Skip to content

Commit ffddf2b

Browse files
theangrydevtheangrydev
authored
Merge pull request #14656 from manfred106/BAEL-6848-jsp-set-param
BAEL-6848: Set a Parameter in a HttpServletRequest in Java
2 parents 26dd69e + 8d115be commit ffddf2b

13 files changed

Lines changed: 411 additions & 0 deletions

‎web-modules/javax-servlets-2/pom.xml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@
2222
<artifactId>commons-fileupload</artifactId>
2323
<version>${commons-fileupload.version}</version>
2424
</dependency>
25+
<dependency>
26+
<groupId>org.apache.commons</groupId>
27+
<artifactId>commons-text</artifactId>
28+
<version>${commons-text.version}</version>
29+
</dependency>
2530
<!-- Servlet -->
2631
<dependency>
2732
<groupId>javax.servlet</groupId>
@@ -76,6 +81,16 @@
7681
</argLine>
7782
</configuration>
7883
</plugin>
84+
<plugin>
85+
<groupId>org.eclipse.jetty</groupId>
86+
<artifactId>jetty-maven-plugin</artifactId>
87+
<version>${jetty-maven-plugin.version}</version>
88+
<configuration>
89+
<webApp>
90+
<contextPath>/</contextPath>
91+
</webApp>
92+
</configuration>
93+
</plugin>
7994
</plugins>
8095
</build>
8196

@@ -84,6 +99,8 @@
8499
<jmockit.version>1.49</jmockit.version>
85100
<spring-test.version>5.3.20</spring-test.version>
86101
<maven-surefire-plugin.version>2.22.2</maven-surefire-plugin.version>
102+
<jetty-maven-plugin.version>10.0.4</jetty-maven-plugin.version>
103+
<commons-text.version>1.10.0</commons-text.version>
87104
</properties>
88105

89106
</project>

‎web-modules/javax-servlets-2/src/main/java/com/baeldung/setparam/LanguageServlet.java‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
package com.baeldung.setparam;
2+
3+
import java.io.IOException;
4+
import java.util.Locale;
5+
6+
import javax.servlet.ServletException;
7+
import javax.servlet.annotation.WebServlet;
8+
import javax.servlet.http.*;
9+
10+
@WebServlet(name = "LanguageServlet", urlPatterns = "/setparam/lang")
11+
public class LanguageServlet extends HttpServlet {
12+
13+
@Override
14+
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
15+
16+
SetParameterRequestWrapper requestWrapper = new SetParameterRequestWrapper(request);
17+
requestWrapper.setParameter("locale", Locale.getDefault().getLanguage());
18+
request.getRequestDispatcher("/setparam/3rd_party_module.jsp").forward(requestWrapper, response);
19+
}
20+
21+
}

‎web-modules/javax-servlets-2/src/main/java/com/baeldung/setparam/SanitizeParametersFilter.java‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
package com.baeldung.setparam;
2+
3+
import java.io.IOException;
4+
import javax.servlet.*;
5+
import javax.servlet.annotation.WebFilter;
6+
import javax.servlet.http.HttpServletRequest;
7+
8+
@WebFilter(urlPatterns = { "/setparam/with-sanitize.jsp" })
9+
public class SanitizeParametersFilter implements Filter {
10+
11+
@Override
12+
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
13+
HttpServletRequest httpReq = (HttpServletRequest) request;
14+
chain.doFilter(new SanitizeParametersRequestWrapper(httpReq), response);
15+
}
16+
17+
}

‎web-modules/javax-servlets-2/src/main/java/com/baeldung/setparam/SanitizeParametersRequestWrapper.java‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
package com.baeldung.setparam;
2+
3+
import java.util.*;
4+
import java.util.stream.Collectors;
5+
6+
import javax.servlet.http.HttpServletRequest;
7+
import javax.servlet.http.HttpServletRequestWrapper;
8+
9+
import org.apache.commons.text.StringEscapeUtils;
10+
11+
public class SanitizeParametersRequestWrapper extends HttpServletRequestWrapper {
12+
13+
private final Map<String, String[]> sanitizedMap;
14+
15+
public SanitizeParametersRequestWrapper(HttpServletRequest request) {
16+
super(request);
17+
sanitizedMap = Collections.unmodifiableMap(
18+
request.getParameterMap().entrySet().stream()
19+
.collect(Collectors.toMap(
20+
Map.Entry::getKey,
21+
entry -> Arrays.stream(entry.getValue())
22+
.map(StringEscapeUtils::escapeHtml4)
23+
.toArray(String[]::new)
24+
)));
25+
}
26+
27+
@Override
28+
public Map<String, String[]> getParameterMap() {
29+
return sanitizedMap;
30+
}
31+
32+
@Override
33+
public String[] getParameterValues(String name) {
34+
return Optional.ofNullable(getParameterMap().get(name))
35+
.map(values -> Arrays.copyOf(values, values.length))
36+
.orElse(null);
37+
}
38+
39+
@Override
40+
public String getParameter(String name) {
41+
return Optional.ofNullable(getParameterValues(name))
42+
.map(values -> values[0])
43+
.orElse(null);
44+
}
45+
46+
}

