From fac0cc89583d9294285af84853b2f9e7a02fb46c Mon Sep 17 00:00:00 2001 From: Anton Tananaev Date: Wed, 17 Oct 2018 11:31:08 +1300 Subject: Sanitize all JSON strings AC-2018-10-9-1, AC-2018-10-9-2, AC-2018-10-9-3, AC-2018-10-9-4 --- src/org/traccar/Context.java | 2 ++ src/org/traccar/helper/SanitizerModule.java | 45 +++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 src/org/traccar/helper/SanitizerModule.java (limited to 'src/org/traccar') diff --git a/src/org/traccar/Context.java b/src/org/traccar/Context.java index 287e5c753..51c67bd0a 100644 --- a/src/org/traccar/Context.java +++ b/src/org/traccar/Context.java @@ -64,6 +64,7 @@ import org.traccar.geocoder.OpenCageGeocoder; import org.traccar.geocoder.Geocoder; import org.traccar.geolocation.UnwiredGeolocationProvider; import org.traccar.helper.Log; +import org.traccar.helper.SanitizerModule; import org.traccar.model.Attribute; import org.traccar.model.BaseModel; import org.traccar.model.Calendar; @@ -366,6 +367,7 @@ public final class Context { } objectMapper = new ObjectMapper(); + objectMapper.registerModule(new SanitizerModule()); objectMapper.registerModule(new JSR353Module()); objectMapper.setConfig( objectMapper.getSerializationConfig().without(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)); diff --git a/src/org/traccar/helper/SanitizerModule.java b/src/org/traccar/helper/SanitizerModule.java new file mode 100644 index 000000000..af9ac5c2b --- /dev/null +++ b/src/org/traccar/helper/SanitizerModule.java @@ -0,0 +1,45 @@ +/* + * Copyright 2018 Anton Tananaev (anton@traccar.org) + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.traccar.helper; + +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.databind.SerializerProvider; +import com.fasterxml.jackson.databind.module.SimpleModule; +import com.fasterxml.jackson.databind.ser.std.StdSerializer; +import org.owasp.encoder.Encode; + +import java.io.IOException; + +public class SanitizerModule extends SimpleModule { + + public static class SanitizerSerializer extends StdSerializer { + + protected SanitizerSerializer() { + super(String.class); + } + + @Override + public void serialize(String value, JsonGenerator gen, SerializerProvider provider) throws IOException { + gen.writeString(Encode.forHtml(value)); + } + + } + + public SanitizerModule() { + addSerializer(new SanitizerSerializer()); + } + +} -- cgit v1.2.3