Skip to content

Commit 25a20f2

Browse files
davewichersdavewichers
committed
Fix some more unintended XSS vulns.
1 parent c3a5dbd commit 25a20f2

File tree

734 files changed

+4833
-4789
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

734 files changed

+4833
-4789
lines changed

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00001.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,8 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
7575
response.getWriter().write(org.owasp.esapi.ESAPI.encoder().encodeForHTML(new String(b,0,size)));
7676
} catch (Exception e) {
7777
System.out.println("Couldn't open FileInputStream on file: '" + fileName + "'");
78-
response.getWriter().write("Problem getting FileInputStream: " + e.getMessage());
78+
response.getWriter().write("Problem getting FileInputStream: "
79+
+ org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));
7980
} finally {
8081
if (fis != null) {
8182
try {

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00054.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,11 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
6262

6363

6464
String bar = "safe!";
65-
java.util.HashMap<String,Object> map17757 = new java.util.HashMap<String,Object>();
66-
map17757.put("keyA-17757", "a Value"); // put some stuff in the collection
67-
map17757.put("keyB-17757", param); // put it in a collection
68-
map17757.put("keyC", "another Value"); // put some stuff in the collection
69-
bar = (String)map17757.get("keyB-17757"); // get it back out
65+
java.util.HashMap<String,Object> map25110 = new java.util.HashMap<String,Object>();
66+
map25110.put("keyA-25110", "a Value"); // put some stuff in the collection
67+
map25110.put("keyB-25110", param); // put it in a collection
68+
map25110.put("keyC", "another Value"); // put some stuff in the collection
69+
bar = (String)map25110.get("keyB-25110"); // get it back out
7070

7171

7272
// Code based on example from:

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00055.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,11 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
6262

6363

6464
String bar = "safe!";
65-
java.util.HashMap<String,Object> map51918 = new java.util.HashMap<String,Object>();
66-
map51918.put("keyA-51918", "a Value"); // put some stuff in the collection
67-
map51918.put("keyB-51918", param); // put it in a collection
68-
map51918.put("keyC", "another Value"); // put some stuff in the collection
69-
bar = (String)map51918.get("keyB-51918"); // get it back out
65+
java.util.HashMap<String,Object> map30297 = new java.util.HashMap<String,Object>();
66+
map30297.put("keyA-30297", "a Value"); // put some stuff in the collection
67+
map30297.put("keyB-30297", param); // put it in a collection
68+
map30297.put("keyC", "another Value"); // put some stuff in the collection
69+
bar = (String)map30297.get("keyB-30297"); // get it back out
7070

7171

7272
// Code based on example from:

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00056.java

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -62,20 +62,20 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
6262

6363

6464
// Chain a bunch of propagators in sequence
65-
String a3441 = param; //assign
66-
StringBuilder b3441 = new StringBuilder(a3441); // stick in stringbuilder
67-
b3441.append(" SafeStuff"); // append some safe content
68-
b3441.replace(b3441.length()-"Chars".length(),b3441.length(),"Chars"); //replace some of the end content
69-
java.util.HashMap<String,Object> map3441 = new java.util.HashMap<String,Object>();
70-
map3441.put("key3441", b3441.toString()); // put in a collection
71-
String c3441 = (String)map3441.get("key3441"); // get it back out
72-
String d3441 = c3441.substring(0,c3441.length()-1); // extract most of it
73-
String e3441 = new String( new sun.misc.BASE64Decoder().decodeBuffer(
74-
new sun.misc.BASE64Encoder().encode( d3441.getBytes() ) )); // B64 encode and decode it
75-
String f3441 = e3441.split(" ")[0]; // split it on a space
65+
String a22167 = param; //assign
66+
StringBuilder b22167 = new StringBuilder(a22167); // stick in stringbuilder
67+
b22167.append(" SafeStuff"); // append some safe content
68+
b22167.replace(b22167.length()-"Chars".length(),b22167.length(),"Chars"); //replace some of the end content
69+
java.util.HashMap<String,Object> map22167 = new java.util.HashMap<String,Object>();
70+
map22167.put("key22167", b22167.toString()); // put in a collection
71+
String c22167 = (String)map22167.get("key22167"); // get it back out
72+
String d22167 = c22167.substring(0,c22167.length()-1); // extract most of it
73+
String e22167 = new String( new sun.misc.BASE64Decoder().decodeBuffer(
74+
new sun.misc.BASE64Encoder().encode( d22167.getBytes() ) )); // B64 encode and decode it
75+
String f22167 = e22167.split(" ")[0]; // split it on a space
7676
org.owasp.benchmark.helpers.ThingInterface thing = org.owasp.benchmark.helpers.ThingFactory.createThing();
77-
String g3441 = "barbarians_at_the_gate"; // This is static so this whole flow is 'safe'
78-
String bar = thing.doSomething(g3441); // reflection
77+
String g22167 = "barbarians_at_the_gate"; // This is static so this whole flow is 'safe'
78+
String bar = thing.doSomething(g22167); // reflection
7979

8080

8181
// Code based on example from:

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00058.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,11 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
6262

