LDKController: HTML-encode container-scope messages and redirect URL

The container-scoped-tables inspection view joined validation messages with StringUtils.join and rendered them via HtmlString.of, and the invalid-redirect error wrapped the user-supplied URL with HtmlString.unsafe. Both reflected unescaped user-controlled content into the page (reflected XSS). Each validation message is now passed through PageFlowUtil.filter before joining (the assembled string is then marked HtmlString.unsafe since its pieces are already encoded), and the redirect error now uses HtmlString.of so the URL is escaped.

Author: labkey-martyp

LDK/src/org/labkey/ldk/LDKController.java

@@ -92,6 +92,7 @@
 import java.util.Map;
 import java.util.Set;
 import java.util.function.Predicate;
+import java.util.stream.Collectors;
 
 public class LDKController extends SpringActionController
 {
@@ -439,9 +440,9 @@ public ModelAndView getView(Object form, BindException errors) throws Exception
             List<String> messages = service.validateContainerScopedTables(false);
 
             String sb = "This page is designed to inspect all registered container scoped tables and report any tables with duplicate keys in the same container.  This should be enforced by the user schema; however, direct DB inserts will bypass this check.<p>" +
-                    StringUtils.join(messages, "<br>");
+                    messages.stream().map(PageFlowUtil::filter).collect(Collectors.joining("<br>"));
 
-            return new HtmlView(HtmlString.of(sb));
+            return new HtmlView(HtmlString.unsafe(sb));
         }
 
         @Override
@@ -912,7 +913,7 @@ public ModelAndView getView(Object form, BindException errors) throws Exception
                     }
                     catch (URISyntaxException e)
                     {
-                        return new HtmlView(HtmlString.unsafe("Invalid redirect URL set: " + urlString));
+                        return new HtmlView(HtmlString.of("Invalid redirect URL set: " + urlString));
                     }
                 }
             }