Codestin Search App

- * <button onclick="alert('<%=Encode.forJavaScript(data)%>');"> - * <script type="text/javascript"> - * var data = "<%=Encode.forJavaScript(data)%>"; - * </script> + * <button onclick="alert('<%=Encode.forJavaScript(data)%>');"> + * <script type="text/javascript"> + * var data = "<%=Encode.forJavaScript(data)%>"; + * </script> *

- * <script type="text/javascript"> - * var data = "<%=Encode.forJavaScriptBlock(data)%>"; - * </script> + * <script type="text/javascript"> + * var data = "<%=Encode.forJavaScriptBlock(data)%>"; + * </script> *

- * <%@page contentType="text/javascript; charset=UTF-8"%> - * var data = "<%=Encode.forJavaScriptSource(data)%>"; + * <%@page contentType="text/javascript; charset=UTF-8"%> + * var data = "<%=Encode.forJavaScriptSource(data)%>"; *

- * <%@page contentType="application/json; charset=UTF-8"%> - * <% myapp.jsonHijackingPreventionMeasure(); %> - * {"data":"<%=Encode.forJavaScriptSource(data)%>"} + * <%@page contentType="application/json; charset=UTF-8"%> + * <% myapp.jsonHijackingPreventionMeasure(); %> + * {"data":"<%=Encode.forJavaScriptSource(data)%>"} *

**Encoding Description**
Input Character	Encoded Result	Notes
U+0008	BS	`\b`	Backspace character
U+0008	BS	`\b`	Backspace character
U+0009	HT	`\t`	Horizontal tab character
U+0009	HT	`\t`	Horizontal tab character
U+000A	LF	`\n`	Line feed character
U+000A	LF	`\n`	Line feed character
U+000C	FF	`\f`	Form feed character
U+000C	FF	`\f`	Form feed character
U+000D	CR	`\r`	Carriage return character
U+000D	CR	`\r`	Carriage return character
U+0022	`"`	`\x22`	The encoding `\"` is not used here because + *
U+0022	`"`	`\x22`	The encoding `\"` is not used here because * it is not safe for use in HTML attributes. (In HTML * attributes, it would also be correct to use * "\"".)
U+0026	`&`	`\x26`	Ampersand character
U+0026	`&`	`\x26`	Ampersand character
U+0027	`'`	`\x27`	The encoding `\'` is not used here because + *
U+0027	`'`	`\x27`	The encoding `\'` is not used here because * it is not safe for use in HTML attributes. (In HTML * attributes, it would also be correct to use * "\'".)
U+002F	`/`	`\/`	This encoding is used to avoid an input sequence - * "</" from prematurely terminating a </script> + *
U+002F	`/`	`\/`	This encoding is used to avoid an input sequence + * "</" from prematurely terminating a </script> * block.
U+005C	`\`	`\\`
U+005C	`\`	`\\`
U+0000 to U+001F	`\x##`	Hexadecimal encoding is used for characters in this + *
U+0000 to U+001F	`\x##`	Hexadecimal encoding is used for characters in this * range that were not already mentioned in above.

Encoding Description

Input Character

Encoded Result

Notes

Input Character

Encoded Result

Notes

U+0008

\b

Backspace character

U+0008

\b

Backspace character

U+0009

\t

Horizontal tab character

U+0009

\t

Horizontal tab character

U+000A

\n

Line feed character

U+000A

\n

Line feed character

U+000C

\f

Form feed character

U+000C

\f

Form feed character

U+000D

\r

Carriage return character

U+000D

\r

Carriage return character

U+0022

"

\x22

The encoding \" is not used here because + *

U+0022

"

\x22

The encoding \" is not used here because * it is not safe for use in HTML attributes. (In HTML * attributes, it would also be correct to use * "\"".)

U+0026

&

\x26

Ampersand character

U+0026

&

\x26

Ampersand character

U+0027

'

\x27

The encoding \' is not used here because + *

U+0027

'

\x27

The encoding \' is not used here because * it is not safe for use in HTML attributes. (In HTML * attributes, it would also be correct to use * "\'".)