6363

6464
String bar = "safe!";
65-
java.util.HashMap<String,Object> map40361 = new java.util.HashMap<String,Object>();
66-
map40361.put("keyA-40361", "a Value"); // put some stuff in the collection
67-
map40361.put("keyB-40361", param); // put it in a collection
68-
map40361.put("keyC", "another Value"); // put some stuff in the collection
69-
bar = (String)map40361.get("keyB-40361"); // get it back out
65+
java.util.HashMap<String,Object> map68278 = new java.util.HashMap<String,Object>();
66+
map68278.put("keyA-68278", "a Value"); // put some stuff in the collection
67+
map68278.put("keyB-68278", param); // put it in a collection
68+
map68278.put("keyC", "another Value"); // put some stuff in the collection
69+
bar = (String)map68278.get("keyB-68278"); // get it back out
7070

7171

7272
// Code based on example from:

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00068.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -62,12 +62,12 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
6262

6363

6464
String bar = "safe!";
65-
java.util.HashMap<String,Object> map32721 = new java.util.HashMap<String,Object>();
66-
map32721.put("keyA-32721", "a_Value"); // put some stuff in the collection
67-
map32721.put("keyB-32721", param); // put it in a collection
68-
map32721.put("keyC", "another_Value"); // put some stuff in the collection
69-
bar = (String)map32721.get("keyB-32721"); // get it back out
70-
bar = (String)map32721.get("keyA-32721"); // get safe value back out
65+
java.util.HashMap<String,Object> map3191 = new java.util.HashMap<String,Object>();
66+
map3191.put("keyA-3191", "a_Value"); // put some stuff in the collection
67+
map3191.put("keyB-3191", param); // put it in a collection
68+
map3191.put("keyC", "another_Value"); // put some stuff in the collection
69+
bar = (String)map3191.get("keyB-3191"); // get it back out
70+
bar = (String)map3191.get("keyA-3191"); // get safe value back out
7171

7272

7373
org.owasp.benchmark.helpers.LDAPManager ads = new org.owasp.benchmark.helpers.LDAPManager();

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00069.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,8 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
6161
}
6262

6363

64-
StringBuilder sbxyz4183 = new StringBuilder(param);
65-
String bar = sbxyz4183.append("_SafeStuff").toString();
64+
StringBuilder sbxyz78173 = new StringBuilder(param);
65+
String bar = sbxyz78173.append("_SafeStuff").toString();
6666

6767

6868
java.security.Provider[] provider = java.security.Security.getProviders();

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00070.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -62,12 +62,12 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
6262

6363

6464
String bar = "safe!";
65-
java.util.HashMap<String,Object> map27057 = new java.util.HashMap<String,Object>();
66-
map27057.put("keyA-27057", "a_Value"); // put some stuff in the collection
67-
map27057.put("keyB-27057", param); // put it in a collection
68-
map27057.put("keyC", "another_Value"); // put some stuff in the collection
69-
bar = (String)map27057.get("keyB-27057"); // get it back out
70-
bar = (String)map27057.get("keyA-27057"); // get safe value back out
65+
java.util.HashMap<String,Object> map3008 = new java.util.HashMap<String,Object>();
66+
map3008.put("keyA-3008", "a_Value"); // put some stuff in the collection
67+
map3008.put("keyB-3008", param); // put it in a collection
68+
map3008.put("keyC", "another_Value"); // put some stuff in the collection
69+
bar = (String)map3008.get("keyB-3008"); // get it back out
70+
bar = (String)map3008.get("keyA-3008"); // get safe value back out
7171

7272

7373
java.security.Provider[] provider = java.security.Security.getProviders();

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00075.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -62,12 +62,12 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
6262

6363

6464
String bar = "safe!";
65-
java.util.HashMap<String,Object> map11448 = new java.util.HashMap<String,Object>();
66-
map11448.put("keyA-11448", "a_Value"); // put some stuff in the collection
67-
map11448.put("keyB-11448", param); // put it in a collection
68-
map11448.put("keyC", "another_Value"); // put some stuff in the collection
69-
bar = (String)map11448.get("keyB-11448"); // get it back out
70-
bar = (String)map11448.get("keyA-11448"); // get safe value back out
65+
java.util.HashMap<String,Object> map25859 = new java.util.HashMap<String,Object>();
66+
map25859.put("keyA-25859", "a_Value"); // put some stuff in the collection
67+
map25859.put("keyB-25859", param); // put it in a collection
68+
map25859.put("keyC", "another_Value"); // put some stuff in the collection
69+
bar = (String)map25859.get("keyB-25859"); // get it back out
70+
bar = (String)map25859.get("keyA-25859"); // get safe value back out
7171

7272

7373
try {

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00092.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,11 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
6262

6363

6464
String bar = "safe!";
65-
java.util.HashMap<String,Object> map93520 = new java.util.HashMap<String,Object>();
66-
map93520.put("keyA-93520", "a Value"); // put some stuff in the collection
67-
map93520.put("keyB-93520", param); // put it in a collection
68-
map93520.put("keyC", "another Value"); // put some stuff in the collection
69-
bar = (String)map93520.get("keyB-93520"); // get it back out
65+
java.util.HashMap<String,Object> map45182 = new java.util.HashMap<String,Object>();
66+
map45182.put("keyA-45182", "a Value"); // put some stuff in the collection
67+
map45182.put("keyB-45182", param); // put it in a collection
68+
map45182.put("keyC", "another Value"); // put some stuff in the collection
69+
bar = (String)map45182.get("keyB-45182"); // get it back out
7070

7171

7272
response.getWriter().println(bar);

0 commit comments

Comments
 (0)