Author: chris.laprun(a)jboss.com Date: 2009-02-21 09:26:05 -0500 (Sat, 21 Feb 2009) New Revision: 12852 Modified: modules/common/trunk/common/src/main/java/org/jboss/portal/common/util/ParameterValidation.java modules/common/trunk/common/src/test/java/org/jboss/portal/test/common/util/ParameterValidationTestCase.java Log: - Getting negative reg-exp right is tricky... Modified: modules/common/trunk/common/src/main/java/org/jboss/portal/common/util/ParameterValidation.java =================================================================== --- modules/common/trunk/common/src/main/java/org/jboss/portal/common/util/ParameterValidation.java 2009-02-20 14:37:19 UTC (rev 12851) +++ modules/common/trunk/common/src/main/java/org/jboss/portal/common/util/ParameterValidation.java 2009-02-21 14:26:05 UTC (rev 12852) @@ -36,7 +36,7 @@ public class ParameterValidation { public final static Pattern CSS_DISTANCE = Pattern.compile("\\d+\\W*(em|ex|px|in|cm|mm|pt|pc|%)?"); - public final static Pattern XSS_CHECK = Pattern.compile("([^<>\\(\\)=\\\\](?!%5c))*", Pattern.CASE_INSENSITIVE); + public final static Pattern XSS_CHECK = Pattern.compile("([^<>\\(\\)=\\\\]^(?!%5C))*", Pattern.CASE_INSENSITIVE); /** * Implements a behavior to be executed in case a value fails to be validated. Uses the Chain of responsibility Modified: modules/common/trunk/common/src/test/java/org/jboss/portal/test/common/util/ParameterValidationTestCase.java =================================================================== --- modules/common/trunk/common/src/test/java/org/jboss/portal/test/common/util/ParameterValidationTestCase.java 2009-02-20 14:37:19 UTC (rev 12851) +++ modules/common/trunk/common/src/test/java/org/jboss/portal/test/common/util/ParameterValidationTestCase.java 2009-02-21 14:26:05 UTC (rev 12852) @@ -103,6 +103,11 @@ assertEquals(defaultValue, ParameterValidation.sanitizeFromPattern("/foo/bar/\\/baz", ParameterValidation.XSS_CHECK, defaultValue)); assertEquals(defaultValue, ParameterValidation.sanitizeFromPattern("/foo/bar/%5c/baz", ParameterValidation.XSS_CHECK, defaultValue)); assertEquals(defaultValue, ParameterValidation.sanitizeFromPattern("/foo/bar/%5C/baz", ParameterValidation.XSS_CHECK, defaultValue)); + assertEquals(defaultValue, ParameterValidation.sanitizeFromPattern("%5C", ParameterValidation.XSS_CHECK, defaultValue)); + assertEquals(defaultValue, ParameterValidation.sanitizeFromPattern("%5C\t ", ParameterValidation.XSS_CHECK, defaultValue)); + assertEquals(defaultValue, ParameterValidation.sanitizeFromPattern("\t\n%5c", ParameterValidation.XSS_CHECK, defaultValue)); + assertEquals(defaultValue, ParameterValidation.sanitizeFromPattern("/foo/bar/%5C", ParameterValidation.XSS_CHECK, defaultValue)); + assertEquals(defaultValue, ParameterValidation.sanitizeFromPattern("/foo/bar/%5c", ParameterValidation.XSS_CHECK, defaultValue)); assertEquals(defaultValue, ParameterValidation.sanitizeFromPattern("http://qa.cwcportal.aviation.ge.com:80/portal/auth/portal/main/cwcportal-" + "Home/cwcportal-Home-LeftNavigationPortletWindow?action=1&org.apache.myfaces.portlet.MyFacesGenericPortlet.VIEW_ID=/pages/h" + "omeleftnavigation.jsp<script>window.open(\"http://3.211.64.16/XSS/ \", \"XSS\",\"width=550,height=290\")</script>",