pax_global_header 0000666 0000000 0000000 00000000064 13752037245 0014522 g ustar 00root root 0000000 0000000 52 comment=1218c16431020dc0d9df2f100f5bf039b2b5d215
owasp-java-encoder-1.2.3/ 0000775 0000000 0000000 00000000000 13752037245 0015212 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/.gitignore 0000664 0000000 0000000 00000000344 13752037245 0017203 0 ustar 00root root 0000000 0000000 */target/**
/target/**
# Intellij project files
*.iml
*.ipr
*.iws
.idea/
# Eclipse project files
.classpath
.project
.settings
maven-eclipse.xml
.externalToolBuilders
# Netbeans configuration
nb-configuration.xml
*/nbproject/*
owasp-java-encoder-1.2.3/.travis.yml 0000664 0000000 0000000 00000000355 13752037245 0017326 0 ustar 00root root 0000000 0000000 language: java
dist: trusty
jdk:
- openjdk8
- oraclejdk8
# to compile using JDK 9+ we must move from source and target 1.5 to 1.6
# - openjdk9
# - openjdk10
# - openjdk11
# - oraclejdk9
# - oraclejdk10
script: mvn test -B -X
owasp-java-encoder-1.2.3/LICENSE 0000664 0000000 0000000 00000002771 13752037245 0016226 0 ustar 00root root 0000000 0000000 Copyright (c) 2015 Jeff Ichnowski
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
* Redistributions of source code must retain the above
copyright notice, this list of conditions and the following
disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials
provided with the distribution.
* Neither the name of the OWASP nor the names of its
contributors may be used to endorse or promote products
derived from this software without specific prior written
permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE. owasp-java-encoder-1.2.3/META-INF/ 0000775 0000000 0000000 00000000000 13752037245 0016352 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/META-INF/MANIFEST.MF 0000664 0000000 0000000 00000000412 13752037245 0020001 0 ustar 00root root 0000000 0000000 Manifest-Version: 1.0
Bnd-LastModified: 1533328833261
Bundle-ManifestVersion: 2
Bundle-Name: org.owasp.encoder
Bundle-SymbolicName: org.owasp.encoder
Bundle-Version: 1.2.1
Created-By: 1.8.0_181 (Oracle Corporation)
Export-Package: org.owasp.encoder
Tool: Bnd-1.50.0
owasp-java-encoder-1.2.3/README.md 0000664 0000000 0000000 00000006167 13752037245 0016503 0 ustar 00root root 0000000 0000000 OWASP Java Encoder Project
==========================
[](https://travis-ci.org/OWASP/owasp-java-encoder) [](https://opensource.org/licenses/BSD-3-Clause)
Contextual Output Encoding is a computer programming technique necessary to stop
Cross-Site Scripting. This project is a Java 1.5+ simple-to-use drop-in high-performance
encoder class with little baggage.
Start using the OWASP Java Encoders
-----------------------------------
You can download a JAR from [Maven Central](https://search.maven.org/#search|ga|1|g%3A%22org.owasp.encoder%22%20a%3A%22encoder%22).
JSP tags and EL functions are available in the encoder-jsp, also available in [Central](http://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder-jsp/1.2/encoder-jsp-1.2.jar).
The jars are also available in Maven:
```xml
org.owasp.encoderencoder1.2.2org.owasp.encoderencoder-jsp1.2.2
```
Quick Overview
--------------
The OWASP Java Encoder library is intended for quick contextual encoding with very little
overhead, either in performance or usage. To get started, simply add the encoder-1.2.jar,
import org.owasp.encoder.Encode and start using.
Example usage:
```java
PrintWriter out = ....;
out.println("");
```
Please look at the javadoc for Encode to see the variety of contexts for which you can encode.
Happy Encoding!
News
----
### 2020-11-08 - 1.2.3 Release
The team is happy to announce that version 1.2.3 has been released!
* Update to make the manifest OSGi-compliant (#39).
* Update to support ESAPI 2.2 and later (#37).
### 2018-09-14 - 1.2.2 Release
The team is happy to announce that version 1.2.2 has been released!
* This is a minor release fixing documentation and licensing issues.
### 2017-02-19 - 1.2.1 Release
The team is happy to announce that version 1.2.1 has been released!
* The CDATA Encoder was modified so that it does not emit intermediate characters between adjacent CDATA sections.
* The documentation on [gh-pages](http://owasp.github.io/owasp-java-encoder/) has been improved.
### 2015-04-12 - 1.2 Release on GitHub
OWASP Java Encoder has been moved to GitHub. Version 1.2 was also released!
### 2014-03-31 - Documentation updated
Please visit https://www.owasp.org/index.php/OWASP_Java_Encoder_Project#tab=Use_the_Java_Encoder_Project to see detailed documentation and examples on each API use!
### 2014-01-30 - Version 1.1.1 released
We're happy to announce that version 1.1.1 has been released. Along with a important bug fix, we added ESAPI integration to replace the legacy ESAPI encoders with the OWASP Java Encoder.
### 2013-02-14 - Version 1.1 released
We're happy to announce that version 1.1 has been released. Along with a few minor encoding enhancements, we improved performance, and added a JSP tag and function library.
owasp-java-encoder-1.2.3/core/ 0000775 0000000 0000000 00000000000 13752037245 0016142 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/core/pom.xml 0000664 0000000 0000000 00000007743 13752037245 0017472 0 ustar 00root root 0000000 0000000
4.0.0org.owasp.encoderencoder-parent1.2.3encoderjarJava Encoder
The OWASP Encoders package is a collection of high-performance low-overhead
contextual encoders, that when utilized correctly, is an effective tool in
preventing Web Application security vulnerabilities such as Cross-Site
Scripting.
org.apache.maven.pluginsmaven-surefire-pluginorg/owasp/encoder/BenchmarkTest.javabenchmarkorg.apache.maven.pluginsmaven-failsafe-plugin-Xmx1024m -XX:MaxPermSize=256morg/owasp/encoder/BenchmarkTest.javaintegration-testverify
owasp-java-encoder-1.2.3/core/src/ 0000775 0000000 0000000 00000000000 13752037245 0016731 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/core/src/main/ 0000775 0000000 0000000 00000000000 13752037245 0017655 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/core/src/main/java/ 0000775 0000000 0000000 00000000000 13752037245 0020576 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/core/src/main/java/org/ 0000775 0000000 0000000 00000000000 13752037245 0021365 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/core/src/main/java/org/owasp/ 0000775 0000000 0000000 00000000000 13752037245 0022516 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/core/src/main/java/org/owasp/encoder/ 0000775 0000000 0000000 00000000000 13752037245 0024135 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/core/src/main/java/org/owasp/encoder/ASCIIBits.java 0000664 0000000 0000000 00000010161 13752037245 0026451 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder;
/**
* ASCIIBits - Small helper class for building up 128-bit bit-mask (2 longs)
* to be used testing lower-ASCII characters. It helps make some other code
* easier to read. It is not intended to be public.
*/
class ASCIIBits {
/** Lower 64 bits. */
long _lowerMask;
/** Upper 64 bits. */
long _upperMask;
/**
* Sets a bit to 1 for each character in the argument string. No checking
* is performed to see if characters are in the valid range 0..127.
*
* @param chars the characters to set to 1.
* @return {@code this}
*/
ASCIIBits set(String chars) {
for (int i=0, n=chars.length() ; i". This encoder removes invalid XML characters, and encodes
* "]]>" (to "]]]]><![CDATA[>"). The result is that the data integrity is
* maintained, but the code receiving the output will have to handle multiple
* CDATA events. As an alternate approach, the caller could pre-encode "]]>" to
* something of their choosing (e.g. data.replaceAll("\\]\\]>", "]] >")), then
* use this encoder to remove any invalid XML characters.
*
* @author Jeff Ichnowski
*/
class CDATAEncoder extends Encoder {
/**
* The encoding of @{code "]]>"}.
*/
private static final char[] CDATA_END_ENCODED
= "]]]]>".toCharArray();
/**
* Length of {@code "]]]]>"}.
*/
private static final int CDATA_END_ENCODED_LENGTH = 15;
/**
* Length of {@code "]]>"}.
*/
private static final int CDATA_END_LENGTH = 3;
@Override
protected int maxEncodedLength(int n) {
// "]" becomes "]" (1 -> 1)
// "]]" becomes "]]" (2 -> 2)
// "]]>" becomes "]]]]>" (3 -> 15)
// "]]>]" becomes "]]]]>]" (3 -> 15 + 1 -> 1)
// ...
int worstCase = n / CDATA_END_LENGTH;
int remainder = n % CDATA_END_LENGTH;
return worstCase * CDATA_END_ENCODED_LENGTH + remainder;
// return (n - remainder) * 5 + remainder;
}
@Override
protected int firstEncodedOffset(String input, int off, int len) {
final int n = off + len;
//int closeCount = 0; //unused...
for (int i = off; i < n; ++i) {
char ch = input.charAt(i);
if (ch <= Unicode.MAX_ASCII) {
if (ch != ']') {
if (ch < ' ' && ch != '\n' && ch != '\r' && ch != '\t') {
return i;
// } else {
// // valid
}
} else if (i + 1 < n) {
if (input.charAt(i + 1) != ']') {
// "]x" (next character is safe for this to be ']')
} else {
// "]]?"
