/*
*Copyright 2014 Google Inc. All rights reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
* in compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License
* is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
* or implied. See the License for the specific language governing permissions and limitations under
* the License.
*/
package com.google.testing.security.firingrange.tests.tags;
import com.google.common.base.Strings;
import com.google.testing.security.firingrange.utils.Responses;
import java.io.IOException;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* This servlet will filter any tag but will be pierced by multiline requests.
* Sample Payload: \r\n\r\n<script>alert(/1/)</script>
*/
public class Multiline extends HttpServlet {
private static final Pattern TAG_FILTER = Pattern.compile("^.*<.*>.*$");
@Override
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
String query = Strings.nullToEmpty(request.getParameter("q"));
Matcher matcher = TAG_FILTER.matcher(query);
if (matcher.matches()) {
String error = "Invalid input, contains tags.";
response.sendError(400, error);
return;
}
String body = String.format("<html><body>%s</body></html>", query);
Responses.sendXssed(response, body);
}
}