Uploaded image for project: 'Sakai'
  1. Sakai
  2. SAK-18792

NPE in Tool Rendering for Tools with Multiple CGI Parameters

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: CLOSED
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 2.7.0
    • Fix Version/s: 2.6.3, 2.7.1
    • Component/s: Portal
    • Labels:
      None
    • CLE Team Issue:
      Yes

      Description

      When using "Portalised Tool State" URLs as described in "URLs Within Sakai" (http://confluence.sakaiproject.org/display/SAKDEV/URLs+within+Sakai) a tool URL with multiple CGI parameters will cause an NPE during render. This is because the IFrameToolRenderService class does not escape the '&' characters which separate CGI parameters when it builds the iframe element that represents the tool. This results in malformed XML. The '&' symbol is used to identify entities in XML, so the CGI parameters look like unterminated entities causing parse errors.

      For example, a URL like:

      https://mySakaiInstance.com/xsl-portal/tool/[tool ID]/foo?parameter1=bar&parameter2=baz

      This will cause the parser to interpret parameter2 as an unterminated entity. This is particularly a problem in xsltcharon (xsl-portal) because the iframe entity is subsequently processed by XmlUtils.readDocumentFromString(...) which catches the parse exception, logs it, and returns null. Calling code will subsequently NPE if it does not check for null.

        Gliffy Diagrams

          Zeplin

            Attachments

              Issue Links

                Activity

                  People

                  Assignee:
                  maintenanceteam Core Team
                  Reporter:
                  duffy Duffy Gillman (Inactive)
                  Votes:
                  0 Vote for this issue
                  Watchers:
                  2 Start watching this issue

                    Dates

                    Created:
                    Updated:
                    Resolved:

                      Git Integration