// keep looping through ']'
for (; i + 2 < n && input.charAt(i + 2) == ']'; ++i) {
// valid
}
// at this point we've looped through a sequence
// of 2 or more "]", if the next character is ">"
// we need to encode "]]>".
if (i + 2 < n) {
if (input.charAt(i + 2) == '>') {
return i;
// } else {
// // valid
}
} else {
return n;
}
}
} else {
return n;
}
} else if (ch < Character.MIN_HIGH_SURROGATE) {
if (ch <= Unicode.MAX_C1_CTRL_CHAR && ch != Unicode.NEL) {
return i;
// } else {
// // valid
}
} else if (ch <= Character.MAX_HIGH_SURROGATE) {
if (i + 1 < n) {
if (Character.isLowSurrogate(input.charAt(i + 1))) {
int cp = Character.toCodePoint(ch, input.charAt(i + 1));
if (Unicode.isNonCharacter(cp)) {
return i;
} else {
++i;
// valid pair
}
} else {
return i;
}
} else {
// end of input, high without low = invalid
return i;
}
} else if (// low surrogate without preceding high surrogate
ch <= Character.MAX_LOW_SURROGATE
// or non-characters
|| ch > '\ufffd'
|| ('\ufdd0' <= ch && ch <= '\ufdef'))
{
return i;
// } else {
// // valid
}
}
return n;
}
@Override
protected CoderResult encodeArrays(CharBuffer input, CharBuffer output, boolean endOfInput) {
final char[] in = input.array();
final char[] out = output.array();
int i = input.arrayOffset() + input.position();
final int n = input.arrayOffset() + input.limit();
int j = output.arrayOffset() + output.position();
final int m = output.arrayOffset() + output.limit();
for (; i < n; ++i) {
char ch = in[i];
if (ch <= Unicode.MAX_ASCII) {
if (ch != ']') {
if (j >= m) {
return overflow(input, i, output, j);
}
if (ch >= ' ' || ch == '\n' || ch == '\r' || ch == '\t') {
out[j++] = ch;
} else {
out[j++] = XMLEncoder.INVALID_CHARACTER_REPLACEMENT;
}
} else if (i + 1 < n) {
if (in[i + 1] != ']') {
// "]x" (next character is safe for this to be ']')
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = ']';
} else {
// "]]?"
// keep looping through ']'
for (; i + 2 < n && in[i + 2] == ']'; ++i) {
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = ']';
}
// at this point we've looped through a sequence
// of 2 or more "]", if the next character is ">"
// we need to encode "]]>".
if (i + 2 < n) {
if (in[i + 2] == '>') {
if (j + CDATA_END_ENCODED_LENGTH > m) {
return overflow(input, i, output, j);
}
System.arraycopy(CDATA_END_ENCODED, 0, out, j, CDATA_END_ENCODED_LENGTH);
j += CDATA_END_ENCODED_LENGTH;
i += 2;
} else {
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = ']';
}
} else if (endOfInput) {
if (j + 2 > m) {
return overflow(input, i, output, j);
}
out[j++] = ']';
out[j++] = ']';
i = n;
break;
} else {
break;
}
}
} else if (endOfInput) {
// seen "]", then end of input.
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = ']';
i++;
break;
} else {
break;
}
} else if (ch < Character.MIN_HIGH_SURROGATE) {
if (ch > Unicode.MAX_C1_CTRL_CHAR || ch == Unicode.NEL) {
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = ch;
} else {
// C1 control code
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = XMLEncoder.INVALID_CHARACTER_REPLACEMENT;
}
} else if (ch <= Character.MAX_HIGH_SURROGATE) {
if (i + 1 < n) {
if (Character.isLowSurrogate(in[i + 1])) {
int cp = Character.toCodePoint(ch, in[i + 1]);
if (Unicode.isNonCharacter(cp)) {
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = XMLEncoder.INVALID_CHARACTER_REPLACEMENT;
++i;
} else {
if (j + 1 >= m) {
return overflow(input, i, output, j);
}
out[j++] = ch;
out[j++] = in[++i];
}
} else {
// high without low
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = XMLEncoder.INVALID_CHARACTER_REPLACEMENT;
}
} else if (endOfInput) {
// end of input, high without low = invalid
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = XMLEncoder.INVALID_CHARACTER_REPLACEMENT;
} else {
break;
}
} else if (// low surrogate without preceding high surrogate
ch <= Character.MAX_LOW_SURROGATE
// or non-characters
|| ch > '\ufffd'
|| ('\ufdd0' <= ch && ch <= '\ufdef'))
{
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = XMLEncoder.INVALID_CHARACTER_REPLACEMENT;
} else {
if (j >= m) {
return overflow(input, i, output, j);
}
out[j++] = ch;
}
}
return underflow(input, i, output, j);
}
@Override
public String toString() {
return "CDATAEncoder";
}
}
owasp-java-encoder-1.2.3/core/src/main/java/org/owasp/encoder/CSSEncoder.java 0000664 0000000 0000000 00000024704 13752037245 0026737 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder;
import java.nio.CharBuffer;
import java.nio.charset.CoderResult;
/**
* CSSEncoder -- Encoder for Cascading-Style-Sheet string and URI contexts.
* Other contexts, such as color, number (w/unit), etc... are not good targets
* for "encoding" (e.g. you cannot encode the string "XYZ" into a number),
* they should instead by validated through other means (such as regular
* expressions).
*/
class CSSEncoder extends Encoder {
/** Number of bits in a {@code long}. */
static final int LONG_BITS = 64;
/** Length of hex encoding with trailing space {@code "\## "}. */
static final int HEX_ENCODED_LENGTH = 4;
/**
* Encoding mode of operation--specified the set of characters that
* required encoding.
*/
enum Mode {
/**
* String contexts. Characters between quotes.
*
*
* Not allowed: \n \r \f \\ " ' (everything else is allowed)
* Allows: "\\{nl}" (escaped newline)
*
*/
URL(new ASCIIBits().set("!#$%").set('*', '[').set(']', '~').clear("/<>")),
// In both contexts above '<' is added to protect embedded tag if there is HTML immediately after the vector to close it. This is useful if you cannot have either an equals sign or a slash in your cross site scripting attack, which has come up at least once in the real world:
Remote style sheet part 3
. This only works in Opera 8.0 (no longer in 9.x) but is fairly tricky. According to
RFC2616
setting a link header is not part of the HTTP1.1 spec, however some browsers still allow it (like Firefox and Opera). The trick here is that I am setting a header (which is basically no different than in the HTTP header saying Link: ; REL=stylesheet) and the remote style sheet with my cross site scripting vector is running the JavaScript, which is not supported in FireFox:
Remote style sheet part 4
. This only works in Gecko rendering engines and works by binding an XUL file to the parent page. I think the irony here is that Netscape assumes that Gecko is safer and therefor is vulnerable to this for the vast majority of sites:
Local htc file
. This is a little different than the above two cross site scripting vectors because it uses an .htc file which must be on the same server as the XSS vector. The example file works by pulling in the JavaScript and running it as part of the style attribute:
List-style-image
. Fairly esoteric issue dealing with embedding images for bulleted lists. This will only work in the IE rendering engine because of the JavaScript directive. Not a particularly useful cross site scripting vector:
XSS
VBscript
in an image:
Mocha
(older versions of Netscape only):
Livescript
US-ASCII
encoding (found by
Kurt Huwig
). This uses malformed ASCII encoding with 7 bits instead of 8. This XSS may bypass many content filters but only works if the host transmits in US-ASCII encoding, or if you set the encoding yourself. This is more useful against web application firewall cross site scripting evasion than it is server side filter evasion. Apache Tomcat is the only known server that transmits in US-ASCII encoding. I highly suggest anyone interested in alternate encoding issues look at
my charsets issues
page:
¼script¾alert(¢XSS¢)¼/script¾
META
(the odd thing about meta refresh is that it doesn't send a referrer in the header - so it can be used for certain types of attacks where you need to get rid of referring URLs):
META using data: directive
URL scheme. This is nice because it also doesn't have anything visibly that has the word SCRIPT or the JavaScript directive in it, because it utilizes base64 encoding. Please see
RFC 2397
for more details or go
or
to encode your own. You can also use the
below if you just want to encode raw HTML or JavaScript as it has a Base64 encoding method:
META with additional URL parameter
. If the target website attempts to see if the URL contains "http://" at the beginning you can evade it with the following technique (Submitted by
Moritz Naumann
):
IFRAME
(if iframes are allowed there are a lot of other XSS problems as well):
FRAME
(frames have the same sorts of XSS problems as iframes):
TABLE
(who would have thought tables were XSS targets... except me, of course):
TD
(just like above, TD's are vulnerable to BACKGROUNDs containing JavaScript XSS vectors):
DIV background-image
DIV background-image with unicoded XSS
exploit (this has been modified slightly to obfuscate the url parameter). The original vulnerability was found by
Renaud Lifchitz
as a vulnerability in Hotmail:
DIV background-image plus extra characters
. I built a quick XSS fuzzer to detect any erroneous characters that are allowed after the open parenthesis but before the JavaScript directive in IE and Netscape 8.1 in secure site mode. These are in decimal but you can include hex and add padding of course. (Any of the following chars can be used: 1-32, 34, 39, 160, 8192-8.13, 12288, 65279):
DIV expression
- a variant of this was effective against a real world cross site scripting filter using a newline between the colon and "expression":
Please note that the OWASP Java Encoders does not implement all
* the encodings of the ESAPI Encoder API. In such situations this
* implementation will fallback onto the default reference implementation
* included with ESAPI. Thus you should see the performance benefit from
* the methods included in the Encoder, but still maintain compatibility
* with all methods from ESAPI Encoder.
*
*
For clarity, the reason the OWASP Java Encoders do not include some
* of the ESAPI library is that the Encoders library is specifically focused
* on encoding, and thus does not include:
(Please note that with sufficient feedback from the user base, the above
* mentioned methods may be implemented in future releases of the OWASP
* Java Encoders, if/when that happens, this shim class will be updated to
* call out to the new methods.)