‎web-modules/javax-servlets-2/src/main/java/com/baeldung/setparam/SetParameterRequestWrapper.java‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package com.baeldung.setparam;
2+
3+
import java.util.*;
4+
5+
import javax.servlet.http.HttpServletRequest;
6+
import javax.servlet.http.HttpServletRequestWrapper;
7+
8+
public class SetParameterRequestWrapper extends HttpServletRequestWrapper {
9+
10+
private final Map<String, String[]> paramMap;
11+
12+
public SetParameterRequestWrapper(HttpServletRequest request) {
13+
super(request);
14+
paramMap = new HashMap<>(request.getParameterMap());
15+
}
16+
17+
@Override
18+
public Map<String, String[]> getParameterMap() {
19+
return Collections.unmodifiableMap(paramMap);
20+
}
21+
22+
@Override
23+
public String[] getParameterValues(String name) {
24+
return Optional.ofNullable(getParameterMap().get(name))
25+
.map(values -> Arrays.copyOf(values, values.length))
26+
.orElse(null);
27+
}
28+
29+
@Override
30+
public String getParameter(String name) {
31+
return Optional.ofNullable(getParameterValues(name))
32+
.map(values -> values[0])
33+
.orElse(null);
34+
}
35+
36+
public void setParameter(String name, String value) {
37+
paramMap.put(name, new String[] {value});
38+
}
39+
40+
}

‎web-modules/javax-servlets-2/src/main/webapp/setparam/3rd_party_module.jsp‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<%@ page import="java.util.*"%>
2+
<html>
3+
<head>
4+
<title>3rd party Module</title>
5+
</head>
6+
<body>
7+
<%
8+
String localeStr = request.getParameter("locale");
9+
Locale currentLocale = (localeStr != null ? new Locale(localeStr) : null);
10+
%>
11+
The language you have selected: <%=currentLocale != null ? currentLocale.getDisplayLanguage(currentLocale) : " None"%>
12+
</body>
13+
</html>

‎web-modules/javax-servlets-2/src/main/webapp/setparam/with-sanitize.jsp‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<html>
2+
<head>
3+
<title>Sanitized request parameter</title>
4+
</head>
5+
<body>
6+
The text below comes from request parameter "input":
7+
<br/>
8+
<%=request.getParameter("input")%>
9+
</body>
10+
</html>

‎web-modules/javax-servlets-2/src/main/webapp/setparam/without-sanitize.jsp‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<html>
2+
<head>
3+
<title>Non sanitized request parameter</title>
4+
</head>
5+
<body>
6+
The text below comes from request parameter "input":
7+
<br/>
8+
<%=request.getParameter("input")%>
9+
</body>
10+
</html>

‎web-modules/javax-servlets-2/src/test/java/com/baeldung/setparam/LanguageServletIntegrationTest.java‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
package com.baeldung.setparam;
2+
3+
import static org.junit.Assert.assertTrue;
4+
5+
import java.util.Locale;
6+
7+
import org.apache.http.HttpEntity;
8+
import org.apache.http.HttpResponse;
9+
import org.apache.http.client.HttpClient;
10+
import org.apache.http.client.methods.HttpGet;
11+
import org.apache.http.impl.client.HttpClientBuilder;
12+
import org.apache.http.util.EntityUtils;
13+
import org.junit.Test;
14+
15+
public class LanguageServletIntegrationTest {
16+
17+
@Test
18+
public void whenGetRequestUsingHttpClient_thenResponseBodyContainsDefaultLanguage() throws Exception {
19+
20+
// When
21+
HttpClient client = HttpClientBuilder.create().build();
22+
HttpGet method = new HttpGet("http://localhost:8080/setparam/lang");
23+
HttpResponse httpResponse = client.execute(method);
24+
25+
// Then
26+
Locale defaultLocale = Locale.getDefault();
27+
String expectedLanguage = defaultLocale.getDisplayLanguage(defaultLocale);
28+
29+
HttpEntity entity = httpResponse.getEntity();
30+
String responseBody = EntityUtils.toString(entity, "UTF-8");
31+
assertTrue(responseBody.contains("The language you have selected: " + expectedLanguage));
32+
}
33+
34+
}

‎web-modules/javax-servlets-2/src/test/java/com/baeldung/setparam/SanitizeParametersRequestIntegrationTest.java‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package com.baeldung.setparam;
2+
3+
import static org.junit.Assert.assertTrue;
4+
5+
import java.io.UnsupportedEncodingException;
6+
import java.net.URLEncoder;
7+
8+
import org.apache.http.HttpEntity;
9+
import org.apache.http.HttpResponse;
10+
import org.apache.http.client.HttpClient;
11+
import org.apache.http.client.methods.HttpGet;
12+
import org.apache.http.impl.client.HttpClientBuilder;
13+
import org.apache.http.util.EntityUtils;
14+
import org.junit.BeforeClass;
15+
import org.junit.Test;
16+
17+
public class SanitizeParametersRequestIntegrationTest {
18+
19+
private static String PARAM_INPUT;
20+
21+
@BeforeClass
22+
public static void init() throws UnsupportedEncodingException {
23+
PARAM_INPUT = URLEncoder.encode("<script>alert('Hello');</script>", "UTF-8");
24+
}
25+
26+
@Test
27+
public void whenInputParameterContainsXss_thenResponseBodyContainsSanitizedValue() throws Exception {
28+
29+
// When
30+
HttpClient client = HttpClientBuilder.create().build();
31+
HttpGet method = new HttpGet(String.format("http://localhost:8080/setparam/with-sanitize.jsp?input=%s", PARAM_INPUT));
32+
HttpResponse httpResponse = client.execute(method);
33+
34+
// Then
35+
HttpEntity entity = httpResponse.getEntity();
36+
String responseBody = EntityUtils.toString(entity, "UTF-8");
37+
assertTrue(responseBody.contains("&lt;script&gt;alert('Hello');&lt;/script&gt;"));
38+
}
39+
40+
}

0 commit comments

Comments
 (0)