mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
feat(corpus): vendor 40 OWASP xss pairs as the owasp slice
output_encoding had exactly ONE pair in the whole corpus. It now has 41. 238 pairs were harvested from OWASP BenchmarkJava (2740 generated servlets, GPL-2.0, with a ground-truth CSV) by matching each really-vulnerable test to the safe test of the same category it most resembles -- adjacent tests come from one template, so they differ in the sink or the sanitiser rather than being unrelated programs. Median similarity 0.91, against the 64% of the older `sast` OWASP entries that the group-4 stratification flagged as different programs. Only 40 are vendored. One representative of each of the seven categories was run through the model BEFORE vendoring, and only xss distinguished: its fix adds ESAPI encoding, which the Java sanitizer facts recognise, so the vulnerable side entails and the fixed side drops to corroborated. cmdi, sqli, ldapi and xpathi put the sink in a helper class outside the servlet and resolved no flow at all; pathtraver found the flow but its "safe" twin carries no distinguishing call, so text similarity had matched a twin that is not semantically the fix -- a subtler form of the very defect the harvest was designed to avoid. Those 198 pairs are deliberately left out: adding pairs the model cannot read would inflate the corpus while making every number less interpretable. Evidence for the vendored slice is 3 of 3 distinguished, which is a small sample and is stated as such in the catalog header rather than implied to be more. The slice is marked SYNTHETIC in its header: it measures breadth across a weakness class and must never stand in for real-world performance. The corpus already shows a +16% overfitting gap, and a large generated slice blended into a headline would widen it invisibly. Two things recorded rather than hidden: BenchmarkJava's LICENSE is GPL-2.0 while the older sast entries declare GPL-3.0 for OWASP, which looks like an error and is not copied; and OWASP-Benchmark/BenchmarkJava already straddled the train/holdout split before these pairs (owasp-java-cmdi train, owasp-java-sqli holdout), so the new all-holdout pairs enlarge an existing straddle rather than create one. The two vendored-count guards did their job -- a corpus change could not land silently -- and are updated as the acknowledgement. Hygiene artifact regenerated: 277 -> 317 vendored pairs. 720 passing, mypy/ruff clean, gates byte-identical. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5
Claude Opus 5
parent
fcb12e116a
commit
1af3db37f6
@@ -92,6 +92,8 @@
|
||||
"owasp-java-hash"
|
||||
],
|
||||
"note": "Repositories in `straddling` have pairs on both sides of the train/holdout split, so a learning path can be taught by one file of a repository and evaluated on another. Pairs in `duplicate_groups` share a vulnerable excerpt byte for byte after the provenance header is stripped. Both cap what any detector number can mean. Groups in `cross_split_duplicates` sit on both sides of the split while being the same code, so the train row teaches the holdout row exactly; forks of one project defeat the repository-level split.",
|
||||
"owasp_note": "The 40 vendored BenchmarkJava xss pairs are all holdout. OWASP-Benchmark/BenchmarkJava already straddled the split before them (owasp-java-cmdi train, owasp-java-sqli holdout), so the new pairs enlarge an existing straddle rather than create one. It matters less than it did -- the learning path a train row could teach is deleted -- but it is recorded, not hidden.",
|
||||
"regenerated": "2026-09-08 after the owasp slice was vendored",
|
||||
"straddling": [
|
||||
[
|
||||
"Contrast-Security-OSS/DjanGoat",
|
||||
@@ -121,7 +123,47 @@
|
||||
[
|
||||
"owasp-java-cmdi",
|
||||
"owasp-java-hash",
|
||||
"owasp-java-sqli"
|
||||
"owasp-java-sqli",
|
||||
"owasp-xss-benchmarktest00013",
|
||||
"owasp-xss-benchmarktest00014",
|
||||
"owasp-xss-benchmarktest00030",
|
||||
"owasp-xss-benchmarktest00036",
|
||||
"owasp-xss-benchmarktest00041",
|
||||
"owasp-xss-benchmarktest00144",
|
||||
"owasp-xss-benchmarktest00145",
|
||||
"owasp-xss-benchmarktest00146",
|
||||
"owasp-xss-benchmarktest00148",
|
||||
"owasp-xss-benchmarktest00149",
|
||||
"owasp-xss-benchmarktest00150",
|
||||
"owasp-xss-benchmarktest00152",
|
||||
"owasp-xss-benchmarktest00153",
|
||||
"owasp-xss-benchmarktest00154",
|
||||
"owasp-xss-benchmarktest00155",
|
||||
