Skip to content

Commit f0c136b

Browse files
ylafonylafon
authored
Merge pull request #251 from w3c/email-entries
check that the input text is not an email.
2 parents dcc3287 + 37ff62d commit f0c136b

File tree

5 files changed

+154
-85
lines changed

5 files changed

+154
-85
lines changed

‎build.xml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
<available file="lib/commons-lang-2.6.jar"/>
3939
<available file="lib/commons-logging-1.1.3.jar"/>
4040
<available file="lib/commons-text-1.3.jar"/>
41+
<available file="lib/commons-validator-1.6.jar"/>
4142
<available file="lib/velocity-1.7.jar"/>
4243
<available file="lib/xercesImpl-2.11.0.jar"/>
4344
<available file="lib/xml-apis-1.4.01.jar"/>
@@ -61,6 +62,7 @@
6162
<get dest="tmp/commons-lang-2.6.jar" src="https://repo1.maven.org/maven2/commons-lang/commons-lang/2.6/commons-lang-2.6.jar" usetimestamp="true"/>
6263
<get dest="tmp/commons-text-1.3.jar" src="https://repo1.maven.org/maven2/org/apache/commons/commons-text/1.3/commons-text-1.3.jar" usetimestamp="true"/>
6364
<get dest="tmp/commons-logging-1.1.3.jar" src="https://repo1.maven.org/maven2/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar" usetimestamp="true"/>
65+
<get dest="tmp/commons-validator-1.6.jar" src="https://repo1.maven.org/maven2/commons-validator/commons-validator/1.6/commons-validator-1.6.jar" usetimestamp="true"/>
6466
<get dest="tmp/velocity-1.7.jar" src="https://repo1.maven.org/maven2/org/apache/velocity/velocity/1.7/velocity-1.7.jar" usetimestamp="true"/>
6567
<get dest="tmp/velocity-tools-2.0.jar" src="https://repo1.maven.org/maven2/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar" usetimestamp="true"/>
6668
<get dest="tmp/xercesImpl-2.11.0.jar" src="https://repo1.maven.org/maven2/xerces/xercesImpl/2.11.0/xercesImpl-2.11.0.jar" usetimestamp="true"/>
@@ -78,6 +80,7 @@
7880
<copy file="tmp/commons-lang-2.6.jar" tofile="lib/commons-lang-2.6.jar"/>
7981
<copy file="tmp/commons-text-1.3.jar" tofile="lib/commons-text-1.3.jar"/>
8082
<copy file="tmp/commons-logging-1.1.3.jar" tofile="lib/commons-logging-1.1.3.jar"/>
83+
<copy file="tmp/commons-validator-1.6.jar" tofile="lib/commons-validator-1.6.jar"/>
8184
<copy file="tmp/velocity-1.7.jar" tofile="lib/velocity-1.7.jar"/>
8285
<copy file="tmp/velocity-tools-2.0.jar" tofile="lib/velocity-tools-2.0.jar"/>
8386
<copy file="tmp/xercesImpl-2.11.0.jar" tofile="lib/xercesImpl-2.11.0.jar"/>

‎org/w3c/css/servlet/CssValidator.java

Lines changed: 89 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77

88
package org.w3c.css.servlet;
99

10+
import org.apache.commons.validator.routines.EmailValidator;
1011
import org.w3c.css.css.CssParser;
1112
import org.w3c.css.css.DocumentParser;
1213
import org.w3c.css.css.StyleReport;
@@ -17,11 +18,14 @@
1718
import org.w3c.css.error.ErrorReport;
1819
import org.w3c.css.error.ErrorReportFactory;
1920
import org.w3c.css.index.IndexGenerator;
21+
import org.w3c.css.parser.CssError;
22+
import org.w3c.css.parser.Errors;
2023
import org.w3c.css.util.ApplContext;
2124
import org.w3c.css.util.Codecs;
2225
import org.w3c.css.util.CssVersion;
2326
import org.w3c.css.util.FakeFile;
2427
import org.w3c.css.util.HTTPURL;
28+
import org.w3c.css.util.InvalidParamException;
2529
import org.w3c.css.util.NVPair;
2630
import org.w3c.css.util.Utf8Properties;
2731
import org.w3c.css.util.Util;
@@ -367,65 +371,76 @@ public void doGet(HttpServletRequest req, HttpServletResponse res)
367371
// " (" + req.getRemoteAddr() + ") at " + (new Date()) );
368372

