FISH-10521 Escape HTTP Characters in REST Interface

[Pandrex247]

Description

Escapes HTTP characters in the REST interface, to help lock down any XSS attempts someone may try if they have access to the application server's filesystem.

Most config which would be displayed here is protected by validation of the domain.xml, as that prevents you from having the "<" or ">" characters as values. The key files however don't have this validation, and so we must escape them.

Important Info

Blockers

None

Testing

New tests

None

Testing Performed

On a clean domain:

• Add the following to the admin-keyfile file under domain config:
• Add the following to the keyfile file under domain config:
• Ping the REST interface http://localhost:4848/management/domain/configs/config/server-config/security-service/auth-realm/file/list-users - no message box should appear
• Ping the REST interface http://localhost:4848/management/domain/configs/config/server-config/security-service/auth-realm/admin-realm/list-users
• Create a standalone instance called Elated-Whalefish
• From the admin console, edit the value of its ASADMIN_LISTENER_PORT property to 24848<img src=x onerror=alert(1)> - Instances > Elated-Whalefish > Properties
  • This was previously fixed in FISH-9553 Sanitise properties in admin console #6943
• Load this page in the REST interface, no message box should appear - http://localhost:4848/management/domain/servers/server/Elated-Whalefish/system-property/ASADMIN_LISTENER_PORT

Testing Environment

Windows 11, Maven 3.9.9, Zulu JDK 11.0.26

Documentation

payara/Payara-Documentation#552

Notes for Reviewers

None