U+002F

/

\/

This encoding is used to avoid an input sequence - * "</" from prematurely terminating a </script> + *

U+002F

/

\/

This encoding is used to avoid an input sequence + * "</" from prematurely terminating a </script> * block.

U+005C

\

\\

U+005C

\

\\

U+0000 to U+001F

\x##

Hexadecimal encoding is used for characters in this + *

U+0000 to U+001F

\x##

Hexadecimal encoding is used for characters in this * range that were not already mentioned in above.

ID	Name	Description
${item.id}		${e:forHtml(item.description)}

Name

Description

${item.id}

${e:forHtml(item.description)}

"; + String expected = "\\3c div\\3e"; + instance.setJspContext(_pageContext); + instance.setValue(value); + instance.doTag(); + String results = _response.getContentAsString(); + assertEquals(expected,results); + } +} diff --git a/jakarta/src/test/java/org/owasp/encoder/tag/ForCssUrlTagTest.java b/jakarta/src/test/java/org/owasp/encoder/tag/ForCssUrlTagTest.java new file mode 100644 index 0000000..77936c3 --- /dev/null +++ b/jakarta/src/test/java/org/owasp/encoder/tag/ForCssUrlTagTest.java @@ -0,0 +1,77 @@ +// Copyright (c) 2012 Jeff Ichnowski +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions +// are met: +// +// * Redistributions of source code must retain the above +// copyright notice, this list of conditions and the following +// disclaimer. +// +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials +// provided with the distribution. +// +// * Neither the name of the OWASP nor the names of its +// contributors may be used to endorse or promote products +// derived from this software without specific prior written +// permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, +// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +// OF THE POSSIBILITY OF SUCH DAMAGE. + + +package org.owasp.encoder.tag; + +/** + * Simple tests for the ForCssUrlTag. + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class ForCssUrlTagTest extends EncodingTagTest { + + public ForCssUrlTagTest(String testName) { + super(testName); + } + + @Override + protected void setUp() throws Exception { + super.setUp(); + } + + @Override + protected void tearDown() throws Exception { + super.tearDown(); + } + + /** + * Test of doTag method, of class ForCssUrlTag. + * This is a very simple test that doesn't fully + * exercise/test the encoder - only that the + * tag itself works. + * @throws Exception is thrown if the tag fails. + */ + public void testDoTag() throws Exception { + System.out.println("doTag"); + ForCssUrlTag instance = new ForCssUrlTag(); + String value = "\\';"; + String expected = "\\5c\\27;"; + instance.setJspContext(_pageContext); + instance.setValue(value); + instance.doTag(); + String results = _response.getContentAsString(); + assertEquals(expected, results); + } +} diff --git a/jakarta/src/test/java/org/owasp/encoder/tag/ForHtmlAttributeTagTest.java b/jakarta/src/test/java/org/owasp/encoder/tag/ForHtmlAttributeTagTest.java new file mode 100644 index 0000000..3c0c64f --- /dev/null +++ b/jakarta/src/test/java/org/owasp/encoder/tag/ForHtmlAttributeTagTest.java @@ -0,0 +1,77 @@ +// Copyright (c) 2012 Jeff Ichnowski +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions +// are met: +// +// * Redistributions of source code must retain the above +// copyright notice, this list of conditions and the following +// disclaimer. +// +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials +// provided with the distribution. +// +// * Neither the name of the OWASP nor the names of its +// contributors may be used to endorse or promote products +// derived from this software without specific prior written +// permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, +// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +// OF THE POSSIBILITY OF SUCH DAMAGE. + + +package org.owasp.encoder.tag; + +/** + * Simple tests for the ForHtmlAttributeTag. + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class ForHtmlAttributeTagTest extends EncodingTagTest { + + public ForHtmlAttributeTagTest(String testName) { + super(testName); + } + + @Override + protected void setUp() throws Exception { + super.setUp(); + } + + @Override + protected void tearDown() throws Exception { + super.tearDown(); + } + + /** + * Test of doTag method, of class ForHtmlAttributeTag. + * This is a very simple test that doesn't fully + * exercise/test the encoder - only that the + * tag itself works. + * @throws Exception is thrown if the tag fails. + */ + public void testDoTag() throws Exception { + System.out.println("doTag"); + ForHtmlAttributeTag instance = new ForHtmlAttributeTag(); + String value = "

"; + String expected = "<div> </div>"; + instance.setJspContext(_pageContext); + instance.setValue(value); + instance.doTag(); + String results = _response.getContentAsString(); + assertEquals(expected,results); + } +} diff --git a/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptAttributeTagTest.java b/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptAttributeTagTest.java new file mode 100644 index 0000000..ad38c07 --- /dev/null +++ b/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptAttributeTagTest.java @@ -0,0 +1,77 @@ +// Copyright (c) 2012 Jeff Ichnowski +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions +// are met: +// +// * Redistributions of source code must retain the above +// copyright notice, this list of conditions and the following +// disclaimer. +// +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials +// provided with the distribution. +// +// * Neither the name of the OWASP nor the names of its +// contributors may be used to endorse or promote products +// derived from this software without specific prior written +// permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, +// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +// OF THE POSSIBILITY OF SUCH DAMAGE. + + +package org.owasp.encoder.tag; + +/** + * Simple tests for the ForJavaScriptAttributeTag. + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class ForJavaScriptAttributeTagTest extends EncodingTagTest { + + public ForJavaScriptAttributeTagTest(String testName) { + super(testName); + } + + @Override + protected void setUp() throws Exception { + super.setUp(); + } + + @Override + protected void tearDown() throws Exception { + super.tearDown(); + } + + /** + * Test of doTag method, of class ForJavaScriptAttributeTag. + * This is a very simple test that doesn't fully + * exercise/test the encoder - only that the + * tag itself works. + * @throws Exception is thrown if the tag fails. + */ + public void testDoTag() throws Exception { + System.out.println("doTag"); + ForJavaScriptAttributeTag instance = new ForJavaScriptAttributeTag(); + String value = "

\"\'"; + String expected = "

