FindProfile_i.java

package org.owasp.webgoat.lessons.instructor.CrossSiteScripting;

import java.util.regex.Pattern;
import org.owasp.webgoat.lessons.CrossSiteScripting.FindProfile;
import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
import org.owasp.webgoat.lessons.GoatHillsFinancial.LessonAction;
import org.owasp.webgoat.session.ParameterNotFoundException;
import org.owasp.webgoat.session.ValidationException;
import org.owasp.webgoat.session.WebSession;


// STAGE 5 FIXES
// Solution Summary: Edit FindProfile.java and change getRequestParameter().
// Modify getRequestParameter() with lines denoted by // STAGE 5 - FIX.
// Solution Steps:
// 1. Talk about the different parser methods. We could have used the parser method that takes a
// regular expression.
// 2. Call validate on the request parameter.
// return validate(s.getParser().getRawParameter(name), (Pattern) patterns.get(name));
//
// Note: patterns.get(name) is used to fetch the XSS validation pattern that is defined
// in FindProfile.Java
//          
// protected static Map patterns = new HashMap();
// static
// {
// patterns.put(CrossSiteScripting.SEARCHNAME, Pattern.compile("[a-zA-Z ]{0,20}"));
// }



public class FindProfile_i extends FindProfile
{
    public FindProfile_i(GoatHillsFinancial lesson, String lessonName, String actionName, LessonAction chainedAction)
    {
        super(lesson, lessonName, actionName, chainedAction);
    }

    protected String getRequestParameter(WebSession s, String name) throws ParameterNotFoundException,
            ValidationException
    {
        // NOTE:
        //
        // In order for this to work generically, the name of the parameter and the name
        // of the regular expression validation patter must be the same.
        // 
        // Another way this could be done is to use the reguler expression method in the
        // ParameterParser class

        // STAGE 5 - FIX
        return validate(s.getParser().getRawParameter(name), (Pattern) patterns.get(name));

        // Note the design goal here...
        // return s.getParser().getStringParameter(name), (Pattern) patterns.get(name));
    }

}