CVE-2025-43740

@@ -21,7 +21,7 @@
 /**
  * @author Sergio González
  */
-@Component(property = "sanitizer.order:Integer=1", service = Sanitizer.class)
+@Component(property = "sanitizer.order:Integer=20", service = Sanitizer.class)
 public class CommentSanitizerImpl implements Sanitizer {
 
 	public CommentSanitizerImpl() {

@@ -115,7 +115,7 @@ protected void activate(
 			HashMapDictionaryBuilder.<String, Object>put(
 				"component.name", AntiSamySanitizerImpl.class.getCanonicalName()
 			).put(
-				"sanitizer.order", 2
+				"sanitizer.order", 30
 			).build());
 	}
 

@@ -30,7 +30,7 @@
  */
 @Component(
 	configurationPid = "com.liferay.portal.security.iframe.sanitizer.configuration.IFrameConfiguration",
-	property = "sanitizer.order:Integer=0", service = Sanitizer.class
+	property = "sanitizer.order:Integer=10", service = Sanitizer.class
 )
 public class IFrameSanitizerImpl implements Sanitizer {
 

@@ -21,7 +21,7 @@
 /**
  * @author Sergio González
  */
-@Component(service = Sanitizer.class)
+@Component(property = "sanitizer.order:Integer=1", service = Sanitizer.class)
 public class CommentSanitizerImpl implements Sanitizer {
 
 	public CommentSanitizerImpl() {

@@ -7,7 +7,7 @@
 
 import com.liferay.portal.configuration.metatype.bnd.util.ConfigurableUtil;
 import com.liferay.portal.kernel.sanitizer.Sanitizer;
-import com.liferay.portal.kernel.util.MapUtil;
+import com.liferay.portal.kernel.util.HashMapDictionaryBuilder;
 import com.liferay.portal.security.antisamy.configuration.AntiSamyClassNameConfiguration;
 import com.liferay.portal.security.antisamy.configuration.AntiSamyConfiguration;
 import com.liferay.portal.security.antisamy.internal.AntiSamySanitizerImpl;
@@ -112,9 +112,11 @@ protected void activate(
 
 		_sanitizerServiceRegistration = bundleContext.registerService(
 			Sanitizer.class, _antiSamySanitizerImpl,
-			MapUtil.singletonDictionary(
-				"component.name",
-				AntiSamySanitizerImpl.class.getCanonicalName()));
+			HashMapDictionaryBuilder.<String, Object>put(
+				"component.name", AntiSamySanitizerImpl.class.getCanonicalName()
+			).put(
+				"sanitizer.order", 2
+			).build());
 	}
 
 	@Deactivate

@@ -30,7 +30,7 @@
  */
 @Component(
 	configurationPid = "com.liferay.portal.security.iframe.sanitizer.configuration.IFrameConfiguration",
-	service = Sanitizer.class
+	property = "sanitizer.order:Integer=0", service = Sanitizer.class
 )
 public class IFrameSanitizerImpl implements Sanitizer {
 

@@ -7,8 +7,10 @@
 
 import com.liferay.osgi.service.tracker.collections.list.ServiceTrackerList;
 import com.liferay.osgi.service.tracker.collections.list.ServiceTrackerListFactory;
+import com.liferay.osgi.service.tracker.collections.map.PropertyServiceReferenceComparator;
 import com.liferay.portal.kernel.module.util.SystemBundleUtil;
 
+import java.util.Collections;
 import java.util.Map;
 
 /**
@@ -55,6 +57,8 @@ public static String sanitize(
 
 	private static final ServiceTrackerList<Sanitizer> _sanitizers =
 		ServiceTrackerListFactory.open(
-			SystemBundleUtil.getBundleContext(), Sanitizer.class);
+			SystemBundleUtil.getBundleContext(), Sanitizer.class,
+			Collections.reverseOrder(
+				new PropertyServiceReferenceComparator<>("sanitizer.order")));
 
 }
\ No newline at end of file

@@ -0,0 +1,3 @@
+Bundle-Name: Liferay Sanitizer Test
+Bundle-SymbolicName: com.liferay.sanitizer.test
+Bundle-Version: 1.0.0
\ No newline at end of file

