Comments (9)
The change to do the HTML-encode was made back in 2019 as a fix for bug 546816. Since this is a valid fix, we should leave it and decode the parameters just before using them in a prepared query. I'll make the change and submit a pull request for it.
from birt.
Thanks for reporting, Steve. Is there a stack trace that you can attach?
from birt.
I've been stepping into the code with the eclipse debugger and I've determined that org.eclipse.birt.report.utility.ParameterAccessor.getParameter() unconditionally encodes string parameters using the htmlEncode function of the same class. This happens just before the RunAndRender task is created. If this is appropriate behavior (and I'm not sure it is), then the method that prepares the sql statement needs to decode the strings. Please comment about whether you think this encoding behavior is appropriate.
from birt.
IMO, if parameters are passed in the URL then they need to be encoded and decoded.
What happens when you don't encode?
from birt.
Well, the parameters are delivered by HttpServletRequest, which automatically decodes them. Then ParameterAccessor re-encodes them, not using URL encoding but HTML encoding. It replaces the space with  , which is an HTML entity. I can't see a reason for this although I imagine there must be one, or why would they have done it? Version 4.6 does not do this. I can remove the encoding, thus making it the same as 4.6, but the question remains why they did it and if it's necessary.
from birt.
from birt.
from birt.
After digging into the code more I have a better solution. The XSS problem is caused by the format parameter being inserted directly into the HTML in Attributes.jsp. The problem doesn't appear to affect any other parameter. So the best solution is to just use the htmlEncode function to encode the format parameter in Attributes.jsp. The htmlEncode function is already used many other places in the jsp's so I think this was just an oversight.
I have forked the repo and am ready to submit a pull request, but I'd like to run the unit tests first. However when I execute mvn package without -DskipTests, it gets class-not-found errors. Maybe this isn't the correct way to run the unit tests. I'll ask on the newsgroup before creating another issue.
from birt.
Tests are failing ATM. See issue #588
Just create a pull request.
ECA
However, before we can accept PR's you have to jump through some legal hoops.
- Create an Eclipse account
- Your Eclipse account must contain your github id
- You have to sign the eclipse contributor agreement before patches can be accepted.
After that, just create a pull request with commits in the following form:
Space is encoded in dataset parameter #623
meaningful description here after one empty line.
Signed-off-by: Steve Schafer <[email protected]>
If your commits are not like this then the pull request will be rejected.
from birt.
Related Issues (20)
- eventHandlerClass with initialize Script HOT 1
- New issue with null values for decimal DS parameters HOT 3
- NPE in SvgFile.isSvg(String) HOT 4
- dispose of temp-files when using StreamingXlsx in spudsoft XlsxEmitter
- BIRT 4.14 output type PPTX: issue with border right, is unset in special cases HOT 2
- How do I test PCL plugin for the artifacts from PR 1531? HOT 1
- When we connect Birt 4.1 to Mongo 3.6 it gives following error HOT 2
- Rounded corners on charts HOT 1
- BIRT 4.14 creates an indent for grids in footer & header HOT 12
- BIRT 4.14 does not properly scale picture like in 4.8 with DOCX output HOT 4
- BIRT 4.14: Embedded images, special cases of images won't be shown at the eclipse-designer HOT 2
- BIRT 4.14 XLSX column autofit worse than in 4.8 HOT 4
- Use newer org.apache.commons.codec HOT 6
- Localization not effective in header & footer HOT 3
- Install Birt Viewer on Ubuntu 22.04 and Tomcat10 fails HOT 4
- birt runtime 4.14 in docker container behind reverse proxy, fails to load with "mixed content" error due to requesting http:// HOT 27
- BIRT 4.14/4.15: OSGI-version is broken, BIRT service cannot be initialized, Tomcat/Catalina: java.lang.NoClassDefFoundError: org/apache/axis/AxisFault HOT 14
- BIRT Eclipse Installer error HOT 3
- Birt is disclosing the webserver and framework details HOT 2
- Check for EMCAScript, Rhino engine: 1.17.10 "target platform" vs. 1.17.14 "Orbit" available HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from birt.