Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-14521

Vertical Tab not properly sanitized in markup, breaks all RSS

    XMLWordPrintable

Details

    Description

      This wiki markup

      * JIRA
      ** *Filters and grouping* - Sort using your filters, group to organise your tasks
      ** *Linkable stack traces* - Open source files directly from stack trace in issue details
      ** *Get started* - Assign issues and start progress instantly
      ** *Generate changelist* - Add current file to changelist directly from issue
      ** *Commits made simple* - Automatically associate committed changes with issue
      

      is rendered as

      	<li>JIRA
      	<ul>
      		<li><b>Filters and grouping</b> - 
                                                        Sort using your filters, group to organise your tasks</li>
      		<li><b>Linkable stack traces</b> - Open source files directly from stack trace in issue details</li>
      		<li><b>Get started</b> - Assign issues and start progress instantly</li>
      		<li><b>Generate changelist</b> - 
                                                       Add current file to changelist directly from issue</li>
      		<li><b>Commits made simple</b> - Automatically associate committed changes with issue</li>
      		<li><span class="error">Unable to render embedded object: File (I like cheese!) not found.</span></li>
      	</ul>
      	</li>
      

      Note the vertical tab after </b> -

      this causes invalid XML to be generated as part of the RSS rendering stage

      2009-02-15 20:05:33,535 ERROR [TP-Processor92] [atlassian.confluence.servlet.ConfluenceServletDispatcher] sendError Could not execute action
       -- url: /spaces/createrssfeed.action | userName: dcheney
      org.jdom.IllegalDataException: The data "<div class="feed">    <p>
              Page
                  <b>edited</b> by
                          <a href="http://extranet.atlassian.com/display/~pdzwart">Peter de Zwart</a>
                  </p>
              <style type="text/css">
              #page-diffs {
                  margin: 2em 1em;
              }
      
              .diff {
                  font-family: "monaco", "lucida console", "courier new", monospace;
                  font-size: 12px;
                  line-height: 14px;
                  list-style-type: none;
                  padding: 0 3em 0 2em;
                  margin-top: 2em;
              }
              .diffadded, .diffdeleted, .diffnochange, .diffchanged, td.diffcontext {
                  padding: 1px 1px 1px 2em;
                  border-left: 0.4em solid;
              }
              .diffadded {
                  background: #dfd;
                  border-left-color: #006400;
              }
              .diffdeleted {
                  color: #999;
                  background: #fdd;
                  border-left-color: #8B0000;
                  text-decoration: line-through;
              }
              .diffchanged {
                  background: #fffff3;
                  border-left-color: #ffd700;
              }
              td.diffcontext {
                  border-left-color: #D3D3D3;
              }
              .diffnochange {
                  border-left-color: #efefef;
              }
              .differror {
                  background: #A52A2A;
              }
              .diffaddedchars, .diff-added-characters {
                  background-color: #9f9;
                  font-weight: bolder;
              }
              .diffremovedchars, .diff-deleted-characters {
                  background-color: #f99;
                  text-decoration: line-through;
                  font-weight: bolder;
              }
              div.diff-snip-link {
                  padding: 1em 1px 1em 1em;
              }
          </style>
          <div style="border-top:1px solid #ddd; padding: 10px 0;">
              <p>
                  Changes between <a href="/display/TEST/Vertical+tab+is+the+new+beige?pageVersion=3">revision 3</a>
                  and <a href="/display/TEST/Vertical+tab+is+the+new+beige">revision 4</a>: <br />
              </p>
                      <div id="page-diffs">
              <table class="diff" cellpadding="0" cellspacing="0">
                  <tr><td class="diffnochange"><div class="diff-snip-link">...</div></td></tr>
                  <tr><td class="diffcontext">** *Generate changelist* - 
                                                                         Add current file to changelist directly from issue&nbsp;<br>&nbsp;** *Commits made simple* - Automatically associate committed changes with issue</td></tr>
                  <tr><td class="diffchanged"><span class="diffcontext">**</span>                                             <span class="diff-changed-word>
                                  <span class="diff-added-characters">!</span><span class="diffcontext">{cheese}</span><span class="diff-added-characters">!</span></span></td></tr>
              </table>
      </div>
          </div>
          <div style="padding-bottom: 10px;">
              <a href="http://extranet.atlassian.com/pages/diffpagesbyversion.action?pageId=1705181410&revisedVersion=4&originalVersion=3">X View Changes Online</a>
              <a href="http://extranet.atlassian.com/pages/viewpreviousversions.action?pageId=1705181410">View All Revisions</a> |
              <a href="http://extranet.atlassian.com/pages/revertpagebacktoversion.action?pageId=1705181410&version=3">Revert To Version 3</a>
          </div>
                  <div style="border-top: 1px solid #ddd; border-bottom: 1px solid #ddd; padding: 10px;">
               <ul>
      	<li>JIRA
      	<ul>
      		<li><b>Filters and grouping</b> - 
                                                        Sort using your filters, group to organise your tasks</li>
      		<li><b>Linkable stack traces</b> - Open source files directly from stack trace in issue details</li>
      		<li><b>Get started</b> - Assign issues and start progress instantly</li>
      		<li><b>Generate changelist</b> - 
                                                       Add current file to changelist directly from issue</li>
      		<li><b>Commits made simple</b> - Automatically associate committed changes with issue</li>
      		<li><span class="error">Unable to render embedded object: File (I like cheese!) not found.</span></li>
      	</ul>
      	</li>
      </ul>
      