@@ -0,0 +1,7 @@
+dependencies {
+	testIntegrationImplementation group: "com.liferay.jakarta.portlet", name: "com.liferay.jakarta.portlet-api", version: "4.0.0"
+	testIntegrationImplementation group: "com.liferay.portal", name: "com.liferay.portal.impl", version: "default"
+	testIntegrationImplementation project(":apps:blogs:blogs-api")
+	testIntegrationImplementation project(":apps:journal:journal-api")
+	testIntegrationImplementation project(":test:arquillian-extension-junit-bridge")
+}
\ No newline at end of file

@@ -0,0 +1,66 @@
+/**
+ * SPDX-FileCopyrightText: (c) 2025 Liferay, Inc. https://liferay.com
+ * SPDX-License-Identifier: LGPL-2.1-or-later OR LicenseRef-Liferay-DXP-EULA-2.0.0-2023-06
+ */
+
+package com.liferay.sanitizer.test;
+
+import com.liferay.arquillian.extension.junit.bridge.junit.Arquillian;
+import com.liferay.blogs.model.BlogsEntry;
+import com.liferay.journal.model.JournalArticle;
+import com.liferay.portal.kernel.model.User;
+import com.liferay.portal.kernel.sanitizer.Sanitizer;
+import com.liferay.portal.kernel.sanitizer.SanitizerUtil;
+import com.liferay.portal.kernel.test.rule.AggregateTestRule;
+import com.liferay.portal.kernel.test.util.RandomTestUtil;
+import com.liferay.portal.kernel.test.util.TestPropsValues;
+import com.liferay.portal.kernel.util.ContentTypes;
+import com.liferay.portal.kernel.util.HashMapBuilder;
+import com.liferay.portal.test.rule.LiferayIntegrationTestRule;
+
+import org.junit.Assert;
+import org.junit.ClassRule;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * @author Manuele Castro
+ */
+@RunWith(Arquillian.class)
+public class SanitizerUtilTest {
+
+	@ClassRule
+	@Rule
+	public static final AggregateTestRule aggregateTestRule =
+		new LiferayIntegrationTestRule();
+
+	@Test
+	public void testSanitize() throws Exception {
+		String string = RandomTestUtil.randomString();
+
+		Assert.assertEquals(
+			""" + string + """,
+			SanitizerUtil.sanitize(
+				TestPropsValues.getCompanyId(), TestPropsValues.getGroupId(),
+				TestPropsValues.getUserId(), JournalArticle.class.getName(), 0,
+				ContentTypes.TEXT_HTML, Sanitizer.MODE_ALL,
+				"\"" + string + "\"",
+				HashMapBuilder.<String, Object>put(
+					"discussion", Boolean.TRUE
+				).build()));
+		Assert.assertEquals(
+			"&quot;" + string + "&quot;",
+			SanitizerUtil.sanitize(
+				TestPropsValues.getCompanyId(), TestPropsValues.getGroupId(),
+				TestPropsValues.getUserId(), User.class.getName(), 0,
+				ContentTypes.TEXT_HTML, "\"" + string + "\""));
+		Assert.assertEquals(
+			"<iframe sandbox=\"\">" + string + "</iframe>",
+			SanitizerUtil.sanitize(
+				TestPropsValues.getCompanyId(), TestPropsValues.getGroupId(),
+				TestPropsValues.getUserId(), BlogsEntry.class.getName(), 0,
+				ContentTypes.TEXT_HTML, "<iframe>" + string + "</iframe>"));
+	}
+
+}
\ No newline at end of file

@@ -0,0 +1,17 @@
+modified.files.includes[relevant][sanitizer-java-rule]=\
+    **/*.java,\
+    **/test/**,\
+    **/testIntegration/**
+
+modules.includes.required.test.batch.class.names.includes[modules-integration-postgresql163][relevant][sanitizer-java-rule]=\
+    apps/sanitizer/**/*Test.java
+
+modules.includes.required.test.batch.class.names.includes[modules-unit][relevant][sanitizer-java-rule]=\
+    apps/sanitizer/**/*Test.java
+
+relevant.rule.names=sanitizer-java-rule
+
+test.batch.names[relevant][sanitizer-java-rule]=\
+    modules-integration-postgresql163
+
+testray.main.component.name=AntiSamy
\ No newline at end of file