Changeset 19114 in josm for trunk

Timestamp:

2024-06-18T23:29:43+02:00 (5 months ago)

Author:

taylor.smock

Message:

Fix an XPath injection issue

This isn't really an issue for JOSM, since we are only reading from public remote
sources.

File:

• trunk/src/org/openstreetmap/josm/tools/Mediawiki.java (modified) (3 diffs)

trunk/src/org/openstreetmap/josm/tools/Mediawiki.java

@@ -7 +7 @@
 import java.util.List;
 import java.util.Optional;
+import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.BiConsumer;
 import java.util.stream.Collectors;
@@ -60 +61 @@
         final Document document = getDocument(url);
         final XPath xPath = XPathFactory.newInstance().newXPath();
-        for (String page : distinctPages) {
-            String normalized = xPath.evaluate("/api/query/normalized/n[@from='" + page + "']/@to", document);
-            if (Utils.isEmpty(normalized)) {
-                normalized = page;
+        AtomicReference<String> normalized = new AtomicReference<>();
+        AtomicReference<String> page = new AtomicReference<>();
+        xPath.setXPathVariableResolver(v -> {
+            if ("page".equals(v.getLocalPart())) {
+                return page.get();
+            } else if ("normalized".equals(v.getLocalPart())) {
+                return normalized.get();
             }
-            final Node node = (Node) xPath.evaluate("/api/query/pages/page[@title='" + normalized + "']", document, XPathConstants.NODE);
+            throw new IllegalArgumentException();
+        });
+        for (String p : distinctPages) {
+            page.set(p);
+            normalized.set(xPath.evaluate("/api/query/normalized/n[@from=$page]/@to", document));
+            if (Utils.isEmpty(normalized.get())) {
+                normalized.set(page.get());
+            }
+            final Node node = (Node) xPath.evaluate("/api/query/pages/page[@title=$normalized]", document, XPathConstants.NODE);
             if (node != null
                     && node.getAttributes().getNamedItem("missing") == null
                     && node.getAttributes().getNamedItem("invalid") == null) {
-                return Optional.of(page);
+                return Optional.of(page.get());
             }
         }
@@ -75 +87 @@
     }
 
-    private Document getDocument(URL url) throws IOException, ParserConfigurationException, SAXException {
+    private static Document getDocument(URL url) throws IOException, ParserConfigurationException, SAXException {
         final HttpClient.Response conn = HttpClient.create(url).connect();
         try (InputStream content = conn.getContent()) {