[TECHNICAL SUPPORT] LPS-125854 Fix XSS validating context and encoding HTML

[liferay-continuous-integration]

Forwarded from: liferay-frontend#699 (Took 1 ci:forward attempt in 3 hours 8 minutes)

@NemethNorbert
@liferay-frontend

Original pull request comment:
Hey,
LPS-125854,

I based my work on: 418sec/form#1

First sec issue, let me know if I missed something.

Please review it.
Thanks,

✔️ ci:test:stable - 9 out of 9 jobs passed

✔️ ci:test:relevant - 23 out of 23 jobs passed in 2 hours 39 minutes

Click here for more details.

Base Branch:

Branch Name: master
Branch GIT ID: 7d640f4b27841520daf470b08dbe8683c2f2e033

Copied in Private Modules Branch:

Branch Name: master-private
Branch GIT ID: 2b89e6be0ae0f6e12dec390930d3e9525006e687

ci:test:stable - 9 out of 9 jobs PASSED

9 Successful Jobs:

• test-portal-acceptance-pullrequest-batch(master)/functional-smoke-tomcat90-mysql57-jdk8_stable/0
• test-portal-acceptance-pullrequest-batch(master)/functional-upgrade-tomcat90-mysql57-jdk8_stable/0
• test-portal-acceptance-pullrequest-batch(master)/js-unit-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/modules-integration-mysql57-jdk8_stable/0
• test-portal-acceptance-pullrequest-batch(master)/modules-unit-jdk8_stable/0
• test-portal-acceptance-pullrequest-batch(master)/pmd-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/rest-builder-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/service-builder-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/unit-jdk8_stable/0

ci:test:relevant - 23 out of 23 jobs PASSED

23 Successful Jobs:

• test-portal-acceptance-pullrequest(master)
• test-portal-acceptance-pullrequest-batch(master)/central-requirements-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/functional-smoke-tomcat90-mysql57-jdk11_open/0
• test-portal-acceptance-pullrequest-batch(master)/functional-smoke-tomcat90-mysql57-jdk8_stable/0
• test-portal-acceptance-pullrequest-batch(master)/functional-tomcat90-mysql57-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/functional-upgrade-tomcat90-mysql57-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/functional-upgrade-tomcat90-mysql57-jdk8_stable/0
• test-portal-acceptance-pullrequest-batch(master)/js-unit-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/lpkg-base-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/lpkg-controller-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/modules-compile-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/modules-integration-mysql57-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/modules-integration-mysql57-jdk8_stable/0
• test-portal-acceptance-pullrequest-batch(master)/modules-semantic-versioning-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/modules-unit-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/modules-unit-jdk8_stable/0
• test-portal-acceptance-pullrequest-batch(master)/modules-unit-project-templates-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/pmd-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/rest-builder-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/semantic-versioning-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/service-builder-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/unit-jdk8/0
• test-portal-acceptance-pullrequest-batch(master)/unit-jdk8_stable/0

For more details click here.

✔️ ci:test:sf - 1 out of 1 jobs passed in 0 ms

Click here for more details.

Base Branch:

Branch Name: master
Branch GIT ID: 9abb5412f865531a30c879edc61e94795e419bce

Sender Branch:

Branch Name: LPS-125854
Branch GIT ID: e144224c2ff63145dc2a6ed2607c1fdb7dbe1a56

1 out of 1jobs PASSED

1 Successful Jobs:

• test-portal-source-format

For more details click here.

[liferay-continuous-integration]

To conserve resources, the PR Tester does not automatically run for forwarded pull requests.

[brianchandotcom]

@NemethNorbert I'm not fond this

	 * version: 3.51.0-2014.06.20
	 * version: 3.51.0.LIFERAY-PATCHED-ISSUE-586

First, it doesn't work for more than one patch issue. Second, I have no idea what the patch was. If you look at our other patched files in modules/third-party, we use actual patch files.

I'm OK with using a patch file in build.gradle

See archived/opensocial-portlet/patches/LPS-21488.patch

But we can do it other ways as well. Please consult with @jbalsas and @wincent thx.

[jbalsas]

Thanks @brianchandotcom, I had similar doubts, but seeing as this is a very old plugin which hasn't changed ever, it felt like the odds of us having to apply more patches is really insignificant compared to the cost of applying patches.

We'll try to work out a different approach.

[wincent]

I pushed this to my fork as a POC of an alternative approach (downloading then patching the jquery.form source), but I am not really a huge fan of it. There are all sorts of annoying obstacles caused by the way Gradle works (caching) and the other build tooling (Babel); for example, to patch the original source, you can't prepare a patch against what's in src and apply it to build/ or classes/, because the whitespace gets damaged on the way through — so that means you have to patch in-place and then you're fighting against the cache.