import org.owasp.html.Sanitizers; //导入依赖的package包/类
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    testBatteryService = appContext.getBean(ITestBatteryService.class);
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);

    String pk = policy.sanitize(request.getParameter("id"));
    String name = policy.sanitize(request.getParameter("columnName"));
    String value = policy.sanitize(request.getParameter("value"));

    response.setContentType("text/html");
    try {
        TestBattery testBattery = testBatteryService.findTestBatteryByKey(Integer.parseInt(pk));
        if (name != null && "Description".equals(name.trim())) {
            testBattery.setDescription(value);
        } else if (name != null && "TestBattery".equals(name.trim())) {
            testBattery.setTestbattery(value);
        } else {
            throw new CerberusException(new MessageGeneral(MessageGeneralEnum.NOT_IMPLEMEMTED));
        }
        testBatteryService.updateTestBattery(testBattery);
        response.getWriter().print(value);
    } catch (CerberusException ex) {
        response.getWriter().print(ex.getMessageError().getDescription());
    }
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
public static String renderContentAsText(LocalDispatcher dispatcher, Delegator delegator, String contentId, Map<String, Object> templateContext,
        Locale locale, String mimeTypeId, boolean cache) throws GeneralException, IOException {
    Writer writer = new StringWriter();
    renderContentAsText(dispatcher, delegator, contentId, writer, templateContext, locale, mimeTypeId, null, null, cache);
    String rendered = writer.toString();
    // According to https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#XSS_Prevention_Rules_Summary
    // Normally head should be protected by X-XSS-Protection Response Header by default
    if (EntityUtilProperties.propertyValueEqualsIgnoreCase("content.properties", "content.sanitize", "true", delegator) 
            && (rendered.contains("<script>")
            || rendered.contains("<!--")
            || rendered.contains("<div")
            || rendered.contains("<style>")
            || rendered.contains("<span")
            || rendered.contains("<input")
            || rendered.contains("<input")
            || rendered.contains("<iframe")
            || rendered.contains("<a"))) {
        PolicyFactory sanitizer = Sanitizers.FORMATTING.and(Sanitizers.BLOCKS).and(Sanitizers.IMAGES).and(Sanitizers.LINKS).and(Sanitizers.STYLES);
        rendered = sanitizer.sanitize(rendered);
    }
    return rendered; 
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
public static PolicyFactory sanitizer() {
	if (sanitizer == null) {
		sanitizer = Sanitizers.FORMATTING.and(Sanitizers.BLOCKS).and(Sanitizers.IMAGES).and(Sanitizers.STYLES);
		PolicyFactory html = new HtmlPolicyBuilder()
			.allowElements("table", "tr", "td", "thead", "tbody", "th", "font", "button", "input", "select", "option", "video", "audio")
			.allowAttributes("class").globally()
			.allowAttributes("color").globally()
			.allowAttributes("bgcolor").globally()
			.allowAttributes("align").globally()
			.allowAttributes("target").globally()
			.allowAttributes("value").globally()
			.allowAttributes("name").globally()
			.allowAttributes("controls").globally()
			.allowAttributes("src").globally()
			.allowAttributes("autoplay").globally()
			.allowAttributes("muted").globally()
			.allowAttributes("loop").globally()
			.allowAttributes("poster").globally()
			.allowUrlProtocols("http", "https", "mailto", "chat").allowElements("a")
		    .allowAttributes("href").onElements("a").requireRelNofollowOnLinks()
			.toFactory();
		sanitizer = sanitizer.and(html);
	}
	return sanitizer;
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
@Override
protected void doPost(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws ServletException, IOException {

    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    ITestCaseStepActionExecutionService testCaseExecutionDetailService = appContext.getBean(ITestCaseStepActionExecutionService.class);
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);

    String test = policy.sanitize(httpServletRequest.getParameter("test"));
    String testcase = policy.sanitize(httpServletRequest.getParameter("testcase"));
    String country = policy.sanitize(httpServletRequest.getParameter("country"));


    JSONArray data = testCaseExecutionDetailService.lastActionExecutionDuration(test, testcase, country);

    try {


        httpServletResponse.setContentType("application/json");
        httpServletResponse.getWriter().print(data.toString());
    } catch (Exception e) {
        httpServletResponse.setContentType("text/html");
        httpServletResponse.getWriter().print(e.getMessage());
    }
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
@Override
protected void doGet(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws ServletException, IOException {
    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    IDocumentationService docService = appContext.getBean(IDocumentationService.class);
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);

    String result = "";

