CVE-2017-14735

app("OWASP ANTISAMY"):
    requires(version: ARMR/2.6)

    /***************************************************************************
        CVE-2017-14735 (OWASP ANTISAMY)

        CVSS 3.0 metrics:
            Base Score          | 6.1 MEDIUM
            Attack Vector       | Network
            Attack Complexity   | Low
            Privileges Required | None
            User Interaction    | Required
            Scope               | Changed
            Confidentiality     | Low
            Integrity           | Low
            Availability        | None

        Description:
            OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities,
            as demonstrated by use of : to construct a javascript: URL.

        Resources:
            https://github.com/nahsra/antisamy/issues/10
            https://github.com/nahsra/antisamy/commit/e76f02a77afb4e43b897f13d17b5bc1260b8afde

        Affected Operating Systems:
            Any

        Affected Versions:
            OWASP antisamy 1.5.6

        Tested Versions:
            1.5.1, 1.5.2, 1.5.3, 1.5.5, 1.5.6

        Protection Provided:
            Functional

        Patch Version:
            1.1
    ***************************************************************************/

    patch("CVE-2017-14735 :01"):
        function("org/owasp/validator/html/Policy.getAllowedRegexps(Ljava/util/Map;Lorg/w3c/dom/Element;)Ljava/util/List;",
            checksums: ["a4f31c5e05",   // 1.5.1 - 1.5.3
                        "222cbe7378",   // 1.5.5
                        "45642b3467"])  // 1.5.6
        entry()

        code(language: java,   import: ["java.util.*",
                                        "java.util.regex.Pattern",
                                        "org.owasp.validator.html.model.AntiSamyPattern"]):
            private static final String ON_SITE_URL = "^(?![\\p{L}\\p{N}\\\\\\.\\#@\\$%\\+&;\\-_~,\\?=/!]*(&colon))[\\p{L}\\p{N}\\\\\\.\\#@\\$%\\+&;\\-_~,\\?=/!]*";
            private static final String ANCHORED_URL = "#(\\w)+";

            public void patch(JavaFrame frame) {
                Map<String, AntiSamyPattern> commonRegularExpressions = (Map<String, AntiSamyPattern>)
                        frame.loadObjectVariable(0);
                Map<String, AntiSamyPattern> commonRegularExpressionsNew = new HashMap<String, AntiSamyPattern>();
                for (Map.Entry<String, AntiSamyPattern> entry : commonRegularExpressions.entrySet()) {
                    String key = entry.getKey();
                    AntiSamyPattern val = entry.getValue();
                    commonRegularExpressionsNew.put(key, val);
                }
                if (commonRegularExpressionsNew.containsKey("onsiteURL")) {
                    commonRegularExpressionsNew.remove("onsiteURL");
                }
                if (commonRegularExpressionsNew.containsKey("anchoredURL")) {
                    commonRegularExpressionsNew.remove("anchoredURL");
                }
                commonRegularExpressionsNew.put(
                        "onsiteURL", new AntiSamyPattern(Pattern.compile(ON_SITE_URL)));
                commonRegularExpressionsNew.put(
                        "anchoredURL", new AntiSamyPattern(Pattern.compile(ANCHORED_URL)));

                frame.storeObjectVariable(0, commonRegularExpressionsNew);
            }
        endcode
    endpatch

    patch("CVE-2017-14735 :02"):
        function("org/owasp/validator/html/Policy.getAllowedRegexps2(Ljava/util/Map;Lorg/w3c/dom/Element;Ljava/lang/String;)Ljava/util/List;",
            checksums: ["a4f31c5e05",   // 1.5.1 - 1.5.3
                        "222cbe7378",   // 1.5.5
                        "45642b3467"])  // 1.5.6
        callsite("java/util/regex/Pattern.compile(Ljava/lang/String;)Ljava/util/regex/Pattern;")

        code(language: java):
            public void patch(JavaFrame frame) {
                String value = frame.loadStringVariable(6);
                frame.storeStringOperand(0, value);
            }
        endcode
    endpatch

    patch("CVE-2017-14735 :03"):
        function("org/owasp/validator/html/Policy.getAllowedRegexps2(Ljava/util/Map;Lorg/w3c/dom/Element;Ljava/lang/String;)Ljava/util/List;",
            checksums: ["a4f31c5e05",   // 1.5.1 - 1.5.3
                        "222cbe7378",   // 1.5.5
                        "45642b3467"])  // 1.5.6
        entry()

        code(language: java,   import: ["java.util.*",
                                        "java.util.regex.Pattern",
                                        "org.owasp.validator.html.model.AntiSamyPattern"]):
            private static final String ON_SITE_URL = "^(?![\\p{L}\\p{N}\\\\\\.\\#@\\$%\\+&;\\-_~,\\?=/!]*(&colon))[\\p{L}\\p{N}\\\\\\.\\#@\\$%\\+&;\\-_~,\\?=/!]*";
            private static final String ANCHORED_URL = "#(\\w)+";

