1+ package com .vuln .v2 .controller ;
2+
13import java .io .BufferedReader ;
24import java .io .InputStream ;
35import java .io .InputStreamReader ;
@@ -27,9 +29,10 @@ public static void main(String[] args) throws Exception {
2729 + " for $user in doc(\" users.xml\" )/Users/User[name=$name] return $user/password" ;
2830 conn = xqds .getConnection ();
2931 XQExpression expr = conn .createExpression ();
30- expr .bindString (new QName ("name" ), name , conn .createAtomicType (XQItemType .XQBASETYPE_STRING ));
32+ expr .bindString (new QName ("name" ), name ,
33+ conn .createAtomicType (XQItemType .XQBASETYPE_STRING ));
3134 XQResultSequence result = expr .executeQuery (query );
32- while (result .next ()){
35+ while (result .next ()) {
3336 System .out .println (result .getItemAsString (null ));
3437 }
3538 } catch (XQException e ) {
@@ -42,10 +45,11 @@ public void testRequestbad(HttpServletRequest request) throws Exception {
4245 String name = request .getParameter ("name" );
4346 XQDataSource ds = new SaxonXQDataSource ();
4447 XQConnection conn = ds .getConnection ();
45- String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + name + "'] return $user/password" ;
48+ String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + name
49+ + "'] return $user/password" ;
4650 XQPreparedExpression xqpe = conn .prepareExpression (query );
4751 XQResultSequence result = xqpe .executeQuery ();
48- while (result .next ()){
52+ while (result .next ()) {
4953 System .out .println (result .getItemAsString (null ));
5054 }
5155 }
@@ -54,11 +58,12 @@ public void testRequestbad(HttpServletRequest request) throws Exception {
5458 public void testRequestbad1 (HttpServletRequest request ) throws Exception {
5559 String name = request .getParameter ("name" );
5660 XQDataSource xqds = new SaxonXQDataSource ();
57- String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + name + "'] return $user/password" ;
61+ String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + name
62+ + "'] return $user/password" ;
5863 XQConnection conn = xqds .getConnection ();
5964 XQExpression expr = conn .createExpression ();
6065 XQResultSequence result = expr .executeQuery (query );
61- while (result .next ()){
66+ while (result .next ()) {
6267 System .out .println (result .getItemAsString (null ));
6368 }
6469 }
@@ -68,22 +73,24 @@ public void testRequestbad1(HttpServletRequest request) throws Exception {
6873 public void testStringtbad (@ RequestParam String nameStr ) throws XQException {
6974 XQDataSource ds = new SaxonXQDataSource ();
7075 XQConnection conn = ds .getConnection ();
71- String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + nameStr + "'] return $user/password" ;
76+ String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + nameStr
77+ + "'] return $user/password" ;
7278 XQPreparedExpression xqpe = conn .prepareExpression (query );
7379 XQResultSequence result = xqpe .executeQuery ();
74- while (result .next ()){
80+ while (result .next ()) {
7581 System .out .println (result .getItemAsString (null ));
7682 }
7783 }
7884
7985 @ RequestMapping
8086 public void testStringtbad1 (@ RequestParam String nameStr ) throws XQException {
8187 XQDataSource xqds = new SaxonXQDataSource ();
82- String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + nameStr + "'] return $user/password" ;
88+ String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + nameStr
89+ + "'] return $user/password" ;
8390 XQConnection conn = xqds .getConnection ();
8491 XQExpression expr = conn .createExpression ();
8592 XQResultSequence result = expr .executeQuery (query );
86- while (result .next ()){
93+ while (result .next ()) {
8794 System .out .println (result .getItemAsString (null ));
8895 }
8996 }
