mirror of
https://github.com/Alfresco/alfresco-community-repo.git
synced 2025-08-14 17:58:59 +00:00
7e1f737e7e
93834: Merged 5.0.N (5.0.1) to HEAD-BUG-FIX (5.1/Cloud)
93734: Merged V4.2-BUG-FIX (4.2.5) to 5.0.N (5.0.1)
- SOURCE/root/projects/remote-api/config/alfresco/templates/webscripts/org/alfresco/collaboration/calendar.get.html.ftl
was removed from 5.0 as part of an EOL activity
93559: Merged V4.2.4 (4.2.4) to V4.2-BUG-FIX (4.2.5)
93544: Merged DEV to V4.2.4 (4.2.4)
93482: MNT-13174: /share/service/components/form {htmlid} unsanitized: XSS vulnerability
- Add html escape to avoid XSS vulnerability
93545: Merged DEV to V4.2.4 (4.2.4)
93508 : MNT-13177 : /alfresco/wcservice/search/keyword {l} unsanitized: XSS vulnerability
- Escape search.localeId property
93549: Merged DEV to V4.2.4 (4.2.4)
93540 : MNT-13173 : /share/service/components/form {destination} unsanitized: XSS vulnerability
- Add html escape to avoid XSS vulnerability
93555: Merged DEV to V4.2.4 (4.2.4)
93476: MNT-13178: /alfresco/wcservice/api/search/person {l} unsanitized: XSS vulnerability
- Add url escape to avoid XSS vulnerability
93556: Merged DEV to V4.2.4 (4.2.4)
93477: MNT-13176 : /alfresco/wcservice/collaboration/calendar {nodeRef} unsanitized: XSS vulnerability
- Added ?html built-in processing for nodeRef argument.
93718: Merged V4.2.4 (4.2.4) to V4.2-BUG-FIX (4.2.5)
93671: Merged DEV to PATCHES/V4.2.4 (4.2.4)
93661: MNT-13180: go through all API URI and confirm all parameters are sanitized
- Add unit test that checks all webscripts for sanitized parameters
93672: MNT-13190: /alfresco/wcservice/sample/blog/search {q} unsanitized: XSS vulnerability
Add html escape to fix XSS vulnerability
93691: MNT-13190: /alfresco/wcservice/sample/blog/search {q} unsanitized: XSS vulnerability
Patch imported blogsearch template
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@94995 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
117 lines
5.8 KiB
Java
117 lines
5.8 KiB
Java
/*
|
|
* Copyright (C) 2005-2012 Alfresco Software Limited.
|
|
*
|
|
* This file is part of Alfresco
|
|
*
|
|
* Alfresco is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Lesser General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* Alfresco is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public License
|
|
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
package org.alfresco.repo.web.scripts;
|
|
|
|
import junit.framework.Test;
|
|
import junit.framework.TestSuite;
|
|
|
|
import org.alfresco.repo.web.scripts.action.RunningActionRestApiTest;
|
|
import org.alfresco.repo.web.scripts.activities.feed.control.FeedControlTest;
|
|
import org.alfresco.repo.web.scripts.admin.AdminWebScriptTest;
|
|
import org.alfresco.repo.web.scripts.audit.AuditWebScriptTest;
|
|
import org.alfresco.repo.web.scripts.blogs.BlogServiceTest;
|
|
import org.alfresco.repo.web.scripts.comment.CommentsApiTest;
|
|
import org.alfresco.repo.web.scripts.dictionary.DictionaryRestApiTest;
|
|
import org.alfresco.repo.web.scripts.discussion.DiscussionRestApiTest;
|
|
import org.alfresco.repo.web.scripts.facet.FacetRestApiTest;
|
|
import org.alfresco.repo.web.scripts.forms.FormRestApiGet_Test;
|
|
import org.alfresco.repo.web.scripts.forms.FormRestApiJsonPost_Test;
|
|
import org.alfresco.repo.web.scripts.groups.GroupsTest;
|
|
import org.alfresco.repo.web.scripts.invitation.InvitationWebScriptTest;
|
|
import org.alfresco.repo.web.scripts.invite.InviteServiceTest;
|
|
import org.alfresco.repo.web.scripts.person.PersonServiceTest;
|
|
import org.alfresco.repo.web.scripts.preference.PreferenceServiceTest;
|
|
import org.alfresco.repo.web.scripts.publishing.PublishingRestApiTest;
|
|