            public void patch(JavaFrame frame) {
                Map<String, AntiSamyPattern> commonRegularExpressions = (Map<String, AntiSamyPattern>)
                        frame.loadObjectVariable(0);
                Map<String, AntiSamyPattern> commonRegularExpressionsNew = new HashMap<String, AntiSamyPattern>();
                for (Map.Entry<String, AntiSamyPattern> entry : commonRegularExpressions.entrySet()) {
                    String key = entry.getKey();
                    AntiSamyPattern val = entry.getValue();
                    commonRegularExpressionsNew.put(key, val);
                }
                if (commonRegularExpressionsNew.containsKey("onsiteURL")) {
                    commonRegularExpressionsNew.remove("onsiteURL");
                }
                if (commonRegularExpressionsNew.containsKey("anchoredURL")) {
                    commonRegularExpressionsNew.remove("anchoredURL");
                }
                commonRegularExpressionsNew.put(
                        "onsiteURL", new AntiSamyPattern(Pattern.compile(ON_SITE_URL)));
                commonRegularExpressionsNew.put(
                        "anchoredURL", new AntiSamyPattern(Pattern.compile(ANCHORED_URL)));

                frame.storeObjectVariable(0, commonRegularExpressionsNew);
            }
        endcode
    endpatch

    patch("CVE-2017-14735 :04"):
        function("org/owasp/validator/html/Policy.getAllowedRegexps2(Ljava/util/Map;Lorg/w3c/dom/Element;Ljava/lang/String;)Ljava/util/List;",
            checksums: ["a4f31c5e05",   // 1.5.1 - 1.5.3
                        "222cbe7378",   // 1.5.5
                        "45642b3467"])  // 1.5.6
        callsite("java/util/regex/Pattern.compile(Ljava/lang/String;)Ljava/util/regex/Pattern;")

        code(language: java):
            public void patch(JavaFrame frame) {
                String value = frame.loadStringVariable(7);
                frame.storeStringOperand(0, value);
            }
        endcode
    endpatch

    patch("CVE-2017-14735 :05"):
        function("org/owasp/validator/html/Policy.getAllowedRegexp3(Ljava/util/Map;Lorg/w3c/dom/Element;Ljava/lang/String;)Ljava/util/List;",
            checksums: ["a4f31c5e05",   // 1.5.1 - 1.5.3
                        "222cbe7378",   // 1.5.5
                        "45642b3467"])  // 1.5.6
        entry()

        code(language: java,   import: ["java.util.*",
                                        "java.util.regex.Pattern",
                                        "org.owasp.validator.html.model.AntiSamyPattern"]):
            private static final String ON_SITE_URL = "^(?![\\p{L}\\p{N}\\\\\\.\\#@\\$%\\+&;\\-_~,\\?=/!]*(&colon))[\\p{L}\\p{N}\\\\\\.\\#@\\$%\\+&;\\-_~,\\?=/!]*";
            private static final String ANCHORED_URL = "#(\\w)+";

            public void patch(JavaFrame frame) {
                Map<String, AntiSamyPattern> commonRegularExpressions = (Map<String, AntiSamyPattern>)
                        frame.loadObjectVariable(0);
                Map<String, AntiSamyPattern> commonRegularExpressionsNew = new HashMap<String, AntiSamyPattern>();
                for (Map.Entry<String, AntiSamyPattern> entry : commonRegularExpressions.entrySet()) {
                    String key = entry.getKey();
                    AntiSamyPattern val = entry.getValue();
                    commonRegularExpressionsNew.put(key, val);
                }
                if (commonRegularExpressionsNew.containsKey("onsiteURL")) {
                    commonRegularExpressionsNew.remove("onsiteURL");
                }
                if (commonRegularExpressionsNew.containsKey("anchoredURL")) {
                    commonRegularExpressionsNew.remove("anchoredURL");
                }
                commonRegularExpressionsNew.put(
                        "onsiteURL", new AntiSamyPattern(Pattern.compile(ON_SITE_URL)));
                commonRegularExpressionsNew.put(
                        "anchoredURL", new AntiSamyPattern(Pattern.compile(ANCHORED_URL)));

                frame.storeObjectVariable(0, commonRegularExpressionsNew);
            }
        endcode
    endpatch

    patch("CVE-2017-14735 :06"):
        function("org/owasp/validator/html/Policy.getAllowedRegexp3(Ljava/util/Map;Lorg/w3c/dom/Element;Ljava/lang/String;)Ljava/util/List;",
            checksums: ["a4f31c5e05",   // 1.5.1 - 1.5.3
                        "222cbe7378",   // 1.5.5
                        "45642b3467"])  // 1.5.6
        callsite("java/util/regex/Pattern.compile(Ljava/lang/String;)Ljava/util/regex/Pattern;")

        code(language: java):

            public void patch(JavaFrame frame) {
                String value = frame.loadStringVariable(7);
                frame.storeStringOperand(0, value);
            }
        endcode
    endpatch

endapp