--- .project | 11 +++ .../document/parser/html/TransformerWriter.java | 20 +----- .../net/yacy/document/parser/htmlParserTest.java | 78 ++++++++++++++++++++++ 3 files changed, 90 insertions(+), 19 deletions(-) diff --git a/.project b/.project index 7bc830b00..5f27c43c7 100644 --- a/.project +++ b/.project @@ -25,4 +25,15 @@ org.eclipse.jdt.core.javanature org.apache.ivyde.eclipse.ivynature + + + 1771186756556 + + 30 + + org.eclipse.core.resources.regexFilterMatcher + node_modules|\.git|__CREATED_BY_JAVA_LANGUAGE_SERVER__ + + + diff --git a/source/net/yacy/document/parser/html/TransformerWriter.java b/source/net/yacy/document/parser/html/TransformerWriter.java index 177d0584e..6477869ff 100644 --- a/source/net/yacy/document/parser/html/TransformerWriter.java +++ b/source/net/yacy/document/parser/html/TransformerWriter.java @@ -395,27 +395,9 @@ public final class TransformerWriter extends Writer { if (this.inSingleQuote) { this.buffer.append(c); if (c == singlequote) this.inSingleQuote = false; - // check error cases - if ((c == rb) && (this.buffer.length() > 0 && this.buffer.charAt(0) == lb)) { - this.inSingleQuote = false; - // the tag ends here. after filtering: pass on - filtered = this.tokenProcessor(this.buffer.getChars(), singlequote); - if (this.out != null) { this.out.write(filtered); } - // this.buffer = new serverByteBuffer(); - this.buffer.reset(); - } } else if (this.inDoubleQuote) { this.buffer.append(c); if (c == doublequote) this.inDoubleQuote = false; - // check error cases - if (c == rb && this.buffer.length() > 0 && this.buffer.charAt(0) == lb) { - this.inDoubleQuote = false; - // the tag ends here. after filtering: pass on - filtered = this.tokenProcessor(this.buffer.getChars(), doublequote); - if (this.out != null) this.out.write(filtered); - // this.buffer = new serverByteBuffer(); - this.buffer.reset(); - } } else if (this.inComment) { this.buffer.append(c); if (c == rb && @@ -554,4 +536,4 @@ public final class TransformerWriter extends Writer { return !this.binaryUnsuspect; } -} \ No newline at end of file +} diff --git a/test/java/net/yacy/document/parser/htmlParserTest.java b/test/java/net/yacy/document/parser/htmlParserTest.java index 760326ee1..5b87fdf88 100644 --- a/test/java/net/yacy/document/parser/htmlParserTest.java +++ b/test/java/net/yacy/document/parser/htmlParserTest.java @@ -470,4 +470,82 @@ public class htmlParserTest { System.out.println("ScraperScriptTagTest: [" + textSource + "] = [" + txt + "]"); assertEquals(txt, textSource); } + + /** + * Test for parseToScraper of class htmlParser with quoted attribute content + * containing ">" characters (for example Alpine.js x-data arrow functions). + * Attribute values must never leak as plain text. + */ + @Test + public void testParseToScraper_QuotedAttributeWithGt() throws MalformedURLException, IOException { + final AnchorURL url = new AnchorURL("http://localhost/"); + final String charset = StandardCharsets.UTF_8.name(); + final String textSource = "Visible text"; + final String testhtml = "" + + "

{" + + "this.mobileMainNavHeight = el.getBoundingClientRect().height;" + + "});" + + "}" + + "}\">" + + "

" + textSource + "

" + + "

" + + ""; + + final ContentScraper scraper = parseToScraper(url, charset, TagValency.IGNORE, new HashSet(), + new VocabularyScraper(), 0, testhtml, 10, 10); + + final String txt = scraper.getText(); + assertEquals(textSource + ".", txt); + assertFalse(txt.contains("getBoundingClientRect")); + assertFalse(txt.contains("mobileMainNavHeight")); + } + + /** + * Test for parseToScraper of class htmlParser with quoted attribute content + * containing a comparison using ">" and additional Alpine-style attributes. + * Attribute names/values must never leak as plain text. + */ + @Test + public void testParseToScraper_QuotedAttributeComparisonGt() throws MalformedURLException, IOException { + final AnchorURL url = new AnchorURL("http://localhost/"); + final String charset = StandardCharsets.UTF_8.name(); + final String textSource = "Next image"; + final String testhtml = "" + + "" + + ""; + + final ContentScraper scraper = parseToScraper(url, charset, TagValency.IGNORE, new HashSet(), + new VocabularyScraper(), 0, testhtml, 10, 10); + + final String txt = scraper.getText(); + assertTrue(txt.contains(textSource)); + assertFalse(txt.contains("@click")); + assertFalse(txt.contains("lightboxPrev")); + assertFalse(txt.contains("imgModalItems.length")); + } } -- cgit v1.2.3