import org.alfresco.repo.web.scripts.quickshare.QuickShareRestApiTest;
|
|
import org.alfresco.repo.web.scripts.rating.RatingRestApiTest;
|
|
import org.alfresco.repo.web.scripts.replication.ReplicationRestApiTest;
|
|
import org.alfresco.repo.web.scripts.rule.RuleServiceTest;
|
|
import org.alfresco.repo.web.scripts.search.PersonSearchTest;
|
|
import org.alfresco.repo.web.scripts.site.SiteServiceTest;
|
|
import org.alfresco.repo.web.scripts.solr.SOLRWebScriptTest;
|
|
import org.alfresco.repo.web.scripts.subscriptions.SubscriptionServiceRestApiTest;
|
|
import org.alfresco.repo.web.scripts.tagging.TaggingServiceTest;
|
|
import org.alfresco.repo.web.scripts.thumbnail.ThumbnailServiceTest;
|
|
import org.alfresco.repo.web.scripts.transfer.TransferWebScriptTest;
|
|
import org.alfresco.repo.web.scripts.workflow.ActivitiWorkflowRestApiTest;
|
|
import org.alfresco.repo.web.scripts.workflow.JBPMWorkflowRestApiTest;
|
|
import org.alfresco.repo.web.scripts.workflow.WorkflowModelBuilderTest;
|
|
import org.alfresco.slingshot.documentlibrary.FolderTemplateTest;
|
|
import org.alfresco.slingshot.web.scripts.SlingshotContentGetTest;
|
|
|
|
/**
|
|
* Web Scripts test suite
|
|
*/
|
|
public class WebScriptTestSuite extends TestSuite
|
|
{
|
|
public static Test suite()
|
|
{
|
|
TestSuite suite = new TestSuite();
|
|
|
|
// Ensure that a suitable context is available
|
|
TestWebScriptRepoServer.getTestServer();
|
|
|
|
// Add the tests
|
|
suite.addTestSuite( QuickShareRestApiTest.class );
|
|
suite.addTestSuite( AdminWebScriptTest.class );
|
|
suite.addTestSuite( AuditWebScriptTest.class );
|
|
suite.addTestSuite( BlogServiceTest.class );
|
|
suite.addTestSuite( DictionaryRestApiTest.class );
|
|
suite.addTestSuite( DiscussionRestApiTest.class );
|
|
suite.addTestSuite( FeedControlTest.class );
|
|
suite.addTestSuite( FormRestApiGet_Test.class );
|
|
suite.addTestSuite( FormRestApiJsonPost_Test.class );
|
|
suite.addTestSuite( GroupsTest.class );
|
|
suite.addTestSuite( InvitationWebScriptTest.class );
|
|
suite.addTestSuite( InviteServiceTest.class );
|
|
suite.addTestSuite( LoginTest.class );
|
|
suite.addTestSuite( PersonSearchTest.class );
|
|
suite.addTestSuite( PersonServiceTest.class );
|
|
suite.addTestSuite( PreferenceServiceTest.class );
|
|
suite.addTestSuite( RatingRestApiTest.class );
|
|
suite.addTestSuite( ReplicationRestApiTest.class );
|
|
suite.addTestSuite( RepositoryContainerTest.class );
|
|
suite.addTestSuite( RuleServiceTest.class );
|
|
suite.addTestSuite( RunningActionRestApiTest.class );
|
|
suite.addTestSuite( SiteServiceTest.class );
|
|
suite.addTestSuite( TaggingServiceTest.class );
|
|
suite.addTestSuite( ThumbnailServiceTest.class );
|
|
suite.addTestSuite( TransferWebScriptTest.class );
|
|
suite.addTestSuite( WorkflowModelBuilderTest.class );
|
|
suite.addTestSuite( ActivitiWorkflowRestApiTest.class );
|
|
suite.addTestSuite( JBPMWorkflowRestApiTest.class );
|
|
suite.addTestSuite( PublishingRestApiTest.class );
|
|
suite.addTestSuite( SOLRWebScriptTest.class );
|
|
suite.addTestSuite( SubscriptionServiceRestApiTest.class );
|
|
suite.addTestSuite( FacetRestApiTest.class );
|
|
suite.addTestSuite( CommentsApiTest.class );
|
|
suite.addTestSuite( FolderTemplateTest.class );
|
|
suite.addTestSuite( DeclarativeSpreadsheetWebScriptTest.class );
|
|
suite.addTestSuite( SlingshotContentGetTest.class);
|
|
suite.addTestSuite( XssVulnerabilityTest.class );
|
|
|
|
// This uses a slightly different context
|
|
// As such, we can't run it in the same suite as the others,
|
|
// due to finalisers closing caches when we're not looking
|
|
//suite.addTestSuite( AssetTest.class );
|
|
|
|
return suite;
|
|
}
|
|
}
|