[
https://issues.apache.org/jira/browse/JSPWIKI-1323?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137558#comment-18137558
]
Arturo Bernal commented on JSPWIKI-1323:
----------------------------------------
Pull request: https://github.com/apache/jspwiki/pull/577
The cookie is now ignored when it cannot be decoded or is not a JSON object,
and the default preferences are used. With the WAR on Tomcat 10.1, a request
for the page Main with the cookie {not-json, [1,2], 123 or "text" gives the
same page as a request without a cookie (9966 bytes, 4 script tags); on master
it gave 3954 bytes and 0 script tags. The 5 tests of the new PreferencesTest
pass, and 2 of them fail on master. Not run: the whole test suite, and a cookie
written by an older version.
> A malformed JSPWikiUserPrefs cookie makes the page lose its stylesheets and
> scripts
> -----------------------------------------------------------------------------------
>
> Key: JSPWIKI-1323
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1323
> Project: JSPWiki
> Issue Type: Bug
> Reporter: Arturo Bernal
> Priority: Minor
> Labels: pull-request-available
>
> The preferences of the user are read from the cookie JSPWikiUserPrefs in
> Preferences.parseJSONPreferences (jspwiki-main) with new Gson().fromJson(
> value, Map.class ) and no error handling.
> Measured on master (4b436f943, the war on Tomcat 10.1), requesting Wiki.jsp
> for the page Main with the cookie set:
> * No cookie, or a JSON object with an unknown SkinName, an invalid TimeZone
> or DateFormat, an unknown Language, or null or array values: HTTP 200 and the
> complete page (9966 bytes, 4 script tags, links to templates/default/).
> * A value that is not JSON ({not-json) or is not a JSON object ([1,2], 123,
> "text"): HTTP 200 but a page of 3954 bytes with the header, the content and
> the footer and nothing in the head: no link to the stylesheets and no script
> tag (0 of them). The log has com.google.gson.JsonSyntaxException inside a JSP
> tag (WikiTagBase).
> The user gets the page as plain HTML without style, and because no script is
> loaded, the script that would replace the cookie (Wiki.js compares the
> version stored in it) never runs, so the page stays that way until the cookie
> is deleted by hand. This is the kind of incompatibility between the server
> and the cookie that JSPWIKI-168 is about.
> I do not know how a real user ends up with such a cookie: I built these
> values by hand and did not try a cookie written by an older version.
> Proposal: ignore the cookie when its value is not a JSON object, so that the
> default preferences are used and the script can replace it.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
