Merge pull request #775 from songproducer/fix/xss-reflected-input

fix: HTML-escape reflected user input and crawled document metadata to prevent XSS (#401, #630) 

2 files changed, 9 insertions, 8 deletions

diff --git a/source/net/yacy/htroot/ViewFile.java b/source/net/yacy/htroot/ViewFile.java
index 25d9d0072..0ec25cf4d 100644
--- a/source/net/yacy/htroot/ViewFile.java
+++ b/source/net/yacy/htroot/ViewFile.java
@@ -279,13 +279,14 @@ public class ViewFile {
                 final String content = document.getTextString();

                 // content = wikiCode.replaceHTML(content); // added by Marc Nause

                 prop.put("viewMode", VIEW_MODE_AS_PARSED_TEXT);

-                prop.put("viewMode_title", document.dc_title());

-                prop.put("viewMode_creator", document.dc_creator());

-                prop.put("viewMode_subject", document.dc_subject(','));

-                prop.put("viewMode_description", document.dc_description().length == 0 ? new String[]{""} : document.dc_description());

-                prop.put("viewMode_publisher", document.dc_publisher());

-                prop.put("viewMode_format", document.dc_format());

-                prop.put("viewMode_identifier", document.dc_identifier());

+                prop.putHTML("viewMode_title", document.dc_title());

+                prop.putHTML("viewMode_creator", document.dc_creator());

+                prop.putHTML("viewMode_subject", document.dc_subject(','));

+                final String[] descs = document.dc_description();

+                prop.putHTML("viewMode_description", descs.length == 0 ? "" : String.join("; ", descs));

+                prop.putHTML("viewMode_publisher", document.dc_publisher());

+                prop.putHTML("viewMode_format", document.dc_format());

+                prop.putHTML("viewMode_identifier", document.dc_identifier());

                 prop.put("viewMode_source", url.toNormalform(false));

                 prop.put("viewMode_lat", document.lat());

                 prop.put("viewMode_lon", document.lon());

diff --git a/source/net/yacy/htroot/yacysearch.java b/source/net/yacy/htroot/yacysearch.java
index dbe77d1ec..05647672d 100644
--- a/source/net/yacy/htroot/yacysearch.java
+++ b/source/net/yacy/htroot/yacysearch.java
@@ -188,7 +188,7 @@ public class yacysearch {
             prop.put("offset", "0");
             prop.put("resource", "global");
             prop.put("urlmaskfilter", (post == null) ? ".*" : post.get("urlmaskfilter", ".*"));
-            prop.put("prefermaskfilter", (post == null) ? "" : post.get("prefermaskfilter", ""));
+            prop.putHTML("prefermaskfilter", (post == null) ? "" : post.get("prefermaskfilter", ""));
             prop.put("indexof", "off");
             prop.put("constraint", "");
             prop.put("depth", "0");