Skip to content

Commit

Permalink
Escaping certain elements to avoid code injection #117
Browse files Browse the repository at this point in the history 
The error message, stacktrace, custom messages in report is escaped.
  • Loading branch information
@apoorvam
apoorvam committed Dec 20, 2016
1 parent 1df95d2 commit 61b1163
Show file tree
Hide file tree
Showing 18 changed files with 256 additions and 244 deletions.
24 changes: 12 additions & 12 deletions generator/_testdata/expectedE2E/before_suite_fail.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,18 +95,18 @@ <h2 class="project">Project: Gauge Project</h2>
<div class="exception-container hidden">
<div class="exception">
<pre class="stacktrace">
StepImplementation.foo(StepImplementation.java:16)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:483)
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)
StepImplementation.foo(StepImplementation.java:16)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<br/>
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br/>
java.lang.reflect.Method.invoke(Method.java:483)<br/>
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)<br/>
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)<br/>
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)<br/>
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)<br/>
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)<br/>
com.thoughtworks.gauge.GaugeRuntime.main(GaugeRuntime.java:37)
</pre>
</div>
Expand Down
24 changes: 12 additions & 12 deletions generator/_testdata/expectedE2E/failing_specification_1.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -176,18 +176,18 @@ <h4 class="error-message">
<pre>java.lang.RuntimeException</pre>
</h4>
<pre class="stacktrace">
StepImplementation.foo(StepImplementation.java:16)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:483)
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)
StepImplementation.foo(StepImplementation.java:16)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<br/>
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br/>
java.lang.reflect.Method.invoke(Method.java:483)<br/>
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)<br/>
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)<br/>
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)<br/>
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)<br/>
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)<br/>
com.thoughtworks.gauge.GaugeRuntime.main(GaugeRuntime.java:37)
</pre>
</div>
Expand Down
24 changes: 12 additions & 12 deletions generator/_testdata/integration/after_scenario_fail.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -166,18 +166,18 @@ <h5 class='execution-time'>
<div class="exception-container hidden">
<div class="exception">
<pre class="stacktrace">
StepImplementation.foo(StepImplementation.java:16)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:483)
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)
StepImplementation.foo(StepImplementation.java:16)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<br/>
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br/>
java.lang.reflect.Method.invoke(Method.java:483)<br/>
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)<br/>
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)<br/>
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)<br/>
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)<br/>
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)<br/>
com.thoughtworks.gauge.GaugeRuntime.main(GaugeRuntime.java:37)
</pre>
</div>
Expand Down
24 changes: 12 additions & 12 deletions generator/_testdata/integration/after_spec_fail.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -286,18 +286,18 @@ <h5 class='execution-time'>
<div class="exception-container hidden">
<div class="exception">
<pre class="stacktrace">
StepImplementation.foo(StepImplementation.java:16)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:483)
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)
StepImplementation.foo(StepImplementation.java:16)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<br/>
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br/>
java.lang.reflect.Method.invoke(Method.java:483)<br/>
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)<br/>
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)<br/>
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)<br/>
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)<br/>
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)<br/>
com.thoughtworks.gauge.GaugeRuntime.main(GaugeRuntime.java:37)
</pre>
</div>
Expand Down
24 changes: 12 additions & 12 deletions generator/_testdata/integration/after_step_fail.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -149,18 +149,18 @@ <h5 class='execution-time'>
<div class="exception-container hidden">
<div class="exception">
<pre class="stacktrace">
StepImplementation.foo(StepImplementation.java:16)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:483)
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)
StepImplementation.foo(StepImplementation.java:16)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<br/>
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br/>
java.lang.reflect.Method.invoke(Method.java:483)<br/>
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)<br/>
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)<br/>
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)<br/>
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)<br/>
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)<br/>
com.thoughtworks.gauge.GaugeRuntime.main(GaugeRuntime.java:37)
</pre>
</div>
Expand Down
24 changes: 12 additions & 12 deletions generator/_testdata/integration/after_suite_fail.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,18 +95,18 @@ <h2 class="project">Project: Gauge Project</h2>
<div class="exception-container hidden">
<div class="exception">
<pre class="stacktrace">
StepImplementation.foo(StepImplementation.java:16)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:483)
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)
StepImplementation.foo(StepImplementation.java:16)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<br/>
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br/>
java.lang.reflect.Method.invoke(Method.java:483)<br/>
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)<br/>
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)<br/>
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)<br/>
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)<br/>
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)<br/>
com.thoughtworks.gauge.GaugeRuntime.main(GaugeRuntime.java:37)
</pre>
</div>
Expand Down
48 changes: 24 additions & 24 deletions generator/_testdata/integration/before_after_scenario_fail.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -152,18 +152,18 @@ <h3 class="head borderBottom">Scenario Heading</h3>
<div class="exception-container hidden">
<div class="exception">
<pre class="stacktrace">
StepImplementation.foo(StepImplementation.java:16)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:483)
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)
StepImplementation.foo(StepImplementation.java:16)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<br/>
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br/>
java.lang.reflect.Method.invoke(Method.java:483)<br/>
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)<br/>
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)<br/>
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)<br/>
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)<br/>
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)<br/>
com.thoughtworks.gauge.GaugeRuntime.main(GaugeRuntime.java:37)
</pre>
</div>
Expand Down Expand Up @@ -195,18 +195,18 @@ <h3 class="head borderBottom">Scenario Heading</h3>
<div class="exception-container hidden">
<div class="exception">
<pre class="stacktrace">
StepImplementation.foo(StepImplementation.java:16)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:483)
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)
StepImplementation.foo(StepImplementation.java:16)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br/>
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<br/>
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br/>
java.lang.reflect.Method.invoke(Method.java:483)<br/>
com.thoughtworks.gauge.execution.MethodExecutor.execute(MethodExecutor.java:32)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.executeHook(HooksExecutor.java:98)<br/>
com.thoughtworks.gauge.execution.HooksExecutor$TaggedHookExecutor.execute(HooksExecutor.java:84)<br/>
com.thoughtworks.gauge.execution.HooksExecutor.execute(HooksExecutor.java:41)<br/>
com.thoughtworks.gauge.processor.MethodExecutionMessageProcessor.executeHooks(MethodExecutionMessageProcessor.java:55)<br/>
com.thoughtworks.gauge.processor.SuiteExecutionStartingProcessor.process(SuiteExecutionStartingProcessor.java:26)<br/>
com.thoughtworks.gauge.connection.MessageDispatcher.dispatchMessages(MessageDispatcher.java:72)<br/>
com.thoughtworks.gauge.GaugeRuntime.main(GaugeRuntime.java:37)
</pre>
</div>
Expand Down
Loading

0 comments on commit 61b1163

Please sign in to comment.