          </div>
              <div style="padding: 10px 0;">
             <a href="http://extranet.atlassian.com/display/TEST/Vertical+tab+is+the+new+beige">View Online</a>
                    |
             <a href="http://extranet.atlassian.com/display/TEST/Vertical+tab+is+the+new+beige?showComments=true&amp;showCommentArea=true#addcomment">Add Comment</a>
                 </div>
      </div>" is not legal for a JDOM character content: 0xb is not a legal XML character.
      	at org.jdom.Text.setText(Text.java:188)
      	at org.jdom.Text.<init>(Text.java:99)
      	at org.jdom.Element.addContent(Element.java:799)
      	at com.sun.syndication.io.impl.RSS090Generator.generateSimpleElement(RSS090Generator.java:221)
      	at com.sun.syndication.io.impl.RSS091UserlandGenerator.populateItem(RSS091UserlandGenerator.java:175)
      	at com.sun.syndication.io.impl.RSS092Generator.populateItem(RSS092Generator.java:85)
      	at com.sun.syndication.io.impl.RSS093Generator.populateItem(RSS093Generator.java:44)
      	at com.sun.syndication.io.impl.RSS094Generator.populateItem(RSS094Generator.java:43)
      	at com.sun.syndication.io.impl.RSS20Generator.populateItem(RSS20Generator.java:67)
      	at com.sun.syndication.io.impl.RSS090Generator.addItem(RSS090Generator.java:202)
      	at com.sun.syndication.io.impl.RSS090Generator.addItems(RSS090Generator.java:195)
      	at com.sun.syndication.io.impl.RSS091UserlandGenerator.addChannel(RSS091UserlandGenerator.java:81)
      	at com.sun.syndication.io.impl.RSS091UserlandGenerator.populateFeed(RSS091UserlandGenerator.java:72)
      	at com.sun.syndication.io.impl.RSS090Generator.generate(RSS090Generator.java:56)
      	at com.sun.syndication.io.WireFeedOutput.outputJDom(WireFeedOutput.java:193)
      	at com.sun.syndication.io.WireFeedOutput.output(WireFeedOutput.java:133)
      	at com.atlassian.xwork.results.RssResult.doExecute(RssResult.java:42)
      	at com.opensymphony.webwork.dispatcher.WebWorkResultSupport.execute(WebWorkResultSupport.java:116)
      	at com.opensymphony.xwork.DefaultActionInvocation.executeResult(DefaultActionInvocation.java:263)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:187)
      	at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:35)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.atlassian.confluence.util.LoggingContextInterceptor.intercept(LoggingContextInterceptor.java:48)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.atlassian.confluence.core.CancellingInterceptor.intercept(CancellingInterceptor.java:23)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.atlassian.confluence.security.actions.PermissionCheckInterceptor.intercept(PermissionCheckInterceptor.java:55)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.atlassian.confluence.setup.webwork.BootstrapAwareInterceptor.intercept(BootstrapAwareInterceptor.java:26)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:35)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.atlassian.confluence.pages.actions.CommentAwareInterceptor.intercept(CommentAwareInterceptor.java:43)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.atlassian.confluence.pages.actions.PageAwareInterceptor.intercept(PageAwareInterceptor.java:109)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.atlassian.confluence.spaces.actions.SpaceAwareInterceptor.intercept(SpaceAwareInterceptor.java:67)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:35)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.atlassian.confluence.core.actions.LastModifiedInterceptor.intercept(LastModifiedInterceptor.java:39)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.atlassian.confluence.core.ConfluenceAutowireInterceptor.intercept(ConfluenceAutowireInterceptor.java:38)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:35)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:35)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.atlassian.xwork.interceptors.TransactionalInvocation.invokeAndHandleExceptions(TransactionalInvocation.java:72)
      	at com.atlassian.xwork.interceptors.TransactionalInvocation.invokeInTransaction(TransactionalInvocation.java:59)
      	at com.atlassian.xwork.interceptors.XWorkTransactionInterceptor.intercept(XWorkTransactionInterceptor.java:56)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:35)
      	at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:165)
      	at com.opensymphony.xwork.DefaultActionProxy.execute(DefaultActionProxy.java:115)
      	at com.atlassian.confluence.servlet.ConfluenceServletDispatcher.serviceAction(ConfluenceServletDispatcher.java:53)
      	at com.opensymphony.webwork.dispatcher.ServletDispatcher.service(ServletDispatcher.java:199)
      	at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:269)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.plugin.servlet.filter.IteratingFilterChain.doFilter(IteratingFilterChain.java:46)
      	at com.atlassian.plugin.servlet.filter.ServletFilterModuleContainerFilter.doFilter(ServletFilterModuleContainerFilter.java:55)
      	at com.atlassian.plugin.servlet.filter.ServletFilterModuleContainerFilter.doFilter(ServletFilterModuleContainerFilter.java:41)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.opensymphony.module.sitemesh.filter.PageFilter.parsePage(PageFilter.java:118)
      	at com.atlassian.confluence.util.profiling.ProfilingPageFilter.parsePage(ProfilingPageFilter.java:151)
      	at com.opensymphony.module.sitemesh.filter.PageFilter.doFilter(PageFilter.java:54)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.plugin.servlet.filter.IteratingFilterChain.doFilter(IteratingFilterChain.java:46)