*
*
You may notice that this class does not actually implement Encoder
* itself. Instead it simply provides a {@link #getInstance()} method that
* does. This allows the implementation details maximum flexibility by not
* creating a any public API that would restrict changes later
*
* @author jeffi
*/
public final class ESAPIEncoder {
/** No instances. */
private ESAPIEncoder() {}
/**
* Returns an instance of the Encoder. This method is the only supported
* mechanism by which an ESAPIEncoder instance should be obtained. The
* returned implementation is guaranteed to be thread-safe for the methods
* that the OWASP Java Encoders implement (see class documentation).
* Though not a requirement of the ESAPI Encoder API, the returned value
* is also serializable.
*
* @return An encoder implementation that uses the OWASP Java Encoders
* for most of the common encoding methods.
*/
public static Encoder getInstance() {
return Impl.INSTANCE;
}
/**
* This is the private singleton that implements the ESAPI Encoder shim.
* It is implemented as a single-value enum to get all the "free" singleton
* properties associated with enums--such as serialization, and on-demand
* initialization.
*
*
The implementation is intentionally private to avoid any API baggage.
* The instance should be obtained using
* {@link org.owasp.encoder.esapi.ESAPIEncoder#getInstance()}.
*/
private enum Impl implements Encoder {
/**
* The singleton instance.
*/
INSTANCE;
/**
* The reference encoder from ESAPI. Any ESAPI method without an
* OWASP Java Encoder equivalent is delegated to this instance.
*/
private final Encoder _referenceEncoder = DefaultEncoder.getInstance();
/** {@inheritDoc} */
public String canonicalize(String s) {
return _referenceEncoder.canonicalize(s);
}
/** {@inheritDoc} */
public String canonicalize(String s, boolean strict) {
return _referenceEncoder.canonicalize(s, strict);
}
/** {@inheritDoc} */
public String canonicalize(String s, boolean restrictMultiple, boolean restrictMixed) {
return _referenceEncoder.canonicalize(s, restrictMultiple, restrictMixed);
}
/** {@inheritDoc} */
public String getCanonicalizedURI(URI dirtyUri) {
return _referenceEncoder.getCanonicalizedURI(dirtyUri);
}
/** {@inheritDoc} */
public String encodeForCSS(String s) {
return Encode.forCssString(s);
}
/** {@inheritDoc} */
public String encodeForHTML(String s) {
return Encode.forHtml(s);
}
/** {@inheritDoc} */
public String decodeForHTML(String s) {
return _referenceEncoder.decodeForHTML(s);
}
/** {@inheritDoc} */
public String encodeForHTMLAttribute(String s) {
return Encode.forHtmlAttribute(s);
}
/** {@inheritDoc} */
public String encodeForJavaScript(String s) {
return Encode.forJavaScript(s);
}
/** {@inheritDoc} */
public String encodeForVBScript(String s) {
return _referenceEncoder.encodeForVBScript(s);
}
/** {@inheritDoc} */
public String encodeForSQL(Codec codec, String s) {
return _referenceEncoder.encodeForSQL(codec, s);
}
/** {@inheritDoc} */
public String encodeForOS(Codec codec, String s) {
return _referenceEncoder.encodeForOS(codec, s);
}
/** {@inheritDoc} */
public String encodeForLDAP(String s) {
return _referenceEncoder.encodeForLDAP(s);
}
/** {@inheritDoc} */
public String encodeForLDAP(String s, boolean b) {
return _referenceEncoder.encodeForLDAP(s, b);
}
/** {@inheritDoc} */
public String encodeForDN(String s) {
return _referenceEncoder.encodeForDN(s);
}
/** {@inheritDoc} */
public String encodeForXPath(String s) {
return _referenceEncoder.encodeForXPath(s);
}
/** {@inheritDoc} */
public String encodeForXML(String s) {
return Encode.forXml(s);
}
/** {@inheritDoc} */
public String encodeForXMLAttribute(String s) {
return Encode.forXmlAttribute(s);
}
/** {@inheritDoc} */
public String encodeForURL(String s) throws EncodingException {
return Encode.forUri(s);
}
/** {@inheritDoc} */
public String decodeFromURL(String s) throws EncodingException {
return _referenceEncoder.decodeFromURL(s);
}
/** {@inheritDoc} */
public String encodeForBase64(byte[] bytes, boolean wrap) {
return _referenceEncoder.encodeForBase64(bytes, wrap);
}
/** {@inheritDoc} */
public byte[] decodeFromBase64(String s) throws IOException {
return _referenceEncoder.decodeFromBase64(s);
}
}
}
owasp-java-encoder-1.2.3/esapi/src/main/resources/ 0000775 0000000 0000000 00000000000 13752037245 0022040 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/main/resources/META-INF/ 0000775 0000000 0000000 00000000000 13752037245 0023200 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/main/resources/META-INF/LICENSE 0000664 0000000 0000000 00000002771 13752037245 0024214 0 ustar 00root root 0000000 0000000 Copyright (c) 2015 Jeff Ichnowski
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
* Redistributions of source code must retain the above
copyright notice, this list of conditions and the following
disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials
provided with the distribution.
* Neither the name of the OWASP nor the names of its
contributors may be used to endorse or promote products
derived from this software without specific prior written
permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE. owasp-java-encoder-1.2.3/esapi/src/site/ 0000775 0000000 0000000 00000000000 13752037245 0020046 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/site/site.xml 0000664 0000000 0000000 00000003142 13752037245 0021534 0 ustar 00root root 0000000 0000000
owasp-java-encoder-1.2.3/esapi/src/test/ 0000775 0000000 0000000 00000000000 13752037245 0020061 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/test/java/ 0000775 0000000 0000000 00000000000 13752037245 0021002 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/test/java/org/ 0000775 0000000 0000000 00000000000 13752037245 0021571 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/test/java/org/owasp/ 0000775 0000000 0000000 00000000000 13752037245 0022722 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/test/java/org/owasp/encoder/ 0000775 0000000 0000000 00000000000 13752037245 0024341 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/test/java/org/owasp/encoder/esapi/ 0000775 0000000 0000000 00000000000 13752037245 0025442 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/test/java/org/owasp/encoder/esapi/ESAPIEncoderTest.java 0000664 0000000 0000000 00000002745 13752037245 0031316 0 ustar 00root root 0000000 0000000 package org.owasp.encoder.esapi;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import junit.framework.Test;
import junit.framework.TestCase;
import junit.framework.TestSuite;
import org.owasp.esapi.ESAPI;
import org.owasp.esapi.Encoder;
/**
* ESAPIEncoderTest
*
* @author jeffi
*/
public class ESAPIEncoderTest extends TestCase {
public static Test suite() {
return new TestSuite(ESAPIEncoderTest.class);
}
public void testEncode() throws Exception {
// Note: ESAPI reference encodes as: "<>&Ω"
// That's 25 characters to OWASP Java Encoder's 14.
assertEquals("<>&\u03a9", ESAPI.encoder().encodeForXML("<>&\u03a9"));
}
public void testSerialization() throws Exception {
// Note: ESAPI reference implementation is NOT serializable. Maybe
// it will be in the future. Our implementation is however
// guaranteed serializable.
Encoder encoder = ESAPI.encoder();
ByteArrayOutputStream baos = new ByteArrayOutputStream();
ObjectOutputStream oos = new ObjectOutputStream(baos);
oos.writeObject(encoder);
oos.close();
ObjectInputStream ois = new ObjectInputStream(
new ByteArrayInputStream(baos.toByteArray()));
Encoder deserializedEncoder = (Encoder)ois.readObject();
assertSame(encoder, deserializedEncoder);
}
}
owasp-java-encoder-1.2.3/esapi/src/test/resources/ 0000775 0000000 0000000 00000000000 13752037245 0022073 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/test/resources/.esapi/ 0000775 0000000 0000000 00000000000 13752037245 0023252 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/esapi/src/test/resources/.esapi/ESAPI.properties 0000664 0000000 0000000 00000004177 13752037245 0026242 0 ustar 00root root 0000000 0000000 # Properties based on ESAPI 2.2.1.1's configuration/esapi/ESAPI.properties file.
ESAPI.Encoder=org.owasp.encoder.esapi.ESAPIEncoder
# Log4JFactory Requires log4j.xml or log4j.properties in classpath - http://www.laliluna.de/log4j-tutorial.html
# Note that this is now considered deprecated!
#ESAPI.Logger=org.owasp.esapi.logging.log4j.Log4JLogFactory
# To use JUL, you need to obtain ESAPI's esapi-java-logging.properties and drop
# it somewhere into your class path. You can get it from the ESAPI configuration
# jar. (See Release 2.2.1.1 under GitHub for ESAPI/esapi-java-legacy.)
ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory
# To use the new SLF4J logger in ESAPI (see GitHub issue #129), set
#ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory
# and do whatever other normal SLF4J configuration that you normally would do for your application.
# Note: The uncommented out ones are those needed for SLF4J. Others may be
# needed if you change the ESAPI logger.
#===========================================================================
# ESAPI Logging
# Set the application name if these logs are combined with other applications
Logger.ApplicationName=ESAPI-Shim-Test
# If you use an HTML log viewer that does not properly HTML escape log data, you can set LogEncodingRequired to true
Logger.LogEncodingRequired=false
# Determines whether ESAPI should log the application name. This might be clutter in some single-server/single-app environments.
Logger.LogApplicationName=true
# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.