369373
if (uri != null) {
370-
// HTML document
371-
try {
372-
uri = HTTPURL.getURL(uri).toString(); // needed to be sure
373-
// that it is a valid
374-
// url
375-
uri = uri.replaceAll(" ", "%20");
376-
if (Util.checkURI(uri)) {
377-
DocumentParser URLparser = new DocumentParser(ac, uri);
378-
handleRequest(ac, res, uri, URLparser.getStyleSheet(), output,
379-
warningLevel, errorReport);
380-
} else {
381-
res.setHeader("Rejected", "Requested URI Forbidden by Rule");
382-
handleError(res, ac, output, "Forbidden", new IOException(
383-
"URI Forbidden by rule"), false);
384-
}
385-
} catch (ProtocolException pex) {
386-
if (Util.onDebug) {
387-
pex.printStackTrace();
374+
// check for scammers
375+
EmailValidator ev = EmailValidator.getInstance();
376+
if (ev.isValid(uri)) {
377+
handleScam(ac, uri, res, output, warningLevel, errorReport);
378+
} else {
379+
// HTML document
380+
try {
381+
uri = HTTPURL.getURL(uri).toString(); // needed to be sure
382+
// that it is a valid
383+
// url
384+
uri = uri.replaceAll(" ", "%20");
385+
if (Util.checkURI(uri)) {
386+
DocumentParser URLparser = new DocumentParser(ac, uri);
387+
handleRequest(ac, res, uri, URLparser.getStyleSheet(), output,
388+
warningLevel, errorReport);
389+
} else {
390+
res.setHeader("Rejected", "Requested URI Forbidden by Rule");
391+
handleError(res, ac, output, "Forbidden", new IOException(
392+
"URI Forbidden by rule"), false);
393+
}
394+
} catch (ProtocolException pex) {
395+
if (Util.onDebug) {
396+
pex.printStackTrace();
397+
}
398+
res.setHeader("WWW-Authenticate", pex.getMessage());
399+
res.sendError(HttpServletResponse.SC_UNAUTHORIZED);
400+
} catch (Exception e) {
401+
handleError(res, ac, output, uri, e, true);
388402
}
389-
res.setHeader("WWW-Authenticate", pex.getMessage());
390-
res.sendError(HttpServletResponse.SC_UNAUTHORIZED);
391-
} catch (Exception e) {
392-
handleError(res, ac, output, uri, e, true);
393403
}
394404
} else if (text != null) {
395405
String fileName = "TextArea";
396406
Util.verbose("- " + fileName + " Data -");
397407
Util.verbose(text);
398408
Util.verbose("- End of " + fileName + " Data");
399-
InputStream is = new ByteArrayInputStream(text.getBytes());
400-
fileName = "file://localhost/" + fileName;
409+
EmailValidator ev = EmailValidator.getInstance();
410+
if (ev.isValid(text)) {
411+
handleScam(ac, text, res, output, warningLevel, errorReport);
412+
} else {
413+
InputStream is = new ByteArrayInputStream(text.getBytes());
414+
fileName = "file://localhost/" + fileName;
401415

402-
try {
416+
try {
403417

404-
if ("css".equals(type) || ("none".equals(type) && isCSS(text))) {
405-
// if CSS:
406-
parser = new StyleSheetParser();
407-
parser.parseStyleElement(ac, is, null, usermedium,
408-
new URL(fileName), 0);
418+
if ("css".equals(type) || ("none".equals(type) && isCSS(text))) {
419+
// if CSS:
420+
parser = new StyleSheetParser();
421+
parser.parseStyleElement(ac, is, null, usermedium,
422+
new URL(fileName), 0);
409423

