[
https://issues.apache.org/jira/browse/JSPWIKI-1323?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18139299#comment-18139299
]
ASF subversion and git services commented on JSPWIKI-1323:
----------------------------------------------------------
Commit 0a67663e34797d91a8c09d18e2ad99e41d3187fe in jspwiki's branch
refs/heads/master from Arturo Bernal
[ https://gitbox.apache.org/repos/asf?p=jspwiki.git;h=0a67663e3 ]
JSPWIKI-1323 Ignore a preferences cookie that is not a JSON object
The cookie is client data. A value that is not JSON, or not a JSON object, made
Gson throw inside the page header, so the page was sent without its stylesheets
and scripts, and the script that replaces the cookie never ran. Such a cookie
is now ignored and the default preferences are used.
> A malformed JSPWikiUserPrefs cookie makes the page lose its stylesheets and
> scripts
> -----------------------------------------------------------------------------------
>
> Key: JSPWIKI-1323
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1323
> Project: JSPWiki
> Issue Type: Bug
> Reporter: Arturo Bernal
> Priority: Minor
> Labels: pull-request-available
>
> The preferences of the user are read from the cookie JSPWikiUserPrefs in
> Preferences.parseJSONPreferences (jspwiki-main) with new Gson().fromJson(
> value, Map.class ) and no error handling.
> Measured on master (4b436f943, the war on Tomcat 10.1), requesting Wiki.jsp
> for the page Main with the cookie set:
> * No cookie, or a JSON object with an unknown SkinName, an invalid TimeZone
> or DateFormat, an unknown Language, or null or array values: HTTP 200 and the
> complete page (9966 bytes, 4 script tags, links to templates/default/).
> * A value that is not JSON ({not-json) or is not a JSON object ([1,2], 123,
> "text"): HTTP 200 but a page of 3954 bytes with the header, the content and
> the footer and nothing in the head: no link to the stylesheets and no script
> tag (0 of them). The log has com.google.gson.JsonSyntaxException inside a JSP
> tag (WikiTagBase).
> The user gets the page as plain HTML without style, and because no script is
> loaded, the script that would replace the cookie (Wiki.js compares the
> version stored in it) never runs, so the page stays that way until the cookie
> is deleted by hand. This is the kind of incompatibility between the server
> and the cookie that JSPWIKI-168 is about.
> I do not know how a real user ends up with such a cookie: I built these
> values by hand and did not try a cookie written by an older version.
> Proposal: ignore the cookie when its value is not a JSON object, so that the
> default preferences are used and the script can replace it.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
