DDF-4355 Sanitize Text Preview Action (#4077)

* DDF-4355 Sanitize Text Preview Action so that HTML elements do not render in the browser * DDF-4355 Add commons-text version property
codice · Dec 4, 2018 · 060a8fc · 060a8fc
1 parent 00381be
commit 060a8fc
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 6 deletions.
diff --git a/catalog/transformer/catalog-transformer-preview/pom.xml b/catalog/transformer/catalog-transformer-preview/pom.xml
@@ -52,6 +52,11 @@
             <artifactId>catalog-transformer-common</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-text</artifactId>
+            <version>${commons-text.version}</version>
+        </dependency>
     </dependencies>
 
     <build>
@@ -66,7 +71,8 @@
                         <Export-Package/>
                         <Embed-Dependency>
                             catalog-core-api-impl,
-                            catalog-core-actions
+                            catalog-core-actions,
+                            commons-text
                         </Embed-Dependency>
                         <Import-Package>
                             !org.codice.ddf.platform.util,

diff --git a/...-preview/src/main/java/org/codice/ddf/transformer/preview/PreviewMetacardTransformer.java b/...-preview/src/main/java/org/codice/ddf/transformer/preview/PreviewMetacardTransformer.java
@@ -21,6 +21,7 @@
 import ddf.catalog.transform.MetacardTransformer;
 import java.io.Serializable;
 import java.util.Map;
+import org.apache.commons.text.StringEscapeUtils;
 import org.apache.tika.io.IOUtils;
 
 public class PreviewMetacardTransformer implements MetacardTransformer {
@@ -36,10 +37,8 @@ public BinaryContent transform(Metacard metacard, Map<String, Serializable> argu
     if (metacard.getAttribute(Extracted.EXTRACTED_TEXT) != null
         && metacard.getAttribute(Extracted.EXTRACTED_TEXT).getValue() != null) {
       preview =
-          metacard
-              .getAttribute(Extracted.EXTRACTED_TEXT)
-              .getValue()
-              .toString()
+          StringEscapeUtils.escapeHtml4(
+                  metacard.getAttribute(Extracted.EXTRACTED_TEXT).getValue().toString())
               .replaceAll("[\n|\r]", "<br>");
       preview = String.format("<head><meta charset=\"utf-8\"/>%s</head>", preview);
     }

diff --git a/features/cxf/src/main/feature/feature.xml b/features/cxf/src/main/feature/feature.xml
@@ -663,7 +663,7 @@
         <bundle start-level="35" dependency="true">
             mvn:org.apache.commons/commons-lang3/${cxf.commons-lang3.version}
         </bundle>
-        <bundle start-level="35" dependency="true">mvn:org.apache.commons/commons-text/1.2</bundle>
+        <bundle start-level="35" dependency="true">mvn:org.apache.commons/commons-text/${commons-text.version}</bundle>
         <bundle dependency="true">
             wrap:mvn:org.apache.velocity/velocity-engine-core/${cxf.velocity.version}
         </bundle>

diff --git a/pom.xml b/pom.xml
@@ -188,6 +188,7 @@
         <commons-logging.version>1.2</commons-logging.version>
         <commons-net.version>3.5</commons-net.version>
         <commons-pool.version>1.6</commons-pool.version>
+        <commons-text.version>1.2</commons-text.version>
         <commons-validator.version>1.6</commons-validator.version>
         <components-font-awesome.version>4.7.0</components-font-awesome.version>
         <countryconverter.version>0.1.4</countryconverter.version>