\\x22\\x27"; + instance.setJspContext(_pageContext); + instance.setValue(value); + instance.doTag(); + String results = _response.getContentAsString(); + assertEquals(expected,results); + } +} diff --git a/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptBlockTagTest.java b/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptBlockTagTest.java new file mode 100644 index 0000000..75cf97e --- /dev/null +++ b/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptBlockTagTest.java @@ -0,0 +1,77 @@ +// Copyright (c) 2012 Jeff Ichnowski +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions +// are met: +// +// * Redistributions of source code must retain the above +// copyright notice, this list of conditions and the following +// disclaimer. +// +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials +// provided with the distribution. +// +// * Neither the name of the OWASP nor the names of its +// contributors may be used to endorse or promote products +// derived from this software without specific prior written +// permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, +// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +// OF THE POSSIBILITY OF SUCH DAMAGE. + + +package org.owasp.encoder.tag; + +/** + * Simple tests for the ForJavaScriptBlockTag. + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class ForJavaScriptBlockTagTest extends EncodingTagTest { + + public ForJavaScriptBlockTagTest(String testName) { + super(testName); + } + + @Override + protected void setUp() throws Exception { + super.setUp(); + } + + @Override + protected void tearDown() throws Exception { + super.tearDown(); + } + + /** + * Test of doTag method, of class ForJavaScriptBlockTag. + * This is a very simple test that doesn't fully + * exercise/test the encoder - only that the + * tag itself works. + * @throws Exception is thrown if the tag fails. + */ + public void testDoTag() throws Exception { + System.out.println("doTag"); + ForJavaScriptBlockTag instance = new ForJavaScriptBlockTag(); + String value = "'\"\0"; + String expected = "\\'\\\"\\x00"; + instance.setJspContext(_pageContext); + instance.setValue(value); + instance.doTag(); + String results = _response.getContentAsString(); + assertEquals(expected,results); + } +} diff --git a/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptSourceTagTest.java b/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptSourceTagTest.java new file mode 100644 index 0000000..0ea95fc --- /dev/null +++ b/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptSourceTagTest.java @@ -0,0 +1,77 @@ +// Copyright (c) 2012 Jeff Ichnowski +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions +// are met: +// +// * Redistributions of source code must retain the above +// copyright notice, this list of conditions and the following +// disclaimer. +// +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials +// provided with the distribution. +// +// * Neither the name of the OWASP nor the names of its +// contributors may be used to endorse or promote products +// derived from this software without specific prior written +// permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, +// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +// OF THE POSSIBILITY OF SUCH DAMAGE. + + +package org.owasp.encoder.tag; + +/** + * Simple tests for the ForJavaScriptSourceTag. + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class ForJavaScriptSourceTagTest extends EncodingTagTest { + + public ForJavaScriptSourceTagTest(String testName) { + super(testName); + } + + @Override + protected void setUp() throws Exception { + super.setUp(); + } + + @Override + protected void tearDown() throws Exception { + super.tearDown(); + } + + /** + * Test of doTag method, of class ForJavaScriptSourceTag. + * This is a very simple test that doesn't fully + * exercise/test the encoder - only that the + * tag itself works. + * @throws Exception is thrown if the tag fails. + */ + public void testDoTag() throws Exception { + System.out.println("doTag"); + ForJavaScriptSourceTag instance = new ForJavaScriptSourceTag(); + String value = "\0'\""; + String expected = "\\x00\\'\\\""; + instance.setJspContext(_pageContext); + instance.setValue(value); + instance.doTag(); + String results = _response.getContentAsString(); + assertEquals(expected,results); + } +} diff --git a/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptTagTest.java b/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptTagTest.java new file mode 100644 index 0000000..2d4f67a --- /dev/null +++ b/jakarta/src/test/java/org/owasp/encoder/tag/ForJavaScriptTagTest.java @@ -0,0 +1,46 @@ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ +package org.owasp.encoder.tag; + +/** + * Simple tests for the ForJavaScriptTag. + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class ForJavaScriptTagTest extends EncodingTagTest { + + public ForJavaScriptTagTest(String testName) { + super(testName); + } + + @Override + protected void setUp() throws Exception { + super.setUp(); + } + + @Override + protected void tearDown() throws Exception { + super.tearDown(); + } + + /** + * Test of doTag method, of class ForJavaScriptTag. + * This is a very simple test that doesn't fully + * exercise/test the encoder - only that the + * tag itself works. + * @throws Exception is thrown if the tag fails. + */ + public void testDoTag() throws Exception { + System.out.println("doTag"); + ForJavaScriptTag instance = new ForJavaScriptTag(); + String value = "\0'\""; + String expected = "\\x00\\x27\\x22"; + instance.setJspContext(_pageContext); + instance.setValue(value); + instance.doTag(); + String results = _response.getContentAsString(); + assertEquals(expected,results); + } +} diff --git a/jakarta/src/test/java/org/owasp/encoder/tag/ForUriComponentTagTest.java