"owasp-xss-benchmarktest00156",
|
||||
"owasp-xss-benchmarktest00157",
|
||||
"owasp-xss-benchmarktest00276",
|
||||
"owasp-xss-benchmarktest00279",
|
||||
"owasp-xss-benchmarktest00280",
|
||||
"owasp-xss-benchmarktest00284",
|
||||
"owasp-xss-benchmarktest00287",
|
||||
"owasp-xss-benchmarktest00290",
|
||||
"owasp-xss-benchmarktest00291",
|
||||
"owasp-xss-benchmarktest00292",
|
||||
"owasp-xss-benchmarktest00301",
|
||||
"owasp-xss-benchmarktest00375",
|
||||
"owasp-xss-benchmarktest00376",
|
||||
"owasp-xss-benchmarktest00378",
|
||||
"owasp-xss-benchmarktest00380",
|
||||
"owasp-xss-benchmarktest00382",
|
||||
"owasp-xss-benchmarktest00383",
|
||||
"owasp-xss-benchmarktest00384",
|
||||
"owasp-xss-benchmarktest00385",
|
||||
"owasp-xss-benchmarktest00387",
|
||||
"owasp-xss-benchmarktest00388",
|
||||
"owasp-xss-benchmarktest00390",
|
||||
"owasp-xss-benchmarktest00392",
|
||||
"owasp-xss-benchmarktest00395",
|
||||
"owasp-xss-benchmarktest00467"
|
||||
]
|
||||
],
|
||||
[
|
||||
@@ -423,5 +465,5 @@
|
||||
"train"
|
||||
]
|
||||
],
|
||||
"vendored_pairs": 277
|
||||
"vendored_pairs": 317
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Dave Wichers
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00013")
|
||||
public class BenchmarkTest00013 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
// some code
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().format(java.util.Locale.US, param, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Dave Wichers
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00014")
|
||||
public class BenchmarkTest00014 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
// some code
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().format(param, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
/**
|
||||
* OWASP Benchmark v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Dave Wichers
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00030")
|
||||
public class BenchmarkTest00030 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
// some code
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
java.util.Map<String, String[]> map = request.getParameterMap();
|
||||
String param = "";
|
||||
if (!map.isEmpty()) {
|
||||
String[] values = map.get("BenchmarkTest00030");
|
||||
if (values != null) param = values[0];
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().printf(param, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
/**
|
||||
* OWASP Benchmark v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Dave Wichers
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00036")
|
||||
public class BenchmarkTest00036 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
// some code
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
boolean flag = true;
|
||||
java.util.Enumeration<String> names = request.getParameterNames();
|
||||
while (names.hasMoreElements() && flag) {
|
||||
String name = (String) names.nextElement();
|
||||
String[] values = request.getParameterValues(name);
|
||||
if (values != null) {
|
||||
for (int i = 0; i < values.length && flag; i++) {
|
||||
String value = values[i];
|
||||
if (value.equals("BenchmarkTest00036")) {
|
||||
param = name;
|
||||
flag = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
int length = 1;
|
||||
if (param != null) {
|
||||
length = param.length();
|
||||
response.getWriter().write(param.toCharArray(), 0, length);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
/**
|
||||
* OWASP Benchmark v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Dave Wichers
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00041")
|
||||
public class BenchmarkTest00041 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
// some code
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
org.owasp.benchmark.helpers.SeparateClassRequest scr =
|
||||
new org.owasp.benchmark.helpers.SeparateClassRequest(request);
|
||||
String param = scr.getTheParameter("BenchmarkTest00041");
|
||||
if (param == null) param = "";
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
int length = 1;
|
||||
if (param != null) {
|
||||
length = param.length();
|
||||
response.getWriter().write(param, 0, length);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00144")
|
||||
public class BenchmarkTest00144 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = "";
|
||||
if (param != null) {
|
||||
java.util.List<String> valuesList = new java.util.ArrayList<String>();