Logger.LogServerIP=false
# LogFileName, the name of the logging file. Provide a full directory path (e.g., C:\\ESAPI\\ESAPI_logging_file) if you
# want to place it in a specific directory.
#Logger.LogFileName=ESAPI_logging_file
# MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000)
#Logger.MaxLogFileSize=10000000
# Determines whether ESAPI should log the user info.
Logger.UserInfo=false
# Determines whether ESAPI should log the session id and client IP
Logger.ClientInfo=false
owasp-java-encoder-1.2.3/esapi/src/test/resources/esapi-java-logging.properties 0000664 0000000 0000000 00000000533 13752037245 0027656 0 ustar 00root root 0000000 0000000 handlers= java.util.logging.ConsoleHandler
.level= INFO
java.util.logging.ConsoleHandler.level = INFO
java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
java.util.logging.SimpleFormatter.format=[%1$tF %1$tT] [%3$-7s] %5$s %n
#https://www.logicbig.com/tutorials/core-java-tutorial/logging/customizing-default-format.html owasp-java-encoder-1.2.3/jsp/ 0000775 0000000 0000000 00000000000 13752037245 0016006 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/pom.xml 0000664 0000000 0000000 00000006672 13752037245 0017336 0 ustar 00root root 0000000 0000000
4.0.0org.owasp.encoderencoder-parent1.2.3encoder-jspjarJSP Encoder
The OWASP Encoder JSP package contains JSP tag definitions and TLDs to allow
easy use of the OWASP Encoder Project's core API. The TLDs contain both tag
definitions and JSP EL functions.
org.owasp.encoderencoder${project.parent.version}javax.servlet.jspjavax.servlet.jsp-api2.2.1providedjavax.servletjavax.servlet-api3.0.1testorg.springframeworkspring-test5.1.3.RELEASEtestorg.springframeworkspring-core5.1.3.RELEASEtest
owasp-java-encoder-1.2.3/jsp/src/ 0000775 0000000 0000000 00000000000 13752037245 0016575 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/main/ 0000775 0000000 0000000 00000000000 13752037245 0017521 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/main/java/ 0000775 0000000 0000000 00000000000 13752037245 0020442 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/main/java/org/ 0000775 0000000 0000000 00000000000 13752037245 0021231 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/ 0000775 0000000 0000000 00000000000 13752037245 0022362 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/ 0000775 0000000 0000000 00000000000 13752037245 0024001 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ 0000775 0000000 0000000 00000000000 13752037245 0024554 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/EncodingTag.java 0000664 0000000 0000000 00000004213 13752037245 0027601 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import javax.servlet.jsp.tagext.SimpleTagSupport;
/**
* The base class for the encoding tags within tihs package.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public abstract class EncodingTag extends SimpleTagSupport {
/**
* The value to be written out by the tag.
*/
protected String _value;
/**
* Sets the value to be written out by the tag.
* @param value the value to be written out by the tag.
*/
public void setValue(String value) {
this._value = value;
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForCDATATag.java 0000664 0000000 0000000 00000004147 13752037245 0027344 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform encoding sufficient to place into a CDATA block.
* This wraps the {@link org.owasp.encoder.Encode#forCDATA(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForCDATATag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forCDATA(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForCssStringTag.java 0000664 0000000 0000000 00000004140 13752037245 0030440 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform CSS encoding for CSS strings.
* This wraps the {@link org.owasp.encoder.Encode#forCssString(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForCssStringTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forCssString(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForCssUrlTag.java 0000664 0000000 0000000 00000004134 13752037245 0027737 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform CSS encoding for CSS URL contexts.
* This wraps the {@link org.owasp.encoder.Encode#forCssUrl(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForCssUrlTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forCssUrl(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForHtmlAttributeTag.java 0000664 0000000 0000000 00000004166 13752037245 0031321 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform HTML encoding for HTML text attributes.
* This wraps the {@link org.owasp.encoder.Encode#forHtmlAttribute(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForHtmlAttributeTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forHtmlAttribute(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForHtmlContentTag.java 0000664 0000000 0000000 00000004150 13752037245 0030761 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform HTML encoding for text content.
* This wraps the {@link org.owasp.encoder.Encode#forHtmlContent(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForHtmlContentTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forHtmlContent(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForHtmlTag.java 0000664 0000000 0000000 00000004102 13752037245 0027423 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform HTML encoding.
* This wraps the {@link org.owasp.encoder.Encode#forHtml(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForHtmlTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forHtml(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForHtmlUnquotedAttributeTag.java 0000664 0000000 0000000 00000004231 13752037245 0033037 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform HTML Attribute encoding for an unquoted attribute.
* This wraps the {@link org.owasp.encoder.Encode#forHtmlUnquotedAttribute(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForHtmlUnquotedAttributeTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forHtmlUnquotedAttribute(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForJavaScriptAttributeTag.java 0000664 0000000 0000000 00000004177 13752037245 0032465 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform JavaScript Attribute encoding.
* This wraps the {@link org.owasp.encoder.Encode#forJavaScriptAttribute(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForJavaScriptAttributeTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forJavaScriptAttribute(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForJavaScriptBlockTag.java 0000664 0000000 0000000 00000004157 13752037245 0031552 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform JavaScript Block encoding.
* This wraps the {@link org.owasp.encoder.Encode#forJavaScriptBlock(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForJavaScriptBlockTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forJavaScriptBlock(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForJavaScriptSourceTag.java 0000664 0000000 0000000 00000004163 13752037245 0031755 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform JavaScript Source encoding.
* This wraps the {@link org.owasp.encoder.Encode#forJavaScriptSource(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForJavaScriptSourceTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forJavaScriptSource(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForJavaScriptTag.java 0000664 0000000 0000000 00000004132 13752037245 0030570 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform JavaScript encoding.
* This wraps the {@link org.owasp.encoder.Encode#forJavaScript(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForJavaScriptTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forJavaScript(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForUriComponentTag.java 0000664 0000000 0000000 00000004274 13752037245 0031153 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag that performs percent-encoding for a component of a URI, such as a query
* parameter name or value, path, or query-string.
* This wraps the {@link org.owasp.encoder.Encode#forUriComponent(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForUriComponentTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forUriComponent(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForUriTag.java 0000664 0000000 0000000 00000004141 13752037245 0027261 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform percent-encoding of a URL according to RFC 3986.
* This wraps the {@link org.owasp.encoder.Encode#forUri(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForUriTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forUri(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForXmlAttributeTag.java 0000664 0000000 0000000 00000004143 13752037245 0031150 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform XML Attribute Encoding.
* This wraps the {@link org.owasp.encoder.Encode#forXmlAttribute(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForXmlAttributeTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forXmlAttribute(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForXmlCommentTag.java 0000664 0000000 0000000 00000004135 13752037245 0030610 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform XML Comment Encoding.
* This wraps the {@link org.owasp.encoder.Encode#forXmlAttribute(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForXmlCommentTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forXmlComment(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForXmlContentTag.java 0000664 0000000 0000000 00000004135 13752037245 0030620 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform XML Content Encoding.
* This wraps the {@link org.owasp.encoder.Encode#forXmlAttribute(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForXmlContentTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forXmlContent(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/java/org/owasp/encoder/tag/ForXmlTag.java 0000664 0000000 0000000 00000004076 13752037245 0027271 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import java.io.IOException;
import javax.servlet.jsp.JspException;
import org.owasp.encoder.Encode;
/**
* A tag to perform XML Encoding.
* This wraps the {@link org.owasp.encoder.Encode#forXml(java.lang.String)}.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForXmlTag extends EncodingTag {
@Override
public void doTag() throws JspException, IOException {
Encode.forXml(getJspContext().getOut(), _value);
}
}
owasp-java-encoder-1.2.3/jsp/src/main/resources/ 0000775 0000000 0000000 00000000000 13752037245 0021533 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/main/resources/META-INF/ 0000775 0000000 0000000 00000000000 13752037245 0022673 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/main/resources/META-INF/LICENSE 0000664 0000000 0000000 00000002771 13752037245 0023707 0 ustar 00root root 0000000 0000000 Copyright (c) 2015 Jeff Ichnowski
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
* Redistributions of source code must retain the above
copyright notice, this list of conditions and the following
disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials
provided with the distribution.
* Neither the name of the OWASP nor the names of its
contributors may be used to endorse or promote products
derived from this software without specific prior written
permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE. owasp-java-encoder-1.2.3/jsp/src/main/resources/META-INF/java-encoder-advanced.tld 0000664 0000000 0000000 00000060535 13752037245 0027512 0 ustar 00root root 0000000 0000000
OWASP Java Encoder Project1.0java-encoderhttps://www.owasp.org/index.php/OWASP_Java_Encoder_Project#advanced
Encodes data for an XML CDATA section. On the chance that the input
contains a terminating
"]]>", it will be replaced by
"]]>]]<![CDATA[>".
As with all XML contexts, characters that are invalid according to the
XML specification will be replaced by a space character. Caller must
provide the CDATA section boundaries.
forCDATAforCDATAorg.owasp.encoder.tag.ForCDATATagemptyThe value to be written outvaluetruetruejava.lang.String
This method encodes for HTML text content. It does not escape
quotation characters and is thus unsafe for use with
HTML attributes. Use either forHtml or forHtmlAttribute for those
methods.
forHtmlContentforHtmlContentorg.owasp.encoder.tag.ForHtmlContentTagemptyvalue to be written outvaluetruetruejava.lang.StringEncodes for XML and XHTML attribute content.forXmlAttributeforXmlAttributeorg.owasp.encoder.tag.ForXmlAttributeTagemptyvalue to be written outvaluetruetruejava.lang.StringEncodes for XML and XHTML.forXmlforXmlorg.owasp.encoder.tag.ForXmlTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for a JavaScript string. It is safe for use in HTML
script attributes (such as onclick), script
blocks, JSON files, and JavaScript source. The caller MUST
provide the surrounding quotation characters for the string.