b/jakarta/src/test/java/org/owasp/encoder/tag/ForUriComponentTagTest.java new file mode 100644 index 0000000..3d9d11c --- /dev/null +++ b/jakarta/src/test/java/org/owasp/encoder/tag/ForUriComponentTagTest.java @@ -0,0 +1,77 @@ +// Copyright (c) 2012 Jeff Ichnowski +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions +// are met: +// +// * Redistributions of source code must retain the above +// copyright notice, this list of conditions and the following +// disclaimer. +// +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials +// provided with the distribution. +// +// * Neither the name of the OWASP nor the names of its +// contributors may be used to endorse or promote products +// derived from this software without specific prior written +// permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, +// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +// OF THE POSSIBILITY OF SUCH DAMAGE. + + +package org.owasp.encoder.tag; + +/** + * Simple tests for the ForUriComponentTag. + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class ForUriComponentTagTest extends EncodingTagTest { + + public ForUriComponentTagTest(String testName) { + super(testName); + } + + @Override + protected void setUp() throws Exception { + super.setUp(); + } + + @Override + protected void tearDown() throws Exception { + super.tearDown(); + } + + /** + * Test of doTag method, of class ForUriComponentTag. + * This is a very simple test that doesn't fully + * exercise/test the encoder - only that the + * tag itself works. + * @throws Exception is thrown if the tag fails. + */ + public void testDoTag() throws Exception { + System.out.println("doTag"); + ForUriComponentTag instance = new ForUriComponentTag(); + String value = "&=test"; + String expected = "%26amp%3B%3Dtest"; + instance.setJspContext(_pageContext); + instance.setValue(value); + instance.doTag(); + String results = _response.getContentAsString(); + assertEquals(expected,results); + } +} diff --git a/jakarta/src/test/java/org/owasp/encoder/tag/ForUriTagTest.java b/jakarta/src/test/java/org/owasp/encoder/tag/ForUriTagTest.java new file mode 100644 index 0000000..ac16812 --- /dev/null +++ b/jakarta/src/test/java/org/owasp/encoder/tag/ForUriTagTest.java @@ -0,0 +1,77 @@ +// Copyright (c) 2012 Jeff Ichnowski +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions +// are met: +// +// * Redistributions of source code must retain the above +// copyright notice, this list of conditions and the following +// disclaimer. +// +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials +// provided with the distribution. +// +// * Neither the name of the OWASP nor the names of its +// contributors may be used to endorse or promote products +// derived from this software without specific prior written +// permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, +// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +// OF THE POSSIBILITY OF SUCH DAMAGE. + + +package org.owasp.encoder.tag; + +/** + * Simple tests for the ForUriTag. + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class ForUriTagTest extends EncodingTagTest { + + public ForUriTagTest(String testName) { + super(testName); + } + + @Override + protected void setUp() throws Exception { + super.setUp(); + } + + @Override + protected void tearDown() throws Exception { + super.tearDown(); + } + + /** + * Test of doTag method, of class ForUriTag. + * This is a very simple test that doesn't fully + * exercise/test the encoder - only that the + * tag itself works. + * @throws Exception is thrown if the tag fails. + */ + public void testDoTag() throws Exception { + System.out.println("doTag"); + ForUriTag instance = new ForUriTag(); + String value = "\\\""; + String expected = "%5C%22"; + instance.setJspContext(_pageContext); + instance.setValue(value); + instance.doTag(); + String results = _response.getContentAsString(); + assertEquals(expected,results); + } +} diff --git a/jakarta/src/test/java/org/owasp/encoder/tag/ForXmlAttributeTagTest.java b/jakarta/src/test/java/org/owasp/encoder/tag/ForXmlAttributeTagTest.java new file mode 100644 index 0000000..4246516 --- /dev/null +++ b/jakarta/src/test/java/org/owasp/encoder/tag/ForXmlAttributeTagTest.java @@ -0,0 +1,77 @@ +// Copyright (c) 2012 Jeff Ichnowski +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions +// are met: +// +// * Redistributions of source code must retain the above +// copyright notice, this list of conditions and the following +// disclaimer. +// +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials +// provided with the distribution. +// +// * Neither the name of the OWASP nor the names of its +// contributors may be used to endorse or promote products +// derived from this software without specific prior written +// permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, +// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +// OF THE POSSIBILITY OF SUCH DAMAGE. + + +package org.owasp.encoder.tag; + +/** + * Simple tests for the ForXmlAttributeTag. + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class ForXmlAttributeTagTest extends EncodingTagTest { + + public ForXmlAttributeTagTest(String testName) { + super(testName); + } + + @Override + protected void setUp() throws Exception { + super.setUp(); + } + + @Override + protected void tearDown() throws Exception { + super.tearDown(); + } + + /** + * Test of doTag method, of class ForXmlAttributeTag. + * This is a very simple test that doesn't fully + * exercise/test the encoder - only that the + * tag itself works. + * @throws Exception is thrown if the tag fails. + */ + public void testDoTag() throws Exception { + System.out.println("doTag"); + ForXmlAttributeTag instance = new ForXmlAttributeTag(); + String value = "