@@ -95,7 +102,7 @@ public void testInputStreambad(HttpServletRequest request) throws Exception {
95102 XQConnection conn = ds .getConnection ();
96103 XQPreparedExpression xqpe = conn .prepareExpression (name );
97104 XQResultSequence result = xqpe .executeQuery ();
98- while (result .next ()){
105+ while (result .next ()) {
99106 System .out .println (result .getItemAsString (null ));
100107 }
101108 }
@@ -107,7 +114,7 @@ public void testInputStreambad1(HttpServletRequest request) throws Exception {
107114 XQConnection conn = xqds .getConnection ();
108115 XQExpression expr = conn .createExpression ();
109116 XQResultSequence result = expr .executeQuery (name );
110- while (result .next ()){
117+ while (result .next ()) {
111118 System .out .println (result .getItemAsString (null ));
112119 }
113120 }
@@ -120,7 +127,7 @@ public void testReaderbad(HttpServletRequest request) throws Exception {
120127 XQConnection conn = ds .getConnection ();
121128 XQPreparedExpression xqpe = conn .prepareExpression (br );
122129 XQResultSequence result = xqpe .executeQuery ();
123- while (result .next ()){
130+ while (result .next ()) {
124131 System .out .println (result .getItemAsString (null ));
125132 }
126133 }
@@ -133,11 +140,26 @@ public void testReaderbad1(HttpServletRequest request) throws Exception {
133140 XQConnection conn = xqds .getConnection ();
134141 XQExpression expr = conn .createExpression ();
135142 XQResultSequence result = expr .executeQuery (br );
136- while (result .next ()){
143+ while (result .next ()) {
137144 System .out .println (result .getItemAsString (null ));
138145 }
139146 }
140147
148+ @ RequestMapping
149+ public void testExecuteCommandbad (HttpServletRequest request ) throws Exception {
150+ String name = request .getParameter ("name" );
151+ XQDataSource xqds = new SaxonXQDataSource ();
152+ XQConnection conn = xqds .getConnection ();
153+ XQExpression expr = conn .createExpression ();
154+ //bad code
155+ expr .executeCommand (name );
156+ //bad code
157+ InputStream is = request .getInputStream ();
158+ BufferedReader br = new BufferedReader (new InputStreamReader (is ));
159+ expr .executeCommand (br );
160+ expr .close ();
161+ }
162+
141163 @ RequestMapping
142164 public void good (HttpServletRequest request ) throws XQException {
143165 String name = request .getParameter ("name" );
@@ -146,9 +168,10 @@ public void good(HttpServletRequest request) throws XQException {
146168 String query = "declare variable $name as xs:string external;"
147169 + " for $user in doc(\" users.xml\" )/Users/User[name=$name] return $user/password" ;
148170 XQPreparedExpression xqpe = conn .prepareExpression (query );
149- xqpe .bindString (new QName ("name" ), name , conn .createAtomicType (XQItemType .XQBASETYPE_STRING ));
171+ xqpe .bindString (new QName ("name" ), name ,
172+ conn .createAtomicType (XQItemType .XQBASETYPE_STRING ));
150173 XQResultSequence result = xqpe .executeQuery ();
151- while (result .next ()){
174+ while (result .next ()) {
152175 System .out .println (result .getItemAsString (null ));
153176 }
154177 }
@@ -161,10 +184,12 @@ public void good1(HttpServletRequest request) throws XQException {
161184 XQDataSource xqds = new SaxonXQDataSource ();
162185 XQConnection conn = xqds .getConnection ();
163186 XQExpression expr = conn .createExpression ();
164- expr .bindString (new QName ("name" ), name , conn .createAtomicType (XQItemType .XQBASETYPE_STRING ));
187+ expr .bindString (new QName ("name" ), name ,
188+ conn .createAtomicType (XQItemType .XQBASETYPE_STRING ));
165189 XQResultSequence result = expr .executeQuery (query );
166- while (result .next ()){
190+ while (result .next ()) {
167191 System .out .println (result .getItemAsString (null ));
168192 }
169193 }
170- }
194+ }
195+
0 commit comments