Since this performs additional encoding so it can work in all
of the JavaScript contexts listed, it may be slightly less
efficient then using one of the methods targetted to a specific
JavaScript context: forJavaScriptAttribute,
forJavaScriptBlock, or forJavaScriptSource.
Unless you are interested in saving a few bytes of output or
are writing a framework on top of this library, it is recommend
that you use this method over the others.
forJavaScriptforJavaScriptorg.owasp.encoder.tag.ForJavaScriptTagemptyvalue to be written outvaluetruetruejava.lang.String
This method encodes for JavaScript strings contained within
HTML script attributes (such as onclick). It is
NOT safe for use in script blocks. The caller MUST provide the
surrounding quotation characters. This method performs the
same encode as Encode.forJavaScript(String) with the
exception that / is not escaped.
forJavaScriptAttributeforJavaScriptAttributeorg.owasp.encoder.tag.ForJavaScriptAttributeTagemptyvalue to be written outvaluetruetruejava.lang.String
This method encodes for JavaScript strings contained within
HTML script blocks. It is NOT safe for use in script
attributes (such as onclick). The caller must
provide the surrounding quotation characters. This method
performs the same encode as Encode.forJavaScript(String)} with
the exception that " and ' are encoded as \" and \' respectively.
forJavaScriptBlockforJavaScriptBlockorg.owasp.encoder.tag.ForJavaScriptBlockTagemptyvalue to be written outvaluetruetruejava.lang.String
This method encodes for JavaScript strings contained within
a JavaScript or JSON file. This method is NOT safe for
use in ANY context embedded in HTML. The caller must
provide the surrounding quotation characters. This method
performs the same encode as Encode.forJavaScript(String) with
the exception that / and & are not escaped and " and ' are
encoded as \" and \' respectively.
forJavaScriptSourceforJavaScriptSourceorg.owasp.encoder.tag.ForJavaScriptSourceTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for unquoted HTML attribute values. forHtml(String) or
forHtmlAttribute(String) should usually be preferred over this
method as quoted attributes are XHTML compliant.
forHtmlUnquotedAttributeforHtmlUnquotedAttributeorg.owasp.encoder.tag.ForHtmlUnquotedAttributeTagemptyvalue to be written outvaluetruetruejava.lang.String
Performs percent-encoding of a URL according to RFC 3986. The provided
URL is assumed to a valid URL. This method does not do any checking on
the quality or safety of the URL itself. In many applications it may
be better to use java.net.URI instead. Note: this is a
particularly dangerous context to put untrusted content in, as for
example a "javascript:" URL provided by a malicious user would be
"properly" escaped, and still execute.
forUriforUriorg.owasp.encoder.tag.ForUriTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for CSS URL contexts. The context must be surrounded by "url()". It
is safe for use in both style blocks and attributes in HTML. Note: this does
not do any checking on the quality or safety of the URL itself. The caller
should insure that the URL is safe for embedding (e.g. input validation) by
other means.
forCssUrlforCssUrlorg.owasp.encoder.tag.ForCssUrlTagemptyvalue to be written outvaluetruetruejava.lang.String
Encoder for XML comments. NOT FOR USE WITH (X)HTML CONTEXTS.
(X)HTML comments may be interpreted by browsers as something
other than a comment, typically in vendor specific extensions
(e.g. <--if[IE]-->.
For (X)HTML it is recommend that unsafe content never be included
in a comment.
forXmlCommentforXmlCommentorg.owasp.encoder.tag.ForXmlCommentTagemptyvalue to be written outvaluetruetruejava.lang.StringEncodes for HTML text attributes.forHtmlAttributeforHtmlAttributeorg.owasp.encoder.tag.ForHtmlAttributeTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for (X)HTML text content and text attributes.
forHtmlforHtmlorg.owasp.encoder.tag.ForHtmlTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for HTML text content. It does not escape
quotation characters and is thus unsafe for use with
HTML attributes. Use either forHtml or forHtmlAttribute for those
methods.
forXmlContentforXmlContentorg.owasp.encoder.tag.ForXmlContentTagemptyvalue to be written outvaluetruetruejava.lang.String
Performs percent-encoding for a component of a URI, such as a query
parameter name or value, path or query-string. In particular this
method insures that special characters in the component do not get
interpreted as part of another component.
forUriComponentforUriComponentorg.owasp.encoder.tag.ForUriComponentTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for CSS strings. The context must be surrounded by quotation characters.
It is safe for use in both style blocks and attributes in HTML.
forCssStringforCssStringorg.owasp.encoder.tag.ForCssStringTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for (X)HTML text content and text attributes.
forHtmlforHtmlorg.owasp.encoder.Encodejava.lang.String forHtml(java.lang.String)forHtml(unsafeData)
This method encodes for HTML text content. It does not escape
quotation characters and is thus unsafe for use with
HTML attributes. Use either forHtml or forHtmlAttribute for those
methods.
forHtmlContentforHtmlContentorg.owasp.encoder.Encodejava.lang.String forHtmlContent(java.lang.String)forHtmlContent(unsafeData)Encodes for HTML text attributes.forHtmlAttributeorg.owasp.encoder.Encodejava.lang.String forHtmlAttribute(java.lang.String)forHtmlAttribute(unsafeData)
Encodes for unquoted HTML attribute values. forHtml(String) or
forHtmlAttribute(String) should usually be preferred over this
method as quoted attributes are XHTML compliant.
forHtmlUnquotedAttributeforHtmlUnquotedAttributeorg.owasp.encoder.Encodejava.lang.String forHtmlUnquotedAttribute(java.lang.String)forHtmlUnquotedAttribute(unsafeData)
Encodes for CSS strings. The context must be surrounded by quotation characters.
It is safe for use in both style blocks and attributes in HTML.
forCssStringforCssStringorg.owasp.encoder.Encodejava.lang.String forCssString(java.lang.String)forCssString(unsafeData)
Encodes for CSS URL contexts. The context must be surrounded by "url()". It
is safe for use in both style blocks and attributes in HTML. Note: this does
not do any checking on the quality or safety of the URL itself. The caller
should insure that the URL is safe for embedding (e.g. input validation) by
other means.
forCssUrlforCssUrlorg.owasp.encoder.Encodejava.lang.String forCssUrl(java.lang.String)forCssUrl(unsafeData)
Performs percent-encoding of a URL according to RFC 3986. The provided
URL is assumed to a valid URL. This method does not do any checking on
the quality or safety of the URL itself. In many applications it may
be better to use java.net.URI instead. Note: this is a
particularly dangerous context to put untrusted content in, as for
example a "javascript:" URL provided by a malicious user would be
"properly" escaped, and still execute.
forUriforUriorg.owasp.encoder.Encodejava.lang.String forUri(java.lang.String)forUri(unsafeData)
Performs percent-encoding for a component of a URI, such as a query
parameter name or value, path or query-string. In particular this
method insures that special characters in the component do not get
interpreted as part of another component.
forUriComponentforUriComponentorg.owasp.encoder.Encodejava.lang.String forUriComponent(java.lang.String)forUriComponent(unsafeData)Encodes for XML and XHTML.forXmlforXmlorg.owasp.encoder.Encodejava.lang.String forXml(java.lang.String)forXml(unsafeData)
Encodes for HTML text content. It does not escape
quotation characters and is thus unsafe for use with
HTML attributes. Use either forHtml or forHtmlAttribute for those
methods.
forXmlContentforXmlContentorg.owasp.encoder.Encodejava.lang.String forXmlContent(java.lang.String)forXmlContent(unsafeData)Encodes for XML and XHTML attribute content.forXmlAttributeforXmlAttributeorg.owasp.encoder.Encodejava.lang.String forXmlAttribute(java.lang.String)forXmlAttribute(unsafeData)
Encoder for XML comments. NOT FOR USE WITH (X)HTML CONTEXTS.
(X)HTML comments may be interpreted by browsers as something
other than a comment, typically in vendor specific extensions
(e.g. <--if[IE]-->.
For (X)HTML it is recommend that unsafe content never be included
in a comment.
forXmlCommentorg.owasp.encoder.Encodejava.lang.String forXmlComment(java.lang.String)forXmlComment(unsafeData)
Encodes data for an XML CDATA section. On the chance that the input
contains a terminating
"]]>", it will be replaced by
"]]>]]<![CDATA[>".
As with all XML contexts, characters that are invalid according to the
XML specification will be replaced by a space character. Caller must
provide the CDATA section boundaries.
forCDATAforCDATAorg.owasp.encoder.Encodejava.lang.String forCDATA(java.lang.String)forCDATA(unsafeData)
Encodes for a JavaScript string. It is safe for use in HTML
script attributes (such as onclick), script
blocks, JSON files, and JavaScript source. The caller MUST
provide the surrounding quotation characters for the string.
Since this performs additional encoding so it can work in all
of the JavaScript contexts listed, it may be slightly less
efficient then using one of the methods targetted to a specific
JavaScript context: forJavaScriptAttribute,
forJavaScriptBlock, or forJavaScriptSource.