"; + String expected = "<div>"; + instance.setJspContext(_pageContext); + instance.setValue(value); + instance.doTag(); + String results = _response.getContentAsString(); + assertEquals(expected,results); + } +} diff --git a/jakarta/src/test/java/org/owasp/encoder/tag/ForXmlCommentTagTest.java b/jakarta/src/test/java/org/owasp/encoder/tag/ForXmlCommentTagTest.java new file mode 100644 index 0000000..cea3db3 --- /dev/null +++ b/jakarta/src/test/java/org/owasp/encoder/tag/ForXmlCommentTagTest.java @@ -0,0 +1,77 @@ +// Copyright (c) 2012 Jeff Ichnowski +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions +// are met: +// +// * Redistributions of source code must retain the above +// copyright notice, this list of conditions and the following +// disclaimer. +// +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials +// provided with the distribution. +// +// * Neither the name of the OWASP nor the names of its +// contributors may be used to endorse or promote products +// derived from this software without specific prior written +// permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, +// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +// OF THE POSSIBILITY OF SUCH DAMAGE. + + +package org.owasp.encoder.tag; + +/** + * Simple tests for the ForXmlCommentTag. + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class ForXmlCommentTagTest extends EncodingTagTest { + + public ForXmlCommentTagTest(String testName) { + super(testName); + } + + @Override + protected void setUp() throws Exception { + super.setUp(); + } + + @Override + protected void tearDown() throws Exception { + super.tearDown(); + } + + /** + * Test of doTag method, of class ForXmlCommentTag. + * This is a very simple test that doesn't fully + * exercise/test the encoder - only that the + * tag itself works. + * @throws Exception is thrown if the tag fails. + */ + public void testDoTag() throws Exception { + System.out.println("doTag"); + ForXmlCommentTag instance = new ForXmlCommentTag(); + String value = "--> - - JSP - - - - - - \ No newline at end of file diff --git a/jsp/src/test/java/org/owasp/encoder/tag/EncodingTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/EncodingTagTest.java index 10705ae..4f49e8b 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/EncodingTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/EncodingTagTest.java @@ -54,7 +54,7 @@ public abstract class EncodingTagTest extends TestCase { protected MockHttpServletResponse _response; /** - * Contructor for the EncodingTagTest + * Constructor for the EncodingTagTest * @param testName the name of the test */ public EncodingTagTest(String testName) { diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForCDATATagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForCDATATagTest.java index 1720d4e..c8e3847 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForCDATATagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForCDATATagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForCDATATag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ @@ -67,7 +67,7 @@ public void testDoTag() throws Exception { System.out.println("doTag"); ForCDATATag instance = new ForCDATATag(); String value = "

