Create infrastructure for XSS sanitization

James Moger

2014-09-06 fc3a39d464b1303f0b7d01d0160f81cbbb80a98b

 src/main/java/com/gitblit/wicket/GitBlitWebApp.java

@@ -25,6 +25,7 @@
import org.apache.wicket.Request;
import org.apache.wicket.Response;
import org.apache.wicket.Session;
import org.apache.wicket.application.IClassResolver;
import org.apache.wicket.markup.html.WebPage;
import org.apache.wicket.protocol.http.WebApplication;

@@ -45,6 +46,7 @@
import com.gitblit.manager.IUserManager;
import com.gitblit.tickets.ITicketService;
import com.gitblit.transport.ssh.IPublicKeyManager;
import com.gitblit.utils.XssFilter;
import com.gitblit.wicket.pages.ActivityPage;
import com.gitblit.wicket.pages.BlamePage;
import com.gitblit.wicket.pages.BlobDiffPage;
@@ -56,6 +58,7 @@
import com.gitblit.wicket.pages.DocPage;
import com.gitblit.wicket.pages.DocsPage;
import com.gitblit.wicket.pages.EditMilestonePage;
import com.gitblit.wicket.pages.EditRepositoryPage;
import com.gitblit.wicket.pages.EditTicketPage;
import com.gitblit.wicket.pages.ExportTicketPage;
import com.gitblit.wicket.pages.FederationRegistrationPage;
@@ -70,6 +73,7 @@
import com.gitblit.wicket.pages.MyDashboardPage;
import com.gitblit.wicket.pages.MyTicketsPage;
import com.gitblit.wicket.pages.NewMilestonePage;
import com.gitblit.wicket.pages.NewRepositoryPage;
import com.gitblit.wicket.pages.NewTicketPage;
import com.gitblit.wicket.pages.OverviewPage;
import com.gitblit.wicket.pages.PatchPage;
@@ -91,9 +95,13 @@

   private final Class<? extends WebPage> homePageClass = MyDashboardPage.class;

   private final Class<? extends WebPage> newRepositoryPageClass = NewRepositoryPage.class;

   private final Map<String, CacheControl> cacheablePages = new HashMap<String, CacheControl>();

   private final IStoredSettings settings;

   private final XssFilter xssFilter;

   private final IRuntimeManager runtimeManager;

@@ -129,6 +137,7 @@

      super();
      this.settings = runtimeManager.getSettings();
      this.xssFilter = runtimeManager.getXssFilter();
      this.runtimeManager = runtimeManager;
      this.pluginManager = pluginManager;
      this.notificationManager = notificationManager;
@@ -206,6 +215,8 @@
      mount("/proposal", ReviewProposalPage.class, "t");
      mount("/registration", FederationRegistrationPage.class, "u", "n");

      mount("/new", NewRepositoryPage.class);
      mount("/edit", EditRepositoryPage.class, "r");
      mount("/activity", ActivityPage.class, "r", "h");
      mount("/lucene", LuceneSearchPage.class);
      mount("/project", ProjectPage.class, "p");
@@ -226,7 +237,8 @@
      }

       // customize the Wicket class resolver to load from plugins
        PluginClassResolver classResolver = new PluginClassResolver(pluginManager);
      IClassResolver coreResolver = getApplicationSettings().getClassResolver();
        PluginClassResolver classResolver = new PluginClassResolver(coreResolver, pluginManager);
        getApplicationSettings().setClassResolver(classResolver);

      getMarkupSettings().setDefaultMarkupEncoding("UTF-8");
@@ -258,6 +270,10 @@
   @Override
   public Class<? extends WebPage> getHomePage() {
      return homePageClass;
   }

   public Class<? extends WebPage> getNewRepositoryPage() {
      return newRepositoryPageClass;
   }

   /* (non-Javadoc)
@@ -296,6 +312,14 @@
   }

   /* (non-Javadoc)
    * @see com.gitblit.wicket.Webapp#xssFilter()
    */
   @Override
   public XssFilter xssFilter() {
      return xssFilter;
   }

   /* (non-Javadoc)
    * @see com.gitblit.wicket.Webapp#isDebugMode()
    */
   @Override