Uploaded image for project: 'Hippo CMS'
  1. Hippo CMS
  2. CMS-8620

HtmlCleanerPlugin can result in NPE in #filter

    XMLWordPrintable

Details

    • Bug
    • Status: Closed
    • Normal
    • Resolution: Fixed
    • None
    • 2.28.00
    • None
    • None

    Description

      The problematic part is

      private TagNode filter(final TagNode node) {
      if (node.getName() != null && !whitelist.containsKey(node.getName()))

      { return null; }

      final Element element = whitelist.get(node.getName());

      when node.getName() is null, the element is null. I've had use cases where the root tagnode however did have xml namespace declaration (for example by adding <pre> html encoded xml </pre>) in document. That results now in an NPE and stacktrace (the last log statement indicates what will be cleaned):

      [INFO] [talledLocalContainer] 31.12.2014 12:06:18 WARN http-nio-8080-exec-5 [RichTextModel.setObject:48] Value not set because html cleaning failed
      [INFO] [talledLocalContainer] java.lang.NullPointerException
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.richtext.htmlcleaner.HtmlCleanerPlugin$Element.access$300(HtmlCleanerPlugin.java:154)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.richtext.htmlcleaner.HtmlCleanerPlugin.filter(HtmlCleanerPlugin.java:108)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.richtext.htmlcleaner.HtmlCleanerPlugin.clean(HtmlCleanerPlugin.java:90)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.richtext.RichTextModel.clean(RichTextModel.java:69)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.richtext.RichTextModel.setObject(RichTextModel.java:44)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.richtext.RichTextModel.setObject(RichTextModel.java:22)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.richtext.jcr.ChildFacetUuidsModel.setObject(ChildFacetUuidsModel.java:191)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.richtext.jcr.ChildFacetUuidsModel.setObject(ChildFacetUuidsModel.java:59)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.richtext.LineEndingsModel.setObject(LineEndingsModel.java:46)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.richtext.LineEndingsModel.setObject(LineEndingsModel.java:25)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.ckeditor.AutoSaveBehavior.respond(AutoSaveBehavior.java:62)
      [INFO] [talledLocalContainer] at org.apache.wicket.ajax.AbstractDefaultAjaxBehavior.onRequest(AbstractDefaultAjaxBehavior.java:626)
      [INFO] [talledLocalContainer] at sun.reflect.GeneratedMethodAccessor101.invoke(Unknown Source)
      [INFO] [talledLocalContainer] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      [INFO] [talledLocalContainer] at java.lang.reflect.Method.invoke(Method.java:483)
      [INFO] [talledLocalContainer] at org.apache.wicket.RequestListenerInterface.internalInvoke(RequestListenerInterface.java:258)
      [INFO] [talledLocalContainer] at org.apache.wicket.RequestListenerInterface.invoke(RequestListenerInterface.java:241)
      [INFO] [talledLocalContainer] at org.apache.wicket.core.request.handler.ListenerInterfaceRequestHandler.invokeListener(ListenerInterfaceRequestHandler.java:250)
      [INFO] [talledLocalContainer] at org.apache.wicket.core.request.handler.ListenerInterfaceRequestHandler.respond(ListenerInterfaceRequestHandler.java:236)
      [INFO] [talledLocalContainer] at org.apache.wicket.request.cycle.RequestCycle$HandlerExecutor.respond(RequestCycle.java:862)
      [INFO] [talledLocalContainer] at org.apache.wicket.request.RequestHandlerStack.execute(RequestHandlerStack.java:64)
      [INFO] [talledLocalContainer] at org.apache.wicket.request.cycle.RequestCycle.execute(RequestCycle.java:261)
      [INFO] [talledLocalContainer] at org.apache.wicket.request.cycle.RequestCycle.processRequest(RequestCycle.java:218)
      [INFO] [talledLocalContainer] at org.apache.wicket.request.cycle.RequestCycle.processRequestAndDetach(RequestCycle.java:289)
      [INFO] [talledLocalContainer] at org.apache.wicket.protocol.http.WicketFilter.processRequestCycle(WicketFilter.java:259)
      [INFO] [talledLocalContainer] at org.apache.wicket.protocol.http.WicketFilter.processRequest(WicketFilter.java:201)
      [INFO] [talledLocalContainer] at org.apache.wicket.protocol.http.WicketFilter.doFilter(WicketFilter.java:282)
      [INFO] [talledLocalContainer] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
      [INFO] [talledLocalContainer] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      [INFO] [talledLocalContainer] at org.hippoecm.frontend.plugins.login.ConcurrentLoginFilter.doFilter(ConcurrentLoginFilter.java:54)
      [INFO] [talledLocalContainer] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
      [INFO] [talledLocalContainer] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      [INFO] [talledLocalContainer] at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
      [INFO] [talledLocalContainer] at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
      [INFO] [talledLocalContainer] at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)
      [INFO] [talledLocalContainer] at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142)
      [INFO] [talledLocalContainer] at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
      [INFO] [talledLocalContainer] at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:610)
      [INFO] [talledLocalContainer] at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
      [INFO] [talledLocalContainer] at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:537)
      [INFO] [talledLocalContainer] at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1085)
      [INFO] [talledLocalContainer] at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:658)
      [INFO] [talledLocalContainer] at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:222)
      [INFO] [talledLocalContainer] at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1556)
      [INFO] [talledLocalContainer] at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1513)
      [INFO] [talledLocalContainer] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      [INFO] [talledLocalContainer] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      [INFO] [talledLocalContainer] at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
      [INFO] [talledLocalContainer] at java.lang.Thread.run(Thread.java:745)
      [INFO] [talledLocalContainer] 31.12.2014 12:06:18 DEBUG http-nio-8080-exec-10 [RichTextModel.setObject:41] Cleaning value <p>Now go ahead and build your own website!</p>
      [INFO] [talledLocalContainer]
      [INFO] [talledLocalContainer] <p> </p>
      [INFO] [talledLocalContainer]
      [INFO] [talledLocalContainer] <p>  </p>
      [INFO] [talledLocalContainer]
      [INFO] [talledLocalContainer] <pre>
      [INFO] [talledLocalContainer] <hst:defineObjects/>
      [INFO] [talledLocalContainer] <c:set var="isPreview" value="${hstRequest.requestContext.preview}"/>
      [INFO] [talledLocalContainer] </pre>
      [INFO] [talledLocalContainer]
      [INFO] [talledLocalContainer] <p> </p>
      [INFO] [talledLocalContainer]
      [INFO] [talledLocalContainer] <p> </p>

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              aschrijvers Ard Schrijvers
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: