This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For + * details, please see https://owasp.org/www-project-benchmark/. + * + *
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms + * of the GNU General Public License as published by the Free Software Foundation, version 2. + * + *
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR + * PURPOSE. See the GNU General Public License for more details. + * + * @author Nick Sanidas + * @created 2015 + */ +package org.owasp.benchmark.testcode; + + +import java.io.IOException; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +@WebServlet(value = "/xss-00/BenchmarkTest02741") +public class BenchmarkTest02741 extends SanitizingHttpServlet { + + private static final long serialVersionUID = 1L; + + @Override + public void doPost(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + response.setContentType("text/html;charset=UTF-8"); + response.setHeader("X-XSS-Protection", "0"); + + String param = request.getParameter("email"); + if (param == null) param = ""; + String sanitizeParam = sanitizeAttribute(param); + + String htmlResponse = ""; + htmlResponse += + "
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For + * details, please see https://owasp.org/www-project-benchmark/. + * + *
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms + * of the GNU General Public License as published by the Free Software Foundation, version 2. + * + *
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR + * PURPOSE. See the GNU General Public License for more details. + * + * @author Nick Sanidas + * @created 2015 + */ +package org.owasp.benchmark.testcode; + +import java.io.IOException; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +@WebServlet(value = "/xss-00/BenchmarkTest02742") +public class BenchmarkTest02742 extends SanitizingHttpServlet { + + private static final long serialVersionUID = 1L; + + @Override + public void doPost(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + response.setContentType("text/html;charset=UTF-8"); + response.setHeader("X-XSS-Protection", "0"); + + String param = request.getParameter("email"); + if (param == null) param = ""; + String sanitizeParam = sanitizeTag(param); + + String htmlResponse = ""; + htmlResponse += + "
"; + if (param != null && param.trim().length() != 0 && b) { + htmlRespone += "Our reply will be sent to your email: " + sanitizeParam; + } else { + htmlRespone += "the provided email is not correct: " + sanitizeParam; + } + htmlRespone += "
"; + response.getWriter().println(htmlRespone); + } +} diff --git a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02744.xml b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02744.xml new file mode 100644 index 0000000000..fc113cc247 --- /dev/null +++ b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02744.xml @@ -0,0 +1,7 @@ +This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For + * details, please see https://owasp.org/www-project-benchmark/. + * + *
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms + * of the GNU General Public License as published by the Free Software Foundation, version 2. + * + *
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR + * PURPOSE. See the GNU General Public License for more details. + * + * @author Nick Sanidas + * @created 2015 + */ +package org.owasp.benchmark.testcode; + +import java.io.IOException; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +@WebServlet(value = "/xss-00/BenchmarkTest02745") +public class BenchmarkTest02745 extends SanitizingHttpServlet { + + private static final long serialVersionUID = 1L; + + @Override + public void doPost(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + response.setContentType("text/html;charset=UTF-8"); + response.setHeader("X-XSS-Protection", "0"); + + String param = request.getParameter("email"); + if (param == null) param = ""; + String sanitizeParam = sanitizeAttribute(param); + + String htmlResponse = ""; + htmlResponse += "
" + sanitizeParam + ""; + htmlResponse += ""; + + response.getWriter().println(htmlResponse); + } +} diff --git a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02745.xml b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02745.xml new file mode 100644 index 0000000000..30e6c34ad1 --- /dev/null +++ b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02745.xml @@ -0,0 +1,7 @@ +This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For + * details, please see https://owasp.org/www-project-benchmark/. + * + *
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms + * of the GNU General Public License as published by the Free Software Foundation, version 2. + * + *
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR + * PURPOSE. See the GNU General Public License for more details. + * + * @author Nick Sanidas + * @created 2015 + */ +package org.owasp.benchmark.testcode; + +import java.io.IOException; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +@WebServlet(value = "/xss-00/BenchmarkTest02746") +public class BenchmarkTest02746 extends SanitizingHttpServlet { + + private static final long serialVersionUID = 1L; + + @Override + public void doPost(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + response.setContentType("text/html;charset=UTF-8"); + response.setHeader("X-XSS-Protection", "0"); + + String param = request.getParameter("email"); + if (param == null) param = ""; + String sanitizeParam = sanitizeTag(param); + + String htmlResponse = ""; + htmlResponse += "
" + sanitizeParam + ""; + htmlResponse += ""; + + response.getWriter().println(htmlResponse); + } +} diff --git a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02746.xml b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02746.xml new file mode 100644 index 0000000000..56daff28eb --- /dev/null +++ b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02746.xml @@ -0,0 +1,7 @@ +This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For + * details, please see https://owasp.org/www-project-benchmark/. + * + *
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms + * of the GNU General Public License as published by the Free Software Foundation, version 2. + * + *
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR + * PURPOSE. See the GNU General Public License for more details. + * + * @author Nick Sanidas + * @created 2015 + */ +package org.owasp.benchmark.testcode; + +import java.io.IOException; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +public class Intermediate extends HttpServlet { + + @Override + public void doGet(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + doPost(request, response); + } + + protected String sanitizeAttribute(String parameter) { + String parameter1 = parameter; + parameter1 = parameter1.replaceAll("'", "'"); + parameter1 = parameter1.replaceAll("\"", """); + parameter1 = parameter1.replaceAll("&", "&"); + return parameter1; + } + + protected String sanitizeTag(String parameter) { + String parameter1 = parameter; + parameter1 = parameter1.replaceAll("&", "&"); + parameter1 = parameter1.replaceAll("<", "\\u003C"); + parameter1 = parameter1.replaceAll(">", "\\u003E"); + return parameter1; + } + + protected String newSanitizedValue(String parameter) { + parameter = parameter.replaceAll("&", "&"); + parameter = parameter.replaceAll("<", "<"); + parameter = parameter.replaceAll(">", ">"); + return parameter; + } +} diff --git a/src/main/java/org/owasp/benchmark/testcode/SanitizingHttpServlet.java b/src/main/java/org/owasp/benchmark/testcode/SanitizingHttpServlet.java new file mode 100644 index 0000000000..ac27352d4c --- /dev/null +++ b/src/main/java/org/owasp/benchmark/testcode/SanitizingHttpServlet.java @@ -0,0 +1,56 @@ +/** + * OWASP Benchmark Project v1.2 + * + *
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For + * details, please see https://owasp.org/www-project-benchmark/. + * + *
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms + * of the GNU General Public License as published by the Free Software Foundation, version 2. + * + *
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR + * PURPOSE. See the GNU General Public License for more details. + * + * @author Nick Sanidas + * @created 2015 + */ +package org.owasp.benchmark.testcode; + +import java.io.IOException; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +public class SanitizingHttpServlet extends HttpServlet { + + @Override + public void doGet(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + doPost(request, response); + } + + protected String sanitizeAttribute(String parameter) { + String parameter1 = parameter; + parameter1 = parameter1.replaceAll("'", "'"); + parameter1 = parameter1.replaceAll("\"", """); + parameter1 = parameter1.replaceAll("&", "&"); + return parameter1; + } + + protected String sanitizeTag(String parameter) { + String parameter1 = parameter; + parameter1 = parameter1.replaceAll("&", "&"); + parameter1 = parameter1.replaceAll("<", "\\u003C"); + parameter1 = parameter1.replaceAll(">", "\\u003E"); + return parameter1; + } + + protected String newSanitizedValue(String parameter) { + parameter = parameter.replaceAll("&", "&"); + parameter = parameter.replaceAll("<", "<"); + parameter = parameter.replaceAll(">", ">"); + return parameter; + } +} diff --git a/src/main/webapp/xss-00/BenchmarkTest02741.html b/src/main/webapp/xss-00/BenchmarkTest02741.html new file mode 100644 index 0000000000..32a11425d1 --- /dev/null +++ b/src/main/webapp/xss-00/BenchmarkTest02741.html @@ -0,0 +1,39 @@ + + +
+ + + +