]]>

"; - String expected = "

]]>]]

"; + String expected = "

]]]]>

"; instance.setJspContext(_pageContext); instance.setValue(value); instance.doTag(); diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForCssStringTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForCssStringTagTest.java index 7a79d40..0c9d6e8 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForCssStringTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForCssStringTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForCssStringTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForCssUrlTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForCssUrlTagTest.java index c787988..77936c3 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForCssUrlTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForCssUrlTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForCssUrlTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlAttributeTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlAttributeTagTest.java index 34d63fc..3c0c64f 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlAttributeTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlAttributeTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForHtmlAttributeTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlContentTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlContentTagTest.java index 9a9703c..ef6e389 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlContentTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlContentTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForHtmlContentTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlTagTest.java index 9f73173..03897a7 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForHtmlTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlUnquotedAttributeTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlUnquotedAttributeTagTest.java index 4d1cae0..bce53a4 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlUnquotedAttributeTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForHtmlUnquotedAttributeTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForHtmlUnquotedAttributeTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptAttributeTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptAttributeTagTest.java index 6829820..ad38c07 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptAttributeTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptAttributeTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForJavaScriptAttributeTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptBlockTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptBlockTagTest.java index 79d7163..75cf97e 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptBlockTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptBlockTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForJavaScriptBlockTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptSourceTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptSourceTagTest.java index 400c8d9..0ea95fc 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptSourceTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptSourceTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForJavaScriptSourceTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptTagTest.java index c7427a7..2d4f67a 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForJavaScriptTagTest.java @@ -28,7 +28,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForJavaScriptTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForUriComponentTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForUriComponentTagTest.java index 6709cde..3d9d11c 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForUriComponentTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForUriComponentTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForUriComponentTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForUriTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForUriTagTest.java index d401d89..ac16812 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForUriTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForUriTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForUriTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForXmlAttributeTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForXmlAttributeTagTest.java index ec42f28..4246516 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForXmlAttributeTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForXmlAttributeTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForXmlAttributeTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForXmlCommentTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForXmlCommentTagTest.java index cf5182a..cea3db3 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForXmlCommentTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForXmlCommentTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForXmlCommentTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForXmlContentTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForXmlContentTagTest.java index 1efd061..536c265 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForXmlContentTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForXmlContentTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForXmlContentTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/jsp/src/test/java/org/owasp/encoder/tag/ForXmlTagTest.java b/jsp/src/test/java/org/owasp/encoder/tag/ForXmlTagTest.java index 59d54dc..b55d2be 100644 --- a/jsp/src/test/java/org/owasp/encoder/tag/ForXmlTagTest.java +++ b/jsp/src/test/java/org/owasp/encoder/tag/ForXmlTagTest.java @@ -59,7 +59,7 @@ protected void tearDown() throws Exception { /** * Test of doTag method, of class ForXmlTag. * This is a very simple test that doesn't fully - * excersize/test the encoder - only that the + * exercise/test the encoder - only that the * tag itself works. * @throws Exception is thrown if the tag fails. */ diff --git a/pom.xml b/pom.xml index bb9d7a3..deacc07 100755 --- a/pom.xml +++ b/pom.xml @@ -1,5 +1,4 @@ - 3.4 + + + lt.velykis.maven.skins + reflow-velocity-tools + 1.1.1 + + + + org.apache.velocity + velocity + 1.7 + + + org.apache.maven.doxia + doxia-module-markdown + 1.6 + + org.apache.maven.plugins maven-project-info-reports-plugin - 2.8 + 2.9 org.apache.maven.plugins maven-pmd-plugin - 3.4 + 3.6 + + + org.apache.felix + maven-bundle-plugin + 3.5.1 org.codehaus.mojo versions-maven-plugin - 2.1 + 2.3 org.apache.maven.plugins @@ -233,7 +257,7 @@ org.codehaus.mojo findbugs-maven-plugin - 3.0.0 + 3.0.4 @@ -242,30 +266,65 @@ org.apache.maven.plugins maven-compiler-plugin - - 1.5 - 1.5 - + + + compile-java-8 + + compile + + + 8 + + + + compile-java-9 + compile + + compile + + + 9 + + ${project.basedir}/src/main/java9 + + true + + + - org.codehaus.mojo - cobertura-maven-plugin - - - 85 - 85 - false - 85 - 85 - 85 - 85 - - + org.apache.felix + maven-bundle-plugin + default-bundle + process-classes - clean + manifest + + true + + <_noee>true + <_nouses>true + ${jigsaw.module.name} + + + + + + + org.jacoco + jacoco-maven-plugin + + + prepare-agent + + prepare-agent + + + surefireArgLine + @@ -276,6 +335,19 @@ org/owasp/encoder/BenchmarkTest.java + ${surefireArgLine} + + + + org.apache.maven.plugins + maven-jar-plugin + + + ${project.build.outputDirectory}/META-INF/MANIFEST.MF + + true + + @@ -294,6 +366,10 @@ org.apache.maven.plugins maven-javadoc-plugin + + 8 + false + attach-javadocs @@ -307,16 +383,6 @@ org.apache.maven.plugins maven-site-plugin - - - org.apache.maven.doxia - doxia-module-markdown - 1.6 - - - - true - @@ -370,14 +436,22 @@ - org.codehaus.mojo - cobertura-maven-plugin + org.jacoco + jacoco-maven-plugin + + + + + report + + + org.apache.maven.plugins maven-pmd-plugin - 1.5 + 1.8 true utf-8 @@ -391,6 +465,10 @@ javadoc + + 8 + false + @@ -435,5 +513,14 @@ + + testJakarta + + false + + + jakarta-test + + diff --git a/src/main/config/checkstyle.xml b/src/main/config/checkstyle.xml index cb56d07..3f2c8b6 100644 --- a/src/main/config/checkstyle.xml +++ b/src/main/config/checkstyle.xml @@ -25,9 +25,17 @@ - + + + + + - + + + + + @@ -75,12 +83,6 @@ - - - - - - @@ -93,7 +95,7 @@ - + @@ -145,7 +147,7 @@ --> - + diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md new file mode 100644 index 0000000..0273e4f --- /dev/null +++ b/src/site/markdown/index.md @@ -0,0 +1,56 @@ +## OWASP Java Encoder Project + +The OWASP Java Encoder Project is a collection of high-performance low-overhead +contextual encoders, that when utilized correctly, is an effective tool in +preventing Web Application security vulnerabilities such as Cross-Site +Scripting (XSS). + +Please see the [OWASP XSS Prevention Cheat Sheet](https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet) +for more information on preventing XSS. + +### Usage + +In addition to the usage guidance below, more examples can be found on the [OWASP Java Encoder Project Wiki](https://www.owasp.org/index.php/OWASP_Java_Encoder_Project#tab=Use_the_Java_Encoder_Project). + +The JARs can be found in [Maven Central](https://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.owasp.encoder%22). + +```xml + + org.owasp.encoder + encoder + 1.2.3 + +``` + +Utilize the encoder: + +```java +import org.owasp.encoder.Encode; + +//... + +PrintWriter out = ....; +out.println(""); +``` + +### JSP Usage + +The JSP Encoder makes the use of the Java Encoder within JSP simple via a TLD that +includes tags and a set of JSP EL functions: + +```xml + + org.owasp.encoder + encoder-jsp + 1.2.3 + +``` + +```JSP +<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %> + +<%-- ... --%> + +

