From 6004270685ad2f901c30db370cd3f02bdb72e420 Mon Sep 17 00:00:00 2001 From: "Ruben S. Montero" Date: Thu, 3 Mar 2016 12:32:36 +0100 Subject: [PATCH] feature #4162: Sanitize some user attributes in XML douments --- include/Attribute.h | 6 +++-- src/common/Attribute.cc | 10 ++++---- src/datastore/Datastore.cc | 34 +++++++++++++-------------- src/host/Host.cc | 6 ++--- src/image/Image.cc | 6 ++--- src/market/MarketPlaceApp.cc | 14 +++++------ src/pool/PoolObjectSQL.cc | 6 ++--- src/um/User.cc | 4 ++-- src/vm/History.cc | 40 ++++++++++++++++---------------- src/vmm/VirtualMachineManager.cc | 6 ++--- src/vnm/AddressRange.cc | 18 +++++++------- src/vnm/VirtualNetwork.cc | 8 +++---- 12 files changed, 81 insertions(+), 77 deletions(-) diff --git a/include/Attribute.h b/include/Attribute.h index 6add65d9e1..30ad7cd3f7 100644 --- a/include/Attribute.h +++ b/include/Attribute.h @@ -22,6 +22,8 @@ #include #include +#include "NebulaUtil.h" + using namespace std; /** @@ -163,8 +165,8 @@ public: { string * xml = new string; - *xml = "<" + name() + ">"; + *xml = "<" + name() + ">" + one_util::escape_xml(attribute_value) + + ""; return xml; } diff --git a/src/common/Attribute.cc b/src/common/Attribute.cc index 11f731d44f..5c6c1597e3 100644 --- a/src/common/Attribute.cc +++ b/src/common/Attribute.cc @@ -19,8 +19,7 @@ #include #include "Attribute.h" - -#define TO_UPPER(S) transform(S.begin(),S.end(),S.begin(),(int(*)(int))toupper) +#include "NebulaUtil.h" const char * VectorAttribute::magic_sep = "@^_^@"; const int VectorAttribute::magic_sep_size = 5; @@ -101,8 +100,9 @@ void VectorAttribute::to_xml(ostringstream &oss) const } else { - oss << "<" << it->first << ">second - << "]]>first << ">"; + oss << "<" << it->first << ">" + << one_util::escape_xml(it->second) + << "first << ">"; } } @@ -294,7 +294,7 @@ int VectorAttribute::vector_value(const char *name, bool& value) const string tmp = it->second; - TO_UPPER(tmp); + one_util::toupper(tmp); if (tmp == "YES") { diff --git a/src/datastore/Datastore.cc b/src/datastore/Datastore.cc index 238435d418..2ffe19f801 100644 --- a/src/datastore/Datastore.cc +++ b/src/datastore/Datastore.cc @@ -651,24 +651,24 @@ string& Datastore::to_xml(string& xml) const oss << "" << - "" << oid << "" << - "" << uid << "" << - "" << gid << "" << - "" << uname << "" << - "" << gname << "" << - "" << name << "" << + "" << oid << "" << + "" << uid << "" << + "" << gid << "" << + "" << uname << "" << + "" << gname << "" << + "" << name << "" << perms_to_xml(perms_xml) << - "" << - "" << - ""<< - "" << type << "" << - "" << disk_type << "" << - "" << state << "" << - "" << cluster_id << "" << - "" << cluster << "" << - "" << total_mb << "" << - "" << free_mb << "" << - "" << used_mb << "" << + "" << one_util::escape_xml(ds_mad) << "" << + "" << one_util::escape_xml(tm_mad) << "" << + "" << one_util::escape_xml(base_path)<< ""<< + "" << type << "" << + "" << disk_type << "" << + "" << state << "" << + "" << cluster_id << ""<< + "" << cluster << "" << + "" << total_mb << "" << + "" << free_mb << "" << + "" << used_mb << "" << images.to_xml(collection_xml) << obj_template->to_xml(template_xml) << ""; diff --git a/src/host/Host.cc b/src/host/Host.cc index e696ff27de..fbf77ad973 100644 --- a/src/host/Host.cc +++ b/src/host/Host.cc @@ -592,9 +592,9 @@ string& Host::to_xml(string& xml) const "" << oid << "" << "" << name << "" << "" << state << "" << - "" << - "" << - "" << + "" << one_util::escape_xml(im_mad_name) << "" << + "" << one_util::escape_xml(vmm_mad_name) << "" << + "" << one_util::escape_xml(vnm_mad_name) << "" << "" << last_monitored << "" << "" << cluster_id << "" << "" << cluster << "" << diff --git a/src/image/Image.cc b/src/image/Image.cc index 100f347e3b..47c3eff1d3 100644 --- a/src/image/Image.cc +++ b/src/image/Image.cc @@ -352,9 +352,9 @@ string& Image::to_xml(string& xml) const "" << disk_type << "" << "" << persistent_img << "" << "" << regtime << "" << - "" << - "" << - "" << + "" << one_util::escape_xml(source) << "" << + "" << one_util::escape_xml(path) << "" << + "" << one_util::escape_xml(fs_type)<< "" << "" << size_mb << "" << "" << state << "" << "" << running_vms << "" << diff --git a/src/market/MarketPlaceApp.cc b/src/market/MarketPlaceApp.cc index 00f7510c75..897a7d44bc 100644 --- a/src/market/MarketPlaceApp.cc +++ b/src/market/MarketPlaceApp.cc @@ -240,14 +240,14 @@ std::string& MarketPlaceApp::to_xml(std::string& xml) const "" << gname << "" << "" << regtime << "" << "" << name << "" << - "" << origin_id << "" << - "" << source << "" << - "" << md5 << "" << + "" << one_util::escape_xml(origin_id)<< "" << + "" << one_util::escape_xml(source) << "" << + "" << one_util::escape_xml(md5) << "" << "" << size_mb << "" << - "" << description << "" << - "" << version << "" << - "" << format << "" << - "" << apptemplate64 << "" << + "" << one_util::escape_xml(description) << "" << + "" << one_util::escape_xml(version) << "" << + "" << one_util::escape_xml(format) << "" << + "" << one_util::escape_xml(apptemplate64) << "" << "" << market_id << "" << "" << market_name << "" << "" << state << "" << diff --git a/src/pool/PoolObjectSQL.cc b/src/pool/PoolObjectSQL.cc index e4e3db6860..9d8e4ba4d9 100644 --- a/src/pool/PoolObjectSQL.cc +++ b/src/pool/PoolObjectSQL.cc @@ -526,9 +526,9 @@ string& PoolObjectSQL::lock_db_to_xml(string& xml) const int locked_int = locked ? 1 : 0; oss << "" - << "" << locked_int << "" - << "" - << "" << lock_expires << "" + << "" << locked_int << "" + << "" << one_util::escape_xml(lock_owner) << "" + << "" << lock_expires << "" << ""; xml = oss.str(); diff --git a/src/um/User.cc b/src/um/User.cc index c10ecb6a94..a52c73a28e 100644 --- a/src/um/User.cc +++ b/src/um/User.cc @@ -234,8 +234,8 @@ string& User::to_xml_extended(string& xml, bool extended) const groups.to_xml(collection_xml) << "" << gname <<"" << "" << name <<"" << - "" << password <<"" << - "" << auth_driver <<""<< + "" <" << + "" <"<< "" << enabled_int <<"" << login_token.to_xml(token_xml) << obj_template->to_xml(template_xml); diff --git a/src/vm/History.cc b/src/vm/History.cc index ab7fdc8b61..3654d5b479 100644 --- a/src/vm/History.cc +++ b/src/vm/History.cc @@ -300,26 +300,26 @@ string& History::to_xml(string& xml, bool database) const oss << "" << - "" << oid << "" << - "" << seq << "" << - "" << hostname << ""<< - "" << hid << "" << - "" << cid << "" << - "" << stime << "" << - "" << etime << "" << - "" << vmm_mad_name << ""<< - "" << vnm_mad_name << ""<< - "" << tm_mad_name << "" << - "" << ds_location << "" << - "" << ds_id << "" << - "" << prolog_stime << ""<< - "" << prolog_etime << ""<< - "" << running_stime << ""<< - "" << running_etime << ""<< - "" << epilog_stime << ""<< - "" << epilog_etime << ""<< - "" << reason << ""<< - "" << action << ""; + "" << oid << "" << + "" << seq << "" << + "" << hostname << ""<< + "" << hid << "" << + "" << cid << "" << + "" << stime << "" << + "" << etime << "" << + "" << one_util::escape_xml(vmm_mad_name) << ""<< + "" << one_util::escape_xml(vnm_mad_name) << ""<< + "" << one_util::escape_xml(tm_mad_name) << "" << + "" << one_util::escape_xml(ds_location) << "" << + "" << ds_id << "" << + "" << prolog_stime << ""<< + "" << prolog_etime << ""<< + "" << running_stime << ""<< + "" << running_etime << ""<< + "" << epilog_stime << ""<< + "" << epilog_etime << ""<< + "" << reason << ""<< + "" << action << ""; if ( database ) { diff --git a/src/vmm/VirtualMachineManager.cc b/src/vmm/VirtualMachineManager.cc index 9f86c30be5..b30740c7df 100644 --- a/src/vmm/VirtualMachineManager.cc +++ b/src/vmm/VirtualMachineManager.cc @@ -425,7 +425,7 @@ string * VirtualMachineManager::format_message( if ( !tm_command.empty() ) { - oss << ""; + oss << "" << one_util::escape_xml(tm_command) << ""; } else { @@ -434,8 +434,8 @@ string * VirtualMachineManager::format_message( if (!tm_command_rollback.empty()) { - oss << ""; + oss << "" << one_util::escape_xml(tm_command_rollback) + << ""; } else { diff --git a/src/vnm/AddressRange.cc b/src/vnm/AddressRange.cc index c324eedbfb..5a33574f78 100644 --- a/src/vnm/AddressRange.cc +++ b/src/vnm/AddressRange.cc @@ -422,14 +422,15 @@ void AddressRange::to_xml(ostringstream &oss, const vector& vms, continue; } - oss << "<" << it->first << ">second - << "]]>first << ">"; + oss << "<" << it->first << ">" + << one_util::escape_xml(it->second) + << "first << ">"; } mac_end[1] = mac[1]; mac_end[0] = (mac[0] + size - 1); - oss << ""; + oss << "" << one_util::escape_xml(mac_to_s(mac_end))<<""; aux_st = attr->vector_value("IP"); @@ -441,7 +442,8 @@ void AddressRange::to_xml(ostringstream &oss, const vector& vms, if (rc == 0) { - oss << ""; + oss << "" << one_util::escape_xml(ip_to_s(ip_i + size - 1)) + << ""; } } @@ -452,19 +454,19 @@ void AddressRange::to_xml(ostringstream &oss, const vector& vms, if (ula6[1] != 0 || ula6[0] != 0 ) /* Unique Local Address */ { ip6_to_s(ula6, mac, ip6_s); - oss << ""; + oss << "" << one_util::escape_xml(ip6_s) << ""; ip6_to_s(ula6, mac_end, ip6_s); - oss << ""; + oss << "" << one_util::escape_xml(ip6_s) << ""; } if (global6[1] != 0 || global6[0] != 0 ) /* Glocal Unicast */ { ip6_to_s(global6, mac, ip6_s); - oss << ""; + oss << "" << one_util::escape_xml(ip6_s) << ""; ip6_to_s(global6, mac_end, ip6_s); - oss << ""; + oss << "" << one_util::escape_xml(ip6_s) << ""; } } diff --git a/src/vnm/VirtualNetwork.cc b/src/vnm/VirtualNetwork.cc index 01eeab6728..6b1101abf0 100644 --- a/src/vnm/VirtualNetwork.cc +++ b/src/vnm/VirtualNetwork.cc @@ -436,8 +436,8 @@ string& VirtualNetwork::to_xml_extended(string& xml, bool extended, perms_to_xml(perm_str) << ""<< cluster_id<< ""<< "" << cluster << "" << - "" << bridge << "" << - "" << vlan << ""; + "" << one_util::escape_xml(bridge)<< "" << + "" << one_util::escape_xml(vlan) << ""; if (parent_vid != -1) { @@ -450,7 +450,7 @@ string& VirtualNetwork::to_xml_extended(string& xml, bool extended, if (!phydev.empty()) { - os << ""; + os << "" << one_util::escape_xml(phydev) << ""; } else { @@ -459,7 +459,7 @@ string& VirtualNetwork::to_xml_extended(string& xml, bool extended, if (!vlan_id.empty()) { - os << ""; + os << "" << one_util::escape_xml(vlan_id) << ""; } else {