Unless you are interested in saving a few bytes of output or
are writing a framework on top of this library, it is recommend
that you use this method over the others.
forJavaScriptforJavaScriptorg.owasp.encoder.Encodejava.lang.String forJavaScript(java.lang.String)forJavaScript(unsafeData)
This method encodes for JavaScript strings contained within
HTML script attributes (such as onclick). It is
NOT safe for use in script blocks. The caller MUST provide the
surrounding quotation characters. This method performs the
same encode as Encode.forJavaScript(String) with the
exception that / is not escaped.
forJavaScriptAttributeforJavaScriptAttributeorg.owasp.encoder.Encodejava.lang.String forJavaScriptAttribute(java.lang.String)forJavaScriptAttribute(unsafeData)
This method encodes for JavaScript strings contained within
HTML script blocks. It is NOT safe for use in script
attributes (such as onclick). The caller must
provide the surrounding quotation characters. This method
performs the same encode as Encode.forJavaScript(String)} with
the exception that " and ' are encoded as \" and \' respectively.
forJavaScriptBlockforJavaScriptBlockorg.owasp.encoder.Encodejava.lang.String forJavaScriptBlock(java.lang.String)forJavaScriptBlock(unsafeData)
This method encodes for JavaScript strings contained within
a JavaScript or JSON file. This method is NOT safe for
use in ANY context embedded in HTML. The caller must
provide the surrounding quotation characters. This method
performs the same encode as Encode.forJavaScript(String) with
the exception that / and & are not escaped and " and ' are
encoded as \" and \' respectively.
forJavaScriptSourceforJavaScriptSourceorg.owasp.encoder.Encodejava.lang.String forJavaScriptSource(java.lang.String)
<%@page contentType="text/javascript; charset=UTF-8"%>
var data = '${forJavaScriptSource(unsafeData)}';
owasp-java-encoder-1.2.3/jsp/src/main/resources/META-INF/java-encoder.tld 0000664 0000000 0000000 00000042613 13752037245 0025744 0 ustar 00root root 0000000 0000000
OWASP Java Encoder Project1.0java-encoderhttps://www.owasp.org/index.php/OWASP_Java_Encoder_Project
Encodes data for an XML CDATA section. On the chance that the input
contains a terminating
"]]>", it will be replaced by
"]]>]]<![CDATA[>".
As with all XML contexts, characters that are invalid according to the
XML specification will be replaced by a space character. Caller must
provide the CDATA section boundaries.
forCDATAforCDATAorg.owasp.encoder.tag.ForCDATATagemptyThe value to be written outvaluetruetruejava.lang.String
This method encodes for HTML text content. It does not escape
quotation characters and is thus unsafe for use with
HTML attributes. Use either forHtml or forHtmlAttribute for those
methods.
forHtmlContentforHtmlContentorg.owasp.encoder.tag.ForHtmlContentTagemptyvalue to be written outvaluetruetruejava.lang.StringEncodes for XML and XHTML attribute content.forXmlAttributeforXmlAttributeorg.owasp.encoder.tag.ForXmlAttributeTagemptyvalue to be written outvaluetruetruejava.lang.StringEncodes for XML and XHTML.forXmlforXmlorg.owasp.encoder.tag.ForXmlTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for a JavaScript string. It is safe for use in HTML
script attributes (such as onclick), script
blocks, JSON files, and JavaScript source. The caller MUST
provide the surrounding quotation characters for the string.
Since this performs additional encoding so it can work in all
of the JavaScript contexts listed, it may be slightly less
efficient then using one of the methods targetted to a specific
JavaScript context: forJavaScriptAttribute,
forJavaScriptBlock, or forJavaScriptSource.
Unless you are interested in saving a few bytes of output or
are writing a framework on top of this library, it is recommend
that you use this method over the others.
forJavaScriptforJavaScriptorg.owasp.encoder.tag.ForJavaScriptTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for unquoted HTML attribute values. forHtml(String) or
forHtmlAttribute(String) should usually be preferred over this
method as quoted attributes are XHTML compliant.
forHtmlUnquotedAttributeforHtmlUnquotedAttributeorg.owasp.encoder.tag.ForHtmlUnquotedAttributeTagemptyvalue to be written outvaluetruetruejava.lang.String
Performs percent-encoding of a URL according to RFC 3986. The provided
URL is assumed to a valid URL. This method does not do any checking on
the quality or safety of the URL itself. In many applications it may
be better to use java.net.URI instead. Note: this is a
particularly dangerous context to put untrusted content in, as for
example a "javascript:" URL provided by a malicious user would be
"properly" escaped, and still execute.
forUriforUriorg.owasp.encoder.tag.ForUriTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for CSS URL contexts. The context must be surrounded by "url()". It
is safe for use in both style blocks and attributes in HTML. Note: this does
not do any checking on the quality or safety of the URL itself. The caller
should insure that the URL is safe for embedding (e.g. input validation) by
other means.
forCssUrlforCssUrlorg.owasp.encoder.tag.ForCssUrlTagemptyvalue to be written outvaluetruetruejava.lang.StringEncodes for HTML text attributes.forHtmlAttributeforHtmlAttributeorg.owasp.encoder.tag.ForHtmlAttributeTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for (X)HTML text content and text attributes.
forHtmlforHtmlorg.owasp.encoder.tag.ForHtmlTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for HTML text content. It does not escape
quotation characters and is thus unsafe for use with
HTML attributes. Use either forHtml or forHtmlAttribute for those
methods.
forXmlContentforXmlContentorg.owasp.encoder.tag.ForXmlContentTagemptyvalue to be written outvaluetruetruejava.lang.String
Performs percent-encoding for a component of a URI, such as a query
parameter name or value, path or query-string. In particular this
method insures that special characters in the component do not get
interpreted as part of another component.
forUriComponentforUriComponentorg.owasp.encoder.tag.ForUriComponentTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for CSS strings. The context must be surrounded by quotation characters.
It is safe for use in both style blocks and attributes in HTML.
forCssStringforCssStringorg.owasp.encoder.tag.ForCssStringTagemptyvalue to be written outvaluetruetruejava.lang.String
Encodes for (X)HTML text content and text attributes.
forHtmlforHtmlorg.owasp.encoder.Encodejava.lang.String forHtml(java.lang.String)forHtml(unsafeData)
This method encodes for HTML text content. It does not escape
quotation characters and is thus unsafe for use with
HTML attributes. Use either forHtml or forHtmlAttribute for those
methods.
forHtmlContentforHtmlContentorg.owasp.encoder.Encodejava.lang.String forHtmlContent(java.lang.String)forHtmlContent(unsafeData)Encodes for HTML text attributes.forHtmlAttributeorg.owasp.encoder.Encodejava.lang.String forHtmlAttribute(java.lang.String)forHtmlAttribute(unsafeData)
Encodes for unquoted HTML attribute values. forHtml(String) or
forHtmlAttribute(String) should usually be preferred over this
method as quoted attributes are XHTML compliant.
forHtmlUnquotedAttributeforHtmlUnquotedAttributeorg.owasp.encoder.Encodejava.lang.String forHtmlUnquotedAttribute(java.lang.String)forHtmlUnquotedAttribute(unsafeData)
Encodes for CSS strings. The context must be surrounded by quotation characters.
It is safe for use in both style blocks and attributes in HTML.
forCssStringforCssStringorg.owasp.encoder.Encodejava.lang.String forCssString(java.lang.String)forCssString(unsafeData)
Encodes for CSS URL contexts. The context must be surrounded by "url()". It
is safe for use in both style blocks and attributes in HTML. Note: this does
not do any checking on the quality or safety of the URL itself. The caller
should insure that the URL is safe for embedding (e.g. input validation) by
other means.
forCssUrlforCssUrlorg.owasp.encoder.Encodejava.lang.String forCssUrl(java.lang.String)forCssUrl(unsafeData)
Performs percent-encoding of a URL according to RFC 3986. The provided
URL is assumed to a valid URL. This method does not do any checking on
the quality or safety of the URL itself. In many applications it may
be better to use java.net.URI instead. Note: this is a
particularly dangerous context to put untrusted content in, as for
example a "javascript:" URL provided by a malicious user would be
"properly" escaped, and still execute.
forUriforUriorg.owasp.encoder.Encodejava.lang.String forUri(java.lang.String)forUri(unsafeData)
Performs percent-encoding for a component of a URI, such as a query
parameter name or value, path or query-string. In particular this
method insures that special characters in the component do not get
interpreted as part of another component.
forUriComponentforUriComponentorg.owasp.encoder.Encodejava.lang.String forUriComponent(java.lang.String)forUriComponent(unsafeData)Encodes for XML and XHTML.forXmlforXmlorg.owasp.encoder.Encodejava.lang.String forXml(java.lang.String)forXml(unsafeData)
Encodes for HTML text content. It does not escape
quotation characters and is thus unsafe for use with
HTML attributes. Use either forHtml or forHtmlAttribute for those
methods.
forXmlContentforXmlContentorg.owasp.encoder.Encodejava.lang.String forXmlContent(java.lang.String)forXmlContent(unsafeData)Encodes for XML and XHTML attribute content.forXmlAttributeforXmlAttributeorg.owasp.encoder.Encodejava.lang.String forXmlAttribute(java.lang.String)forXmlAttribute(unsafeData)
Encodes data for an XML CDATA section. On the chance that the input
contains a terminating
"]]>", it will be replaced by
"]]>]]<
for more information on preventing XSS.