    String docTable = policy.sanitize(httpServletRequest.getParameter("docTable"));
    String docField = policy.sanitize(httpServletRequest.getParameter("docField"));
    String docLabel = policy.sanitize(httpServletRequest.getParameter("docLabel"));
    String lang = ParameterParserUtil.parseStringParamAndSanitize(httpServletRequest.getParameter("lang"), "en");

    result = docService.findLabelHTML(docTable, docField, docLabel, lang);

    try {
        httpServletResponse.setContentType("text/html");
        httpServletResponse.getWriter().print(result);
    } catch (Exception exception) {
        LOG.warn(exception.toString());
    }
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
@Override
protected void doGet(HttpServletRequest httpServletRequest, HttpServletResponse response) throws ServletException, IOException {
    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    IDocumentationService docService = appContext.getBean(IDocumentationService.class);
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
    JSONObject jsonResponse = new JSONObject();
    List<Documentation> result = new ArrayList<Documentation>();
    JSONObject format = new JSONObject();

    response.setContentType("application/json");
    response.setCharacterEncoding("utf8");

    String lang = ParameterParserUtil.parseStringParamAndSanitize(httpServletRequest.getParameter("lang"), "en");

    result = docService.findAllWithEmptyDocLabel(lang);
    format = docService.formatGroupByDocTable(result);
    try {
        jsonResponse.put("labelTable", format);
    } catch (JSONException ex) {
        LOG.warn(ex);
    }
    response.getWriter().print(jsonResponse.toString());
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    try {
        ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
        testBatteryService = appContext.getBean(ITestBatteryService.class);
        factoryTestBattery = appContext.getBean(IFactoryTestBattery.class);
        PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);

        String testbattery = policy.sanitize(request.getParameter("TestBattery"));
        String description = policy.sanitize(request.getParameter("Description"));

        response.setContentType("text/html");
        testBatteryService.createTestBattery(factoryTestBattery.create(null, testbattery, description));

        String newTestBatteryId = String.valueOf(testBatteryService.findTestBatteryByTestBatteryName(testbattery).getTestbatteryID());
        response.getWriter().append(newTestBatteryId).close();
    } catch (CerberusException ex) {
        LOG.warn(ex);
        response.getWriter().append("-1").close();
    }

}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
/**
 * Processes requests for both HTTP <code>GET</code> and <code>POST</code>
 * methods.
 *
 * @param request servlet request
 * @param response servlet response
 * @throws ServletException if a servlet-specific error occurs
 * @throws IOException if an I/O error occurs
 */
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
    String system = policy.sanitize(request.getParameter("system"));
    
    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    ITestCaseService testService = appContext.getBean(ITestCaseService.class);

    JSONArray array = new JSONArray();
    JSONObject jsonObject = new JSONObject();
    for (String test : testService.findTestWithTestCaseActiveAutomatedBySystem(system)) {
        array.put(test);
    }
    try {
        jsonObject.put("testsList", array);

        response.setContentType("application/json");
        response.getWriter().print(jsonObject.toString());
    } catch (JSONException exception) {
        LOG.warn(exception.toString());
    }
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
@Override
protected void doGet(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws ServletException, IOException {
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
    String testName = policy.sanitize(httpServletRequest.getParameter("test"));
    String testCaseName = policy.sanitize(httpServletRequest.getParameter("testCase"));

    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    ITestCaseCountryService testCaseCountryService = appContext.getBean(ITestCaseCountryService.class);

    JSONArray array = new JSONArray();
    JSONObject jsonObject = new JSONObject();
    for (String country : testCaseCountryService.findListOfCountryByTestTestCase(testName, testCaseName)) {
        array.put(country);
    }
    try {
        jsonObject.put("countriesList", array);

        httpServletResponse.setContentType("application/json");
        httpServletResponse.getWriter().print(jsonObject.toString());
    } catch (JSONException exception) {
        LOG.warn(exception.toString());
    }
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
@Override
protected void doGet(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws ServletException, IOException {
    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    ITestCaseService testService = appContext.getBean(ITestCaseService.class);
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);

    String test = policy.sanitize(httpServletRequest.getParameter("test"));
    JSONArray array = new JSONArray();
    JSONObject jsonObject = new JSONObject();
    for (TestCase testcase : testService.findTestCaseByTest(test)) {
        array.put(testcase.getTestCase());
    }
    try {
        jsonObject.put("testcasesList", array);

        httpServletResponse.setContentType("application/json");
        httpServletResponse.getWriter().print(jsonObject.toString());
    } catch (JSONException exception) {
        LOG.warn(exception.toString());
    }
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
/**
 * Processes requests for both HTTP <code>GET</code> and <code>POST</code>
 * methods.
 *
 * @param request servlet request
 * @param response servlet response
 * @throws ServletException if a servlet-specific error occurs
 * @throws IOException if an I/O error occurs
 * @throws org.cerberus.exception.CerberusException
 * @throws org.json.JSONException
 */
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException, CerberusException, JSONException {
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
    String system = policy.sanitize(request.getParameter("system"));
    String country = policy.sanitize(request.getParameter("country"));
    String application = policy.sanitize(request.getParameter("application"));
    
    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    ICountryEnvParamService ceService = appContext.getBean(ICountryEnvParamService.class);

    JSONArray array = new JSONArray();
    for (JSONObject ce : ceService.findActiveEnvironmentBySystemCountryApplication(system, country, application)) {
            array.put(ce);
    }
    response.setContentType("application/json");
    response.getWriter().print(array);
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
public static void main(String[] argv) {
  SafeHtmlMint mint = SafeHtmlMint.fromPolicyFactory(
      Sanitizers.FORMATTING.and(Sanitizers.BLOCKS));
  for (String arg : argv) {
    SafeHtml html = mint.sanitize(arg);
    System.out.println(html.getSafeHtmlString());
  }
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
HtmlSanitizer.Policy createPolicy(ImageAwareHtmlRenderer htmlRenderer) {
  return Sanitizers.FORMATTING
          .and(LINKS)
          .and(IFRAME)
          .and(Sanitizers.IMAGES)
          .apply(htmlRenderer);
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
public String sanitize(String text) {
	// Telegram does not support <br> but does support new lines.
	text = text.replace("<br/>", "\n");
	text = text.replace("<br>", "\n");
	text = text.replace("</br>", "");
	text = text.replace("<p/>", "\n");
	text = text.replace("<p>", "\n");
	text = text.replace("</p>", "");
	text = text.replace("<li>", "\n");
	text = text.replace("</li>", "");
	text = text.replace("<ul>", "");
	text = text.replace("</ul>", "\n");
	text = text.replace("<ol>", "");
	text = text.replace("</ol>", "\n");
	if (sanitizer == null) {
		sanitizer = new HtmlPolicyBuilder().allowElements(
		        "b", "i", "strong", "code", "em", "pre").toFactory().and(Sanitizers.LINKS);
	}
	String result = sanitizer.sanitize(text);
	if (result.contains("&")) {
		// The sanitizer is too aggressive and escaping some chars.
		//result = result.replace("&#34;", "\"");
		result = result.replace("&#96;", "`");
		//result = result.replace("&#39;", "'");
		result = result.replace("&#64;", "@");
		result = result.replace("&#61;", "=");
		result = result.replace("&#43;", "+");
		result = result.replace("&amp;", "&");
	}
	return result;
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
/**
 * Processes requests for both HTTP <code>GET</code> and <code>POST</code>
 * methods.
 *
 * @param request servlet request
 * @param response servlet response
 * @throws ServletException if a servlet-specific error occurs
 * @throws IOException if an I/O error occurs
 */
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException, CerberusException, JSONException {
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
    String idName = policy.sanitize(request.getParameter("idName"));

    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    response.setContentType("application/json");
    response.setCharacterEncoding("utf8");

    // Calling Servlet Transversal Util.
    ServletUtil.servletStart(request);

    IInvariantService invariantService = appContext.getBean(InvariantService.class);

    JSONArray array = new JSONArray();
    AnswerList answer = invariantService.readByIdname(idName); //TODO: handle if the response does not turn ok
    for (Invariant myInvariant : (List<Invariant>) answer.getDataList()) {
        JSONObject jsonObject = new JSONObject();
        jsonObject.put("value", myInvariant.getValue());
        jsonObject.put("description", myInvariant.getDescription());
        array.put(jsonObject);
    }

    response.getWriter().print(array.toString());

}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
private List<TestDataLibData> getSubDataFromParameter(HttpServletRequest request, ApplicationContext appContext, int testDataLibId, JSONArray json) throws JSONException {
    List<TestDataLibData> tdldList = new ArrayList();
    IFactoryTestDataLibData tdldFactory = appContext.getBean(IFactoryTestDataLibData.class);
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
    String charset = request.getCharacterEncoding();

    for (int i = 0; i < json.length(); i++) {
        JSONObject objectJson = json.getJSONObject(i);

