This changes eliminate a way to cripple Message pages on other peers by sending special messages with HTML tags. (See forum for details.)

git-svn-id: https://svn.berlios.de/svnroot/repos/yacy/trunk@325 6c8d7289-2bf4-0310-a012-ef5d649a1542

htroot/Messages_p.java

@@ -56,6 +56,7 @@ import de.anomic.plasma.plasmaSwitchboard;
 import de.anomic.server.serverFileUtils;
 import de.anomic.server.serverObjects;
 import de.anomic.server.serverSwitch;
+import de.anomic.tools.unHtml;
 
 public class Messages_p {
 
@@ -100,7 +101,7 @@ public class Messages_p {
                 messages += "<td>" + dateString(message.date()) + "</td>";
                 messages += "<td>" + message.author() + "</td>";
                 messages += "<td>" + message.recipient() + "</td>";
-                messages += "<td>" + message.subject() + "</td>";
+                messages += "<td>" + (new unHtml(message.subject())).un() + "</td>";
                 messages += "<td>" +
                             "<a href=\"Messages_p.html?action=view&object=" + key + "\">view</a>&nbsp;/&nbsp;" +
                             "<a href=\"MessageSend_p.html?hash=" + message.authorHash() + "&subject=Re: " + message.subject() + "\">reply</a>&nbsp;/&nbsp;" +
@@ -121,8 +122,8 @@ public class Messages_p {
             messages += "<tr><td class=\"MenuHeader\">From:</td><td class=\"MessageBackground\">" + message.author() + "</td></tr>";
             messages += "<tr><td class=\"MenuHeader\">To:</td><td class=\"MessageBackground\">" + message.recipient() + "</td></tr>";
             messages += "<tr><td class=\"MenuHeader\">Send Date:</td><td class=\"MessageBackground\">" + dateString(message.date()) + "</td></tr>";
-            messages += "<tr><td class=\"MenuHeader\">Subject:</td><td class=\"MessageBackground\">" + message.subject() + "</td></tr>";
-            messages += "<tr><td class=\"MessageBackground\" colspan=\"2\">" + new String(message.message()) + "</td></tr>";
+            messages += "<tr><td class=\"MenuHeader\">Subject:</td><td class=\"MessageBackground\">" + (new unHtml(message.subject())).un() + "</td></tr>";
+            messages += "<tr><td class=\"MessageBackground\" colspan=\"2\">" + (new unHtml(new String(message.message()))).un() + "</td></tr>";
 	    messages += "<tr><td class=\"MenuHeader\">Action:</td>" +	    
 	    		"<td class=\"MessageBackground\">" +
 			"<a href=\"Messages_p.html\">inbox</a>&nbsp;/&nbsp;" +

source/de/anomic/tools/unHtml.java

@@ -0,0 +1,76 @@
+// unHTML.java 
+// ---------------------------
+// part of YaCy
+// (C) by Marc Nause; marc.nause@gmx.de.
+// Braunschweig, Germany, 2005
+// last major change: 27.06.2005
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; either version 2 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+//
+// Using this software in any meaning (reading, learning, copying, compiling,
+// running) means that you agree that the Author(s) is (are) not responsible
+// for cost, loss of data or any harm that may be caused directly or indirectly
+// by usage of this softare or this documentation. The usage of this software
+// is on your own risk. The installation and usage (starting/running) of this
+// software may allow other people or application to access your computer and
+// any attached devices and is highly dependent on the configuration of the
+// software which must be done by the user of the software; the author(s) is
+// (are) also not responsible for proper configuration and usage of the
+// software, even if provoked by documentation provided together with
+// the software.
+//
+// Any changes to this file according to the GPL as documented in the file
+// gpl.txt aside this file in the shipment you received can be done to the
+// lines that follows this copyright notice here, but changes must not be
+// done inside the copyright notive above. A re-distribution must contain
+// the intact and unchanged copyright notice.
+// Contributions and changes to the program code must be marked as such.
+
+/**Some code to avoid people being able to mess with the message system
+  *by using HTML.
+  *@author Marc Nause
+  */
+  
+package de.anomic.tools;  
+  
+public class unHtml {
+	
+	String text;
+	/**Creates an object so un() has something to work on*/
+	public unHtml(String s)
+	{
+		this.text = s;
+	}
+
+	/**Replaces all < and > with &lt; and &gt in a string.
+	*@author Marc Nause
+	*@return String
+	*/
+	public String un(){
+		String input = this.text;
+		String output = "";
+		int iter = 0;
+		
+		while(iter < input.length()){
+			String temp = input.substring(iter,iter+1);
+			iter++;
+			if(temp.equals("<")) {temp = "&lt;";}
+			else if (temp.equals(">")) {temp = "&gt;";}
+			output = output + temp;
+		}
+	
+	return output;
+	}
+}