf</source-type>
</test-code>
</test-data>