### JSP Usage
The JSP Encoder makes the use of the Java Encoder within JSP simple via a TLD that
includes tags and a set of JSP EL functions:
```xml
org.owasp.encoderencoder-jsp1.2.2
```
```JSP
<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>
<%-- ... --%>
Dynamic data via EL: ${e:forHtml(param.value)}
Dynamic data via tag:
```
owasp-java-encoder-1.2.3/jsp/src/site/site.xml 0000664 0000000 0000000 00000003143 13752037245 0021230 0 ustar 00root root 0000000 0000000
owasp-java-encoder-1.2.3/jsp/src/test/ 0000775 0000000 0000000 00000000000 13752037245 0017554 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/test/java/ 0000775 0000000 0000000 00000000000 13752037245 0020475 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/test/java/org/ 0000775 0000000 0000000 00000000000 13752037245 0021264 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/ 0000775 0000000 0000000 00000000000 13752037245 0022415 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/ 0000775 0000000 0000000 00000000000 13752037245 0024034 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ 0000775 0000000 0000000 00000000000 13752037245 0024607 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/EncodingTagTest.java 0000664 0000000 0000000 00000005623 13752037245 0030502 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
import junit.framework.TestCase;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.mock.web.MockPageContext;
import org.springframework.mock.web.MockServletContext;
/**
* EncodingTagTest is the base class for all unit tests for the tags.
* This sets up the ServletContext so that tags can be tested.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public abstract class EncodingTagTest extends TestCase {
protected MockServletContext _servletContext;
protected MockPageContext _pageContext;
protected MockHttpServletRequest _request;
protected MockHttpServletResponse _response;
/**
* Constructor for the EncodingTagTest
* @param testName the name of the test
*/
public EncodingTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
_servletContext = new MockServletContext();
_request = new MockHttpServletRequest();
_response = new MockHttpServletResponse();
_pageContext = new MockPageContext(_servletContext, _request, _response);
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForCDATATagTest.java 0000664 0000000 0000000 00000005312 13752037245 0030232 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForCDATATag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForCDATATagTest extends EncodingTagTest {
public ForCDATATagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForCDATATag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForCDATATag instance = new ForCDATATag();
String value = "
]]>
";
String expected = "
]]]]>
";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForCssStringTagTest.java 0000664 0000000 0000000 00000005313 13752037245 0031336 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForCssStringTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForCssStringTagTest extends EncodingTagTest {
public ForCssStringTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForCssStringTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForCssStringTag instance = new ForCssStringTag();
String value = "
";
String expected = "\\3c div\\3e";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForCssUrlTagTest.java 0000664 0000000 0000000 00000005266 13752037245 0030641 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForCssUrlTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForCssUrlTagTest extends EncodingTagTest {
public ForCssUrlTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForCssUrlTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForCssUrlTag instance = new ForCssUrlTag();
String value = "\\';";
String expected = "\\5c\\27;";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected, results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlAttributeTagTest.java 0000664 0000000 0000000 00000005337 13752037245 0032215 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForHtmlAttributeTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForHtmlAttributeTagTest extends EncodingTagTest {
public ForHtmlAttributeTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForHtmlAttributeTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForHtmlAttributeTag instance = new ForHtmlAttributeTag();
String value = "
";
String expected = "<div>";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlContentTagTest.java 0000664 0000000 0000000 00000005326 13752037245 0031662 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForHtmlContentTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForHtmlContentTagTest extends EncodingTagTest {
public ForHtmlContentTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForHtmlContentTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForHtmlContentTag instance = new ForHtmlContentTag();
String value = "
";
String expected = "<div>";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlTagTest.java 0000664 0000000 0000000 00000005254 13752037245 0030327 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForHtmlTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForHtmlTagTest extends EncodingTagTest {
public ForHtmlTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForHtmlTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForHtmlTag instance = new ForHtmlTag();
String value = "
";
String expected = "<div>";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
ForHtmlUnquotedAttributeTagTest.java 0000664 0000000 0000000 00000005456 13752037245 0033665 0 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForHtmlUnquotedAttributeTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForHtmlUnquotedAttributeTagTest extends EncodingTagTest {
public ForHtmlUnquotedAttributeTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForHtmlUnquotedAttributeTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForHtmlUnquotedAttributeTag instance = new ForHtmlUnquotedAttributeTag();
String value = "
";
String expected = "<div> </div>";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptAttributeTagTest.java 0000664 0000000 0000000 00000005416 13752037245 0033355 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForJavaScriptAttributeTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForJavaScriptAttributeTagTest extends EncodingTagTest {
public ForJavaScriptAttributeTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForJavaScriptAttributeTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForJavaScriptAttributeTag instance = new ForJavaScriptAttributeTag();
String value = "
\"\'";
String expected = "
\\x22\\x27";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptBlockTagTest.java 0000664 0000000 0000000 00000005357 13752037245 0032450 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForJavaScriptBlockTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForJavaScriptBlockTagTest extends EncodingTagTest {
public ForJavaScriptBlockTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForJavaScriptBlockTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForJavaScriptBlockTag instance = new ForJavaScriptBlockTag();
String value = "'\"\0";
String expected = "\\'\\\"\\x00";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptSourceTagTest.java 0000664 0000000 0000000 00000005365 13752037245 0032655 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForJavaScriptSourceTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForJavaScriptSourceTagTest extends EncodingTagTest {
public ForJavaScriptSourceTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForJavaScriptSourceTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForJavaScriptSourceTag instance = new ForJavaScriptSourceTag();
String value = "\0'\"";
String expected = "\\x00\\'\\\"";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptTagTest.java 0000664 0000000 0000000 00000002336 13752037245 0031467 0 ustar 00root root 0000000 0000000 /*
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/
package org.owasp.encoder.tag;
/**
* Simple tests for the ForJavaScriptTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForJavaScriptTagTest extends EncodingTagTest {
public ForJavaScriptTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForJavaScriptTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForJavaScriptTag instance = new ForJavaScriptTag();
String value = "\0'\"";
String expected = "\\x00\\x27\\x22";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForUriComponentTagTest.java 0000664 0000000 0000000 00000005346 13752037245 0032047 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForUriComponentTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForUriComponentTagTest extends EncodingTagTest {
public ForUriComponentTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForUriComponentTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForUriComponentTag instance = new ForUriComponentTag();
String value = "&=test";
String expected = "%26amp%3B%3Dtest";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForUriTagTest.java 0000664 0000000 0000000 00000005240 13752037245 0030155 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForUriTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForUriTagTest extends EncodingTagTest {
public ForUriTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForUriTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForUriTag instance = new ForUriTag();
String value = "\\\"";
String expected = "%5C%22";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForXmlAttributeTagTest.java 0000664 0000000 0000000 00000005331 13752037245 0032043 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForXmlAttributeTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForXmlAttributeTagTest extends EncodingTagTest {
public ForXmlAttributeTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForXmlAttributeTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForXmlAttributeTag instance = new ForXmlAttributeTag();
String value = "
";
String expected = "<div>";
instance.setJspContext(_pageContext);
instance.setValue(value);
instance.doTag();
String results = _response.getContentAsString();
assertEquals(expected,results);
}
}
owasp-java-encoder-1.2.3/jsp/src/test/java/org/owasp/encoder/tag/ForXmlCommentTagTest.java 0000664 0000000 0000000 00000005400 13752037245 0031477 0 ustar 00root root 0000000 0000000 // Copyright (c) 2012 Jeff Ichnowski
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
//
// * Redistributions of source code must retain the above
// copyright notice, this list of conditions and the following
// disclaimer.
//
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials
// provided with the distribution.
//
// * Neither the name of the OWASP nor the names of its
// contributors may be used to endorse or promote products
// derived from this software without specific prior written
// permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
// OF THE POSSIBILITY OF SUCH DAMAGE.
package org.owasp.encoder.tag;
/**
* Simple tests for the ForXmlCommentTag.
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class ForXmlCommentTagTest extends EncodingTagTest {
public ForXmlCommentTagTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of doTag method, of class ForXmlCommentTag.
* This is a very simple test that doesn't fully
* exercise/test the encoder - only that the
* tag itself works.
* @throws Exception is thrown if the tag fails.
*/
public void testDoTag() throws Exception {
System.out.println("doTag");
ForXmlCommentTag instance = new ForXmlCommentTag();
String value = "-->
4.0.0org.owasp.encoderencoder-parent1.2.3pomOWASP Java Encoder Project
The OWASP Encoders package is a collection of high-performance low-overhead
contextual encoders, that when utilized correctly, is an effective tool in
preventing Web Application security vulnerabilities such as Cross-Site
Scripting.