      	at com.atlassian.plugin.servlet.filter.ServletFilterModuleContainerFilter.doFilter(ServletFilterModuleContainerFilter.java:55)
      	at com.atlassian.plugin.servlet.filter.ServletFilterModuleContainerFilter.doFilter(ServletFilterModuleContainerFilter.java:41)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.confluence.jmx.JmxFilter.doFilter(JmxFilter.java:105)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.core.filters.ServletContextThreadLocalFilter.doFilter(ServletContextThreadLocalFilter.java:19)
      	at com.atlassian.core.filters.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:31)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.confluence.util.LoggingContextFilter.doFilter(LoggingContextFilter.java:46)
      	at com.atlassian.core.filters.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:31)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.confluence.web.filter.ThreadLocalCacheFilter.doFilter(ThreadLocalCacheFilter.java:23)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.confluence.util.UserThreadLocalFilter.doFilter(UserThreadLocalFilter.java:44)
      	at com.atlassian.core.filters.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:31)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.seraph.filter.SecurityFilter.doFilter(SecurityFilter.java:204)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.seraph.filter.TrustedApplicationsFilter.doFilter(TrustedApplicationsFilter.java:120)
      	at com.atlassian.confluence.util.AbstractBootstrapHotSwappingFilter.doFilter(AbstractBootstrapHotSwappingFilter.java:30)
      	at com.atlassian.core.filters.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:31)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.seraph.filter.BaseLoginFilter.doFilter(BaseLoginFilter.java:138)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.plugin.servlet.filter.IteratingFilterChain.doFilter(IteratingFilterChain.java:46)
      	at com.atlassian.plugin.servlet.filter.ServletFilterModuleContainerFilter.doFilter(ServletFilterModuleContainerFilter.java:55)
      	at com.atlassian.plugin.servlet.filter.ServletFilterModuleContainerFilter.doFilter(ServletFilterModuleContainerFilter.java:41)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.confluence.util.ClusterHeaderFilter.doFilter(ClusterHeaderFilter.java:35)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.johnson.filters.AbstractJohnsonFilter.doFilter(AbstractJohnsonFilter.java:72)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at org.springframework.orm.hibernate.support.OpenSessionInViewFilter.doFilterInternal(OpenSessionInViewFilter.java:170)
      	at com.atlassian.spring.filter.FlushingSpringSessionInViewFilter.doFilterInternal(FlushingSpringSessionInViewFilter.java:29)
      	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:75)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.util.profiling.filters.ProfilingFilter.doFilter(ProfilingFilter.java:99)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.confluence.core.datetime.RequestTimeThreadLocalFilter.doFilter(RequestTimeThreadLocalFilter.java:34)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.confluence.util.RequestCacheThreadLocalFilter.doFilter(RequestCacheThreadLocalFilter.java:25)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.gzipfilter.GzipFilter.doFilterInternal(GzipFilter.java:75)
      	at com.atlassian.gzipfilter.GzipFilter.doFilter(GzipFilter.java:51)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.core.filters.cache.AbstractCachingFilter.doFilter(AbstractCachingFilter.java:33)
      	at com.atlassian.core.filters.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:31)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.plugin.servlet.filter.IteratingFilterChain.doFilter(IteratingFilterChain.java:46)
      	at com.atlassian.plugin.servlet.filter.ServletFilterModuleContainerFilter.doFilter(ServletFilterModuleContainerFilter.java:55)
      	at com.atlassian.plugin.servlet.filter.ServletFilterModuleContainerFilter.doFilter(ServletFilterModuleContainerFilter.java:41)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at com.atlassian.core.filters.encoding.AbstractEncodingFilter.doFilter(AbstractEncodingFilter.java:41)
      	at com.atlassian.core.filters.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:31)
      	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
      	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
      	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
      	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:174)
      	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
      	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
      	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108)
      	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:174)
      	at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:200)
      	at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283)
      	at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:773)
      	at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:703)
      	at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:895)
      	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:689)
      	at java.lang.Thread.run(Thread.java:595)
      
      

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              dcheney David Cheney (Inactive)
              Votes:
              4 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated: