From ab49ef4dcaeb00bd6658cece9b29ca42f0b23567 Mon Sep 17 00:00:00 2001 From: Kamil Date: Thu, 15 Aug 2024 22:26:04 +0200 Subject: [PATCH 01/10] #2985 Prevent XSS for REST API by escape String content: - added serializer: XssStringSerializer; - defined ObjectMapper in xml config(springDispatcher-servlet.xml) and ApplicationBeans.getObjectMapper then use this method when new ObjectMapper; - corrected websocket url in index.js, websocketStore.js, dataPointEdit.jsp; - corrected visible escape text content in EventList.vue; - fixed HttpSenderRT for POST with JSON; - fixed: AuthenticationAPI, ConfigAPI, EventDetectorAPI, EventHandlerAPI, PointPropertiesAPI, PointValueAPI, SystemSettingsAPI, UtilsAPI, ViewAPI, ViewComponentAPI, ViewHierarchyAPI, PointHierarchyController, DataPointsBaseOnNameFilter; --- WebContent/WEB-INF/jsp/dataPointEdit.jsp | 10 +- .../WEB-INF/springDispatcher-servlet.xml | 20 +- scadalts-ui/src/store/index.js | 7 +- scadalts-ui/src/store/websocketStore.js | 6 +- scadalts-ui/src/views/Alarms/EventList.vue | 4 +- .../work/AbstractBeforeAfterWorkItem.java | 14 + .../mango/rt/maint/work/WorkItems.java | 2 - .../rt/publish/httpSender/HttpSenderRT.java | 64 +- .../CompoundComponentDeserializer.java | 3 +- .../HtmlComponentDeserializer.java | 3 +- .../ImageSetComponentDeserializer.java | 3 +- .../ImageStateListDeserializer.java | 3 +- .../PointComponentDeserializer.java | 3 +- .../ScriptBaseComponentDeserializer.java | 3 +- .../ViewComponentDeserializer.java | 3 +- .../EmailRecipientDeserializer.java | 3 +- .../mango/service/SystemSettingsService.java | 10 +- .../PermissionEvaluatorAclImp.java | 3 +- .../service/MultiChangesHistoryService.java | 3 +- src/org/scada_lts/service/UtilsService.java | 2 +- .../scada_lts/utils/CreateObjectUtils.java | 3 +- .../scada_lts/utils/SystemSettingsUtils.java | 13 + .../scada_lts/web/beans/ApplicationBeans.java | 5 + .../web/beans/XssStringSerializer.java | 20 + .../web/mvc/api/AuthenticationAPI.java | 48 +- src/org/scada_lts/web/mvc/api/ConfigAPI.java | 19 +- .../web/mvc/api/EventDetectorAPI.java | 21 +- .../web/mvc/api/EventHandlerAPI.java | 41 +- .../web/mvc/api/PointPropertiesAPI.java | 953 ++++++++---------- .../scada_lts/web/mvc/api/PointValueAPI.java | 91 +- .../web/mvc/api/SystemSettingsAPI.java | 47 +- src/org/scada_lts/web/mvc/api/UtilsAPI.java | 18 +- src/org/scada_lts/web/mvc/api/ViewAPI.java | 229 ++--- .../web/mvc/api/ViewComponentAPI.java | 26 +- .../web/mvc/api/ViewHierarchyAPI.java | 115 +-- .../modbusip/ModbusIpController.java | 3 +- .../report/DataPointsBaseOnNameFilter.java | 23 +- .../controller/PointHierarchyController.java | 127 +-- ...ExecutorConfigSystemSettingsUtilsTest.java | 20 +- 39 files changed, 810 insertions(+), 1181 deletions(-) create mode 100644 src/org/scada_lts/web/beans/XssStringSerializer.java diff --git a/WebContent/WEB-INF/jsp/dataPointEdit.jsp b/WebContent/WEB-INF/jsp/dataPointEdit.jsp index 1ffb2da1b7..8de649b777 100644 --- a/WebContent/WEB-INF/jsp/dataPointEdit.jsp +++ b/WebContent/WEB-INF/jsp/dataPointEdit.jsp @@ -396,13 +396,9 @@ } } // const - var pathArray = location.href.split( '/' ); - var