corejspesapihttps://www.owasp.org/index.php/OWASP_Java_Encoder_Project2011OWASP (Open Web-Application Security Project)https://www.owasp.org/The BSD 3-Clause Licensehttp://www.opensource.org/licenses/BSD-3-Clauserepoorg.sonatype.ossoss-parent9scm:git:git@github.com:owasp/owasp-java-encoder.gitscm:git:git@github.com:owasp/owasp-java-encoder.githttps://github.com/owasp/owasp-java-encodergh-pagesgh-pageshttp://owasp.github.io/owasp-java-encoderOwasp-java-encoder-projecthttps://lists.owasp.org/mailman/listinfo/owasp-java-encoder-projecthttps://lists.owasp.org/mailman/listinfo/owasp-java-encoder-projectowasp-java-encoder-project@lists.owasp.orghttp://lists.owasp.org/pipermail/owasp-java-encoder-project/githubhttps://github.com/owasp/owasp-java-encoder/issuesJeff IchnowskiProject OwnerArchitectDeveloperJim ManicoOWASPhttps://www.owasp.org/ArchitectDeveloperJeremy Longjeremy.long@owasp.orgOWASPhttps://www.owasp.org/developerUTF-8UTF-8junitjunit3.8.2junitjunittestorg.apache.maven.pluginsmaven-compiler-plugin3.5.1org.apache.maven.pluginsmaven-jar-plugin3.0.2org.apache.maven.pluginsmaven-source-plugin3.0.1org.apache.maven.pluginsmaven-javadoc-plugin2.10.4org.codehaus.mojocobertura-maven-plugin2.6org.apache.maven.pluginsmaven-failsafe-plugin2.19.1org.apache.maven.pluginsmaven-surefire-plugin2.19.1org.apache.maven.pluginsmaven-surefire-report-plugin2.19.1org.apache.maven.pluginsmaven-gpg-plugin1.6org.apache.maven.pluginsmaven-site-plugin3.4lt.velykis.maven.skinsreflow-velocity-tools1.1.1org.apache.velocityvelocity1.7org.apache.maven.doxiadoxia-module-markdown1.6org.apache.maven.pluginsmaven-project-info-reports-plugin2.9org.apache.maven.pluginsmaven-pmd-plugin3.6org.apache.felixmaven-bundle-plugin3.3.0org.codehaus.mojoversions-maven-plugin2.3org.apache.maven.pluginsmaven-jxr-plugin2.5org.codehaus.mojofindbugs-maven-plugin3.0.4org.apache.maven.pluginsmaven-compiler-plugin1.51.5org.apache.felixmaven-bundle-plugindefault-bundleprocess-classesmanifesttrue
<_noee>true
<_nouses>true
org.codehaus.mojocobertura-maven-plugin8585false85858585cleanorg.apache.maven.pluginsmaven-surefire-pluginorg/owasp/encoder/BenchmarkTest.java-Xmx1024m -XX:MaxPermSize=256morg.apache.maven.pluginsmaven-jar-plugindefault-jarpackagejartrue${project.build.outputDirectory}/META-INF/MANIFEST.MForg.apache.maven.pluginsmaven-source-pluginattach-sourcespackagejarorg.apache.maven.pluginsmaven-javadoc-pluginattach-javadocspackagejarorg.apache.maven.pluginsmaven-site-pluginorg.apache.maven.pluginsmaven-project-info-reports-pluginindexsummarylicensescmmailing-listissue-trackingdependenciesplugin-managementproject-teamorg.codehaus.mojoversions-maven-plugindependency-updates-reportplugin-updates-reportorg.apache.maven.pluginsmaven-jxr-pluginorg.apache.maven.pluginsmaven-surefire-report-pluginreport-onlyfailsafe-report-onlyorg.codehaus.mojocobertura-maven-pluginorg.apache.maven.pluginsmaven-pmd-plugin1.5trueutf-8org.apache.maven.pluginsmaven-javadoc-plugindefaultjavadocorg.apache.maven.pluginsmaven-checkstyle-pluginsrc/main/config/checkstyle.xmlsrc/main/config/checkstyle-header.txtorg.codehaus.mojofindbugs-maven-pluginsign-artifactsperformReleasetrueorg.apache.maven.pluginsmaven-gpg-pluginsign-artifactsverifysign
owasp-java-encoder-1.2.3/src/ 0000775 0000000 0000000 00000000000 13752037245 0016001 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/src/main/ 0000775 0000000 0000000 00000000000 13752037245 0016725 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/src/main/config/ 0000775 0000000 0000000 00000000000 13752037245 0020172 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/src/main/config/checkstyle-header.txt 0000664 0000000 0000000 00000003430 13752037245 0024317 0 ustar 00root root 0000000 0000000 ^// Copyright \(c\) 201[2-9] (Jeff Ichnowski|Jim Manico|Jeremy Long)\s*$
^// All rights reserved\.\s*$
^//
^// Redistribution and use in source and binary forms, with or without\s*$
^// modification, are permitted provided that the following conditions\s*$
^// are met:\s*$
^//\s*$
^// \* Redistributions of source code must retain the above\s*$
^// copyright notice, this list of conditions and the following\s*$
^// disclaimer\.\s*$
^//
^// \* Redistributions in binary form must reproduce the above\s*$
^// copyright notice, this list of conditions and the following\s*$
^// disclaimer in the documentation and/or other materials\s*$
^// provided with the distribution.\s*$
^//
^// \* Neither the name of the OWASP nor the names of its\s*$
^// contributors may be used to endorse or promote products\s*$
^// derived from this software without specific prior written\s*$
^// permission\.\s*$
^//
^// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\s*$
^// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\s*$
^// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS\s*$
^// FOR A PARTICULAR PURPOSE ARE DISCLAIMED\. IN NO EVENT SHALL THE\s*$
^// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,\s*$
^// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\s*$
^// \(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\s*$
^// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION\)\s*$
^// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\s*$
^// STRICT LIABILITY, OR TORT \(INCLUDING NEGLIGENCE OR OTHERWISE\)\s*$
^// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED\s*$
^// OF THE POSSIBILITY OF SUCH DAMAGE\.\s*$
owasp-java-encoder-1.2.3/src/main/config/checkstyle.xml 0000664 0000000 0000000 00000020335 13752037245 0023055 0 ustar 00root root 0000000 0000000
owasp-java-encoder-1.2.3/src/site/ 0000775 0000000 0000000 00000000000 13752037245 0016745 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/src/site/markdown/ 0000775 0000000 0000000 00000000000 13752037245 0020567 5 ustar 00root root 0000000 0000000 owasp-java-encoder-1.2.3/src/site/markdown/index.md 0000664 0000000 0000000 00000003136 13752037245 0022223 0 ustar 00root root 0000000 0000000 ## OWASP Java Encoder Project
The OWASP Java Encoder Project is a collection of high-performance low-overhead
contextual encoders, that when utilized correctly, is an effective tool in
preventing Web Application security vulnerabilities such as Cross-Site
Scripting (XSS).
Please see the [OWASP XSS Prevention Cheat Sheet](https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet)
for more information on preventing XSS.
### Usage
In addition to the usage guidance below, more examples can be found on the [OWASP Java Encoder Project Wiki](https://www.owasp.org/index.php/OWASP_Java_Encoder_Project#tab=Use_the_Java_Encoder_Project).
The JARs can be found in [Maven Central](https://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.owasp.encoder%22).
```xml
org.owasp.encoderencoder1.2.2
```
Utilize the encoder:
```java
import org.owasp.encoder.Encode;
//...
PrintWriter out = ....;
out.println("");
```
### JSP Usage
The JSP Encoder makes the use of the Java Encoder within JSP simple via a TLD that
includes tags and a set of JSP EL functions:
```xml
org.owasp.encoderencoder-jsp1.2.2
```
```JSP
<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>
<%-- ... --%>
Mocha (older versions of Netscape only):
Livescript
US-ASCII encoding (found by Kurt Huwig ). This uses malformed ASCII encoding with 7 bits instead of 8. This XSS may bypass many content filters but only works if the host transmits in US-ASCII encoding, or if you set the encoding yourself. This is more useful against web application firewall cross site scripting evasion than it is server side filter evasion. Apache Tomcat is the only known server that transmits in US-ASCII encoding. I highly suggest anyone interested in alternate encoding issues look at my charsets issues page: ¼script¾alert(¢XSS¢)¼/script¾ META (the odd thing about meta refresh is that it doesn't send a referrer in the header - so it can be used for certain types of attacks where you need to get rid of referring URLs): META using data: directive URL scheme. This is nice because it also doesn't have anything visibly that has the word SCRIPT or the JavaScript directive in it, because it utilizes base64 encoding. Please see RFC 2397 for more details or go or to encode your own. You can also use the below if you just want to encode raw HTML or JavaScript as it has a Base64 encoding method: META with additional URL parameter . If the target website attempts to see if the URL contains "http://" at the beginning you can evade it with the following technique (Submitted by Moritz Naumann ): IFRAME (if iframes are allowed there are a lot of other XSS problems as well): FRAME (frames have the same sorts of XSS problems as iframes): TABLE (who would have thought tables were XSS targets... except me, of course):
IMG Embedded commands part II - this is more scary because there are absolutely no identifiers that make it look suspicious other than it is not hosted on your own domain. The vector uses a 302 or 304 (others work too) to redirect the image back to a command. So a normal
could actually be an attack vector to run commands as the user who views the image link. Here is the .htaccess (under Apache) line to accomplish the vector (thanks to Timo for part of this):
Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
Cookie manipulation
- admittidly this is pretty obscure but I have seen a few examples where
UTF-7
encoding - if the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following (Thanks to
for this one). Click
for an example (you don't need the charset statement if the user's browser is set to auto-detect and there is no overriding content-types on the page in Internet Explorer and Netscape 8.1 in IE rendering engine mode). This does not work in any modern browser without changing the encoding type which is why it is marked as completely unsupported.
Watchfire found this hole
in Google's custom 404 script.:
+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
XSS using HTML quote encapsulation:
This was tested in IE, your mileage may vary. For performing XSS on sites that allow "
For performing XSS on sites that allow "
Another XSS to evade the same filter, "/1 Introduction 1.1 Background 1.10 Recommended reading 1.2 Audience 1.3 Scope 1.4 History 1.5 Design notes 1.5.1 Serializability of script execution 1.5.2 Compliance with other specifications 1.6 HTML vs XHTML 1.7 Structure of this specification 1.7.1 How to read this specification 1.7.2 Typographic conventions 1.8 A quick introduction to HTML 1.8.1 Writing secure applications with HTML 1.8.2 Common pitfalls to avoid when using the scripting APIs 1.9 Conformance requirements for authors 1.9.1 Presentational markup 1.9.2 Syntax errors 1.9.3 Restrictions on content models and on attribute values 10 Rendering 10.1 Introduction 10.2 The CSS user agent style sheet and presentational hints 10.3 Non-replaced elements 10.3.1 Hidden elements 10.3.10 The