actions/setup-java
1
0
Fork 0
mirror of https://github.com/actions/setup-java synced 2024-12-22 21:22:41 +00:00
Code Issues Activity

sanitzie XML characters

Browse source
This commit is contained in:
Bryan Clark 2019-12-10 09:26:51 -08:00
parent 9d56a3bd35
commit 551e2a2770
3 changed files with 41 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
__tests__/auth.test.ts
View file

@ -82,4 +82,22 @@ describe('auth tests', () => {
expect(fs.existsSync(m2Dir)).toBe(false);
expect(fs.existsSync(settingsFile)).toBe(false);
}, 100000);
it('escapes invalid XML inputs', () => {
const id = 'packages';
const username = 'bluebottle';
const password = '&<>"\'\'"><&';
expect(auth.generate(id, username, password)).toEqual(`
<settings>
<servers>
<server>
<id>${id}</id>
<username>${username}</username>
<password>&amp;&lt;&gt;&quot;&apos;&apos;&quot;&gt;&lt;&amp;</password>
</server>
</servers>
</settings>
`);
});
});

14
dist/index.js generated vendored
View file

@ -4145,15 +4145,23 @@ function configAuthentication(id, username, password) {
});
}
exports.configAuthentication = configAuthentication;
function escapeXML(value) {
return value
.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&apos;');
}
// only exported for testing purposes
function generate(id, username, password) {
return `
<settings>
<servers>
<server>
<id>${id}</id>
<username>${username}</username>
<password>${password}</password>
<id>${escapeXML(id)}</id>
<username>${escapeXML(username)}</username>
<password>${escapeXML(password)}</password>
</server>
</servers>
</settings>

15
src/auth.ts
View file

@ -27,15 +27,24 @@ export async function configAuthentication(
}
}
function escapeXML(value: string) {
return value
.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&apos;');
}
// only exported for testing purposes
export function generate(id: string, username: string, password: string) {
return `
<settings>
<servers>
<server>
<id>${id}</id>
<username>${username}</username>
<password>${password}</password>
<id>${escapeXML(id)}</id>
<username>${escapeXML(username)}</username>
<password>${escapeXML(password)}</password>
</server>
</servers>
</settings>