Merge pull request DSpace#9289 from saschaszott/patch-21

Validation of page url in FeedbackRestRepository
4Science · Apr 30, 2024 · 2345ee4 · 2345ee4
2 parents b5b8ce2 + c4cc56a
commit 2345ee4
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/...ce-server-webapp/src/main/java/org/dspace/app/rest/repository/FeedbackRestRepository.java b/...ce-server-webapp/src/main/java/org/dspace/app/rest/repository/FeedbackRestRepository.java
@@ -79,8 +79,14 @@ protected FeedbackRest createAndReturn(Context context) throws AuthorizeExceptio
  throw new DSpaceBadRequestException("e-mail and message fields are mandatory!");
  }
 
+ String pageUrl = feedbackRest.getPage();
+ String urlPrefix = configurationService.getProperty("dspace.ui.url");
+ if (StringUtils.isNotBlank(pageUrl) && ! StringUtils.startsWith(pageUrl, urlPrefix)) {
+ throw new DSpaceBadRequestException("unexpected page url was submitted");
+ }
+
  try {
- feedbackService.sendEmail(context, req, recipientEmail, senderEmail, message, feedbackRest.getPage());
+ feedbackService.sendEmail(context, req, recipientEmail, senderEmail, message, pageUrl);
  } catch (IOException | MessagingException e) {
  throw new RuntimeException(e.getMessage(), e);
  }