        // Parameter that are already controled by GUI (no need to decode) --> We SECURE them
        boolean delete = objectJson.getBoolean("toDelete");
        Integer testDataLibDataId = objectJson.getInt("testDataLibDataID");
        // Parameter that needs to be secured --> We SECURE+DECODE them
        // NONE
        // Parameter that we cannot secure as we need the html --> We DECODE them
        String subdata = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("subData"), "", charset);
        String value = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("value"), "", charset);
        String column = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("column"), "", charset);
        String parsingAnswer = ParameterParserUtil.parseStringParam(objectJson.getString("parsingAnswer"), "");
        String columnPosition = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("columnPosition"), "", charset);
        String description = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("description"), "", charset);

        if (!delete) {
            TestDataLibData tdld = tdldFactory.create(testDataLibDataId, testDataLibId, subdata, value, column, parsingAnswer, columnPosition, description);
            tdldList.add(tdld);
        }
    }
    return tdldList;
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
private List<TestDataLibData> getSubDataFromParameter(HttpServletRequest request, ApplicationContext appContext, int testDataLibId, JSONArray json) throws JSONException {
    List<TestDataLibData> tdldList = new ArrayList();
    IFactoryTestDataLibData tdldFactory = appContext.getBean(IFactoryTestDataLibData.class);
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
    String charset = request.getCharacterEncoding();

    for (int i = 0; i < json.length(); i++) {
        JSONObject objectJson = json.getJSONObject(i);

        // Parameter that are already controled by GUI (no need to decode) --> We SECURE them
        boolean delete = objectJson.getBoolean("toDelete");
        Integer testDataLibDataId = objectJson.getInt("testDataLibDataID");
        // Parameter that needs to be secured --> We SECURE+DECODE them
        // NONE
        // Parameter that we cannot secure as we need the html --> We DECODE them
        String subdata = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("subData"), "", charset);
        String value = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("value"), "", charset);
        String column = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("column"), "", charset);
        String parsingAnswer = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("parsingAnswer"), "", charset);
        String columnPosition = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("columnPosition"), "", charset);
        String description = ParameterParserUtil.parseStringParamAndDecode(objectJson.getString("description"), "", charset);

        if (!delete) {
            TestDataLibData tdld = tdldFactory.create(testDataLibDataId, testDataLibId, subdata, value, column, parsingAnswer, columnPosition, description);
            tdldList.add(tdld);
        }
    }
    return tdldList;
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    testBatteryService = appContext.getBean(ITestBatteryService.class);
    factoryTestBatteryContent = appContext.getBean(IFactoryTestBatteryContent.class);
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);

    String id = policy.sanitize(request.getParameter("id"));

    response.setContentType("text/html");
    testBatteryService.deleteTestBatteryContent(factoryTestBatteryContent.create(Integer.parseInt(id), null, null, null));
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    testBatteryService = appContext.getBean(ITestBatteryService.class);
    factoryTestBattery = appContext.getBean(IFactoryTestBattery.class);
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);

    String id = policy.sanitize(request.getParameter("id"));

    response.setContentType("text/html");
    testBatteryService.deleteTestBattery(factoryTestBattery.create(Integer.parseInt(id), null, null));
}
 

import org.owasp.html.Sanitizers; //导入依赖的package包/类
/**
 * Processes requests for both HTTP <code>GET</code> and <code>POST</code>
 * methods.
 *
 * @param request servlet request
 * @param response servlet response
 * @throws ServletException if a servlet-specific error occurs
 * @throws IOException if an I/O error occurs
 */
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {
    response.setContentType("text/html;charset=UTF-8");
    PrintWriter out = response.getWriter();
    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
    ApplicationContext appContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
    ITestCaseExecutionService executionService = appContext.getBean(ITestCaseExecutionService.class);

    try {
        String id = policy.sanitize(request.getParameter("executionId"));
        String tag = policy.sanitize(request.getParameter("newTag"));
        executionService.setTagToExecution(Long.valueOf(id), tag);

        // Create Tag when exist.
        if (!StringUtil.isNullOrEmpty(tag)) {
            // We create or update it.
            ITagService tagService = appContext.getBean(ITagService.class);
            tagService.createAuto(tag, "", request.getRemoteUser());
        }

        /* TODO output your page here. You may use following sample code. */
        out.println("<!DOCTYPE html>");
        out.println("<html>");
        out.println("<head>");
        out.println("<title>Servlet SetTagToExecution</title>");
        out.println("</head>");
        out.println("<body>");
        out.println("<h1>Servlet SetTagToExecution at " + request.getContextPath() + "</h1>");
        out.println("</body>");
        out.println("</html>");
    } catch (CerberusException ex) {
        LOG.warn(ex);
    } finally {
        out.close();
    }
}