diff --git a/pom.xml b/pom.xml index 843d54c..9411f84 100644 --- a/pom.xml +++ b/pom.xml @@ -12,6 +12,7 @@ 1.9.3 1.7.7 1.7.7 + 1.2.3 @@ -83,11 +84,27 @@ ${sl4j.version} + + + org.owasp.encoder + encoder + ${owaspencoder.version} + + + + + src/main/resources + + jetty/*.* + + + + @@ -103,11 +120,13 @@ org.mortbay.jetty jetty-maven-plugin + src/main/resources/jetty/jetty.xml 9966 foo 10 /lode + src/main/resources/jetty/override-web.xml - * + * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. - * + * * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR @@ -24,12 +24,14 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import org.owasp.encoder.Encode; + /** * Servlet implementation class GetSource */ public class GetSource extends HttpServlet { private static final long serialVersionUID = 1L; - + /** * @see HttpServlet#HttpServlet() */ @@ -42,18 +44,18 @@ public GetSource() { * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response) */ protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { - + SourceExtractor extractor = new SourceExtractor(); extractor.addMimeTypes(MimeType.mimeTypes); response.setCharacterEncoding("UTF-8"); - + try { String stringURL = request.getParameter("url"); String content = ""; - + URL ontologyURL = new URL(stringURL); content = extractor.exec(ontologyURL); - + response.setContentType("text/plain"); PrintWriter out = response.getWriter(); out.println(content); @@ -65,7 +67,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) t } private String getErrorPage(Exception e) { - return + return "" + "LODE error" + "" + @@ -73,7 +75,7 @@ private String getErrorPage(Exception e) { "LODE: get source error" + "" + "

Reason: " + - e.getMessage() + + Encode.forHtml(e.getMessage()) + "

" + "" + ""; diff --git a/src/main/java/it/essepuntato/lode/LodeServlet.java b/src/main/java/it/essepuntato/lode/LodeServlet.java index 93127c8..99459c8 100644 --- a/src/main/java/it/essepuntato/lode/LodeServlet.java +++ b/src/main/java/it/essepuntato/lode/LodeServlet.java @@ -1,10 +1,10 @@ -/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * +/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Copyright (c) 2010-2013, Silvio Peroni - * + * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. - * + * * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR @@ -86,6 +86,8 @@ import com.clarkparsia.pellet.owlapiv3.PelletReasoner; import com.clarkparsia.pellet.owlapiv3.PelletReasonerFactory; +import org.owasp.encoder.Encode; + /** * Servlet implementation class LodeServlet */ @@ -191,19 +193,19 @@ private void resolvePaths(HttpServletRequest request) { * considerImportedOntologies, boolean considerImportedClosure, boolean * useReasoner) throws OWLOntologyCreationException, * OWLOntologyStorageException, URISyntaxException { String result = content; - * + * * if (useOWLAPI) { - * + * * List removed = new ArrayList(); if (!considerImportedClosure * && !considerImportedOntologies) { result = removeImportedAxioms(result, * removed); } - * - * + * + * * OWLOntologyManager manager = OWLManager.createOWLOntologyManager(); - * + * * OWLOntology ontology = manager.loadOntologyFromOntologyDocument( new * StringDocumentSource(result)); - * + * * if (considerImportedClosure || considerImportedOntologies) { Set * setOfImportedOntologies = new HashSet(); if * (considerImportedOntologies) { @@ -211,18 +213,18 @@ private void resolvePaths(HttpServletRequest request) { * setOfImportedOntologies.addAll(ontology.getImportsClosure()); } for * (OWLOntology importedOntology : setOfImportedOntologies) { * manager.addAxioms(ontology, importedOntology.getAxioms()); } } - * + * * if (useReasoner) { ontology = parseWithReasoner(manager, ontology); } - * + * * StringDocumentTarget parsedOntology = new StringDocumentTarget(); - * + * * manager.saveOntology(ontology, new RDFXMLOntologyFormat(), parsedOntology); * result = parsedOntology.toString(); - * + * * if (!removed.isEmpty() && !considerImportedClosure && * !considerImportedOntologies) { result = addImportedAxioms(result, removed); } * } - * + * * return result; } */ @@ -311,29 +313,29 @@ private String addImportedAxioms(String result, List removed) { * DocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); try { * DocumentBuilder builder = factory.newDocumentBuilder(); Document document = * builder.parse(new ByteArrayInputStream(result.getBytes())); - * + * * NodeList ontologies = * document.getElementsByTagNameNS("http://www.w3.org/2002/07/owl#", * "Ontology"); for (int i = 0; i < ontologies.getLength() ; i++) { Element * ontology = (Element) ontologies.item(i); - * + * * NodeList children = ontology.getChildNodes(); List removed = new * ArrayList(); for (int j = 0; j < children.getLength(); j++) { Node * child = children.item(j); - * + * * if ( child.getNodeType() == Node.ELEMENT_NODE && * child.getNamespaceURI().equals("http://www.w3.org/2002/07/owl#") && * child.getLocalName().equals("imports")) { removed.add((Element) child); } } - * + * * for (Element toBeRemoved : removed) { * removedImport.add(toBeRemoved.getAttributeNS( * "http://www.w3.org/1999/02/22-rdf-syntax-ns#", "resource")); * ontology.removeChild(toBeRemoved); } } - * + * * Transformer transformer = TransformerFactory.newInstance().newTransformer(); * StreamResult output = new StreamResult(new StringWriter()); DOMSource source * = new DOMSource(document); transformer.transform(source, output); - * + * * return output.getWriter().toString(); } catch (ParserConfigurationException * e) { return result; } catch (SAXException e) { return result; } catch * (IOException e) { return result; } catch (TransformerConfigurationException @@ -445,7 +447,7 @@ private void applyAnnotations(OWLEntity aEntity, private String getErrorPage(Exception e) { return "" + "LODE error" + "" + "

" + "LODE error" + "

" - + "

Reason: " + e.getMessage() + "

" + "" + ""; + + "

Reason: " + Encode.forHtml(e.getMessage()) + "

" + "" + ""; } private String applyXSLTTransformation(String source, String ontologyUrl, String lang) throws TransformerException { diff --git a/src/main/resources/jetty/jetty.xml b/src/main/resources/jetty/jetty.xml new file mode 100644 index 0000000..bdcddae --- /dev/null +++ b/src/main/resources/jetty/jetty.xml @@ -0,0 +1,64 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + 10 + 200 + false + + + + + + + + + + + + + + + + + + + + + + + false + + + + + + true + false + true + 1000 + false + false + + diff --git a/src/main/resources/jetty/override-web.xml b/src/main/resources/jetty/override-web.xml new file mode 100644 index 0000000..180fc17 --- /dev/null +++ b/src/main/resources/jetty/override-web.xml @@ -0,0 +1,10 @@ + + + + org.eclipse.jetty.servlet.Default.dirAllowed + false + +