410-
handleRequest(ac, res, fileName, parser
411-
.getStyleSheet(), output, warningLevel, errorReport);
412-
} else {
413-
// else, trying HTML
424+
handleRequest(ac, res, fileName, parser.getStyleSheet(),
425+
output, warningLevel, errorReport);
426+
} else {
427+
// else, trying HTML
414428
// HTMLParserStyleSheetHandler handler = new HTMLParserStyleSheetHandler(null, ac);
415-
TagSoupStyleSheetHandler handler = new TagSoupStyleSheetHandler(null, ac);
416-
handler.parse(is, fileName);
417-
418-
handleRequest(ac, res, fileName, handler.getStyleSheet(), output,
419-
warningLevel, errorReport);
420-
}
421-
} catch (ProtocolException pex) {
422-
if (Util.onDebug) {
423-
pex.printStackTrace();
429+
TagSoupStyleSheetHandler handler = new TagSoupStyleSheetHandler(null, ac);
430+
handler.parse(is, fileName);
431+
432+
handleRequest(ac, res, fileName, handler.getStyleSheet(), output,
433+
warningLevel, errorReport);
434+
}
435+
} catch (ProtocolException pex) {
436+
if (Util.onDebug) {
437+
pex.printStackTrace();
438+
}
439+
res.setHeader("WWW-Authenticate", pex.getMessage());
440+
res.sendError(HttpServletResponse.SC_UNAUTHORIZED);
441+
} catch (Exception e) {
442+
handleError(res, ac, output, fileName, e, false);
424443
}
425-
res.setHeader("WWW-Authenticate", pex.getMessage());
426-
res.sendError(HttpServletResponse.SC_UNAUTHORIZED);
427-
} catch (Exception e) {
428-
handleError(res, ac, output, fileName, e, false);
429444
}
430445
}
431446
Util.verbose("CssValidator: Request terminated.\n");
@@ -667,6 +682,12 @@ public void doPost(HttpServletRequest req, HttpServletResponse res)
667682
fileName = file.getName();
668683
Util.verbose("File : " + fileName);
669684
} else {
685+
// check POSTED text for possible scam
686+
EmailValidator ev = EmailValidator.getInstance();
687+
if (ev.isValid(text)) {
688+
handleScam(ac, text, res, output, warningLevel, errorReport);
689+
return;
690+
}
670691
ac.setFakeText(text);
671692
fileName = "TextArea";
672693
Util.verbose("- " + fileName + " Data -");
@@ -724,6 +745,27 @@ public void doPost(HttpServletRequest req, HttpServletResponse res)
724745
Util.verbose("CssValidator: Request terminated.\n");
725746
}
726747

748+
private void handleScam(ApplContext ac, String uri, HttpServletResponse res, String output,
749+
int warningLevel, boolean errorReport)
750+
throws IOException {
751+
// so it is an email and not a URL, do something clever.
752+
String fileName = "email";
753+
InputStream is = new ByteArrayInputStream("".getBytes());
754+
fileName = "file://" + fileName;
755+
try {
756+
TagSoupStyleSheetHandler handler = new TagSoupStyleSheetHandler(null, ac);
757+
handler.parse(is, fileName);
758+
// add a warning
759+
Errors e = new Errors();
760+
e.addError(new CssError(new InvalidParamException("email", uri, ac)));
761+
handler.getStyleSheet().addErrors(e);
762+
handleRequest(ac, res, fileName, handler.getStyleSheet(), output,
763+
warningLevel, errorReport);
764+
} catch (Exception e) {
765+
handleError(res, ac, output, fileName, e, false);
766+
}
767+
}
768+
727769
private void handleRequest(ApplContext ac, HttpServletResponse res,
728770
String title, StyleSheet styleSheet,
729771
String output, int warningLevel,

‎org/w3c/css/util/Messages.properties.en

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -444,3 +444,5 @@ error.invalidtype: Invalid type: \u201C%s\u201D
444444
error.typevaluemismatch: The value \u201C%s\u201D is incompatible with its type definition <\u201C%s\u201D>
445445

446446
error.emptymedia: In CSS2, the media type in @media is mandatory
447+
448+
error.email: email addresses cannot be validated by this tool, you might be scammed

‎org/w3c/css/util/Messages.properties.fr

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -465,3 +465,5 @@ error.invalidtype: Type invalide: \u201C%s\u201D
465465
error.typevaluemismatch: La valeur \u201C%s\u201D est incompatible avec sa définition de type <\u201C%s\u201D>
466466

467467
error.emptymedia: En CSS2, l'indication du type de media dans la règle @media est ogligatoire
468+
469+
error.email: Les adresses email ne peuvent être validées par cet outil, il est possible que vous soyez victime d'une escroquerie

0 commit comments

Comments
 (0)