Dynamic data via EL: ${e:forHtml(param.value)}

Dynamic data via tag:

+``` diff --git a/src/site/resources/images/owasp.jpg b/src/site/resources/images/owasp.jpg new file mode 100644 index 0000000..addae89 Binary files /dev/null and b/src/site/resources/images/owasp.jpg differ diff --git a/src/site/site.xml b/src/site/site.xml index a389c70..f1d4a83 100644 --- a/src/site/site.xml +++ b/src/site/site.xml @@ -37,56 +37,56 @@ OF THE POSSIBILITY OF SUCH DAMAGE. --> - org.apache.maven.skins - maven-fluido-skin - 1.3.1 + lt.velykis.maven.skins + reflow-maven-skin + 1.1.1 - - - true - true - - owasp/owasp-java-encoder - right - gray - - - - - + + + OWASP Java Encoder Project + Codestin Search App OWASP Java Encoder Project - + ./images/owasp.jpg + 107 + 300 - - - - - - - + + + default + true + github + + ${project.name} + https://www.owasp.org/index.php/OWASP_Java_Encoder_Project + + false + top + 6 + Modules|Maven Documentation + + Modules + Contribute + Maven Documentation + + + + + + - - - - - - - - - - - - - + + + + + + + + + + + +

Example JSP Usage:

Encoding Description

Example JSP Usage:

Example JSP Usage:

Example JSP Usage:

Hello World!