protocol = pathArray[0]; - var host = pathArray[2]; - var appScada = pathArray[3]; var myLocation; if (!myLocation) { - myLocation = protocol + "//" + host + "/" + appScada + "/"; + myLocation = getAppLocation(); } var arrDictLoggingType = ["", "When point value changes", "All data", "Do not log", "Interval", "When point timestamp changes"]; @@ -813,7 +809,7 @@ jQuery.ajax({ type: "GET", dataType: "json", - url:myLocation+"/api/point_properties/getPropertiesBaseOnId/"+idPointConfigurationToBaseOnExistingPoint, + url:myLocation+"api/point_properties/getPropertiesBaseOnId/"+idPointConfigurationToBaseOnExistingPoint, success: function(properties){ setConfig(properties); }, @@ -836,7 +832,7 @@ jQuery.ajax({ type: "GET", dataType: "json", - url:myLocation+"/api/point_properties/getPropertiesBaseOnId/"+idPointConfigurationToBaseOnExistingPoint, + url:myLocation+"api/point_properties/getPropertiesBaseOnId/"+idPointConfigurationToBaseOnExistingPoint, success: function(properties){ let bCheckedType = checkType(properties.dataTypeId); diff --git a/WebContent/WEB-INF/springDispatcher-servlet.xml b/WebContent/WEB-INF/springDispatcher-servlet.xml index d7b17a4914..9028967d1c 100644 --- a/WebContent/WEB-INF/springDispatcher-servlet.xml +++ b/WebContent/WEB-INF/springDispatcher-servlet.xml @@ -11,7 +11,11 @@ http://www.springframework.org/schema/mvc/spring-mvc-4.2.xsd"> - + + + + + @@ -215,4 +219,18 @@ dataSourceList + + + + + + + + + + + + + + diff --git a/scadalts-ui/src/store/index.js b/scadalts-ui/src/store/index.js index 0774a26d13..ca6029591b 100644 --- a/scadalts-ui/src/store/index.js +++ b/scadalts-ui/src/store/index.js @@ -75,7 +75,7 @@ export default new Vuex.Store({ // useCredentials: true, // credentials: 'same-origin', }, - webSocketUrl: 'ws-scada/alarmLevel', + webSocketUrl: 'ws-scada', timePeriods: [ { id: 1, label: i18n.t('common.timeperiod.seconds') }, @@ -98,7 +98,10 @@ export default new Vuex.Store({ }, mutations: { updateWebSocketUrl(state) { - state.webSocketUrl = getAppLocation() + state.webSocketUrl; + let base = getAppLocation(); + if(!state.webSocketUrl.includes(base)) { + state.webSocketUrl = base + state.webSocketUrl; + } }, updateRequestTimeout(state, timeout) { diff --git a/scadalts-ui/src/store/websocketStore.js b/scadalts-ui/src/store/websocketStore.js index 3d0b8f053d..e8a4164b76 100644 --- a/scadalts-ui/src/store/websocketStore.js +++ b/scadalts-ui/src/store/websocketStore.js @@ -18,7 +18,11 @@ const webSocketModule = { mutations: { INIT_WEBSOCKET(state) { - let socket = new SockJS(getAppLocation() + state.webSocketUrl); + let base = getAppLocation(); + if(!state.webSocketUrl.includes(base)) { + state.webSocketUrl = base + state.webSocketUrl; + } + let socket = new SockJS(state.webSocketUrl); let client = Stomp.over(socket); if(!state.debugMode) { client.debug = () => {}; diff --git a/scadalts-ui/src/views/Alarms/EventList.vue b/scadalts-ui/src/views/Alarms/EventList.vue index 418790dadf..7671822695 100644 --- a/scadalts-ui/src/views/Alarms/EventList.vue +++ b/scadalts-ui/src/views/Alarms/EventList.vue @@ -327,7 +327,7 @@ {{ $t(`eventList.sourceType${item.typeId}`) }}