|
||||
valuesList.add("safe");
|
||||
valuesList.add(param);
|
||||
valuesList.add("moresafe");
|
||||
|
||||
valuesList.remove(0); // remove the 1st safe value
|
||||
|
||||
bar = valuesList.get(0); // get the param value
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().format(java.util.Locale.US, bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00145")
|
||||
public class BenchmarkTest00145 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = "safe!";
|
||||
java.util.HashMap<String, Object> map17589 = new java.util.HashMap<String, Object>();
|
||||
map17589.put("keyA-17589", "a-Value"); // put some stuff in the collection
|
||||
map17589.put("keyB-17589", param); // put it in a collection
|
||||
map17589.put("keyC", "another-Value"); // put some stuff in the collection
|
||||
bar = (String) map17589.get("keyB-17589"); // get it back out
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().format(java.util.Locale.US, bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00146")
|
||||
public class BenchmarkTest00146 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = param;
|
||||
if (param != null && param.length() > 1) {
|
||||
StringBuilder sbxyz67327 = new StringBuilder(param);
|
||||
bar = sbxyz67327.replace(param.length() - "Z".length(), param.length(), "Z").toString();
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().format(java.util.Locale.US, bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00148")
|
||||
public class BenchmarkTest00148 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar;
|
||||
|
||||
// Simple if statement that assigns param to bar on true condition
|
||||
int num = 196;
|
||||
if ((500 / 42) + num > 200) bar = param;
|
||||
else bar = "This should never happen";
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", bar};
|
||||
response.getWriter().format("Formatted like: %1$s and %2$s.", obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00149")
|
||||
public class BenchmarkTest00149 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
StringBuilder sbxyz19132 = new StringBuilder(param);
|
||||
String bar = sbxyz19132.append("_SafeStuff").toString();
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", bar};
|
||||
response.getWriter().printf(java.util.Locale.US, "Formatted like: %1$s and %2$s.", obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00150")
|
||||
public class BenchmarkTest00150 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar;
|
||||
|
||||
// Simple if statement that assigns param to bar on true condition
|
||||
int num = 196;
|
||||
if ((500 / 42) + num > 200) bar = param;
|
||||
else bar = "This should never happen";
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", bar};
|
||||
response.getWriter().printf(java.util.Locale.US, "Formatted like: %1$s and %2$s.", obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00151")
|
||||
public class BenchmarkTest00151 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = "alsosafe";
|
||||
if (param != null) {
|
||||
java.util.List<String> valuesList = new java.util.ArrayList<String>();
|
||||
valuesList.add("safe");
|
||||
valuesList.add(param);
|
||||
valuesList.add("moresafe");
|
||||
|
||||
valuesList.remove(0); // remove the 1st safe value
|
||||
|
||||
bar = valuesList.get(1); // get the last 'safe' value
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().printf(bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00152")
|
||||
public class BenchmarkTest00152 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar;
|
||||
String guess = "ABC";
|
||||
char switchTarget = guess.charAt(2);
|
||||
|
||||
// Simple case statement that assigns param to bar on conditions 'A', 'C', or 'D'
|
||||
switch (switchTarget) {
|
||||
case 'A':
|
||||
bar = param;
|
||||
break;
|
||||
case 'B':
|
||||
bar = "bobs_your_uncle";
|
||||
break;
|
||||
case 'C':
|
||||
case 'D':
|
||||
bar = param;
|
||||
break;
|
||||
default:
|
||||
bar = "bobs_your_uncle";
|
||||
break;
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar.toCharArray());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00153")
|
||||
public class BenchmarkTest00153 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = "safe!";
|
||||
java.util.HashMap<String, Object> map96050 = new java.util.HashMap<String, Object>();
|
||||
map96050.put("keyA-96050", "a-Value"); // put some stuff in the collection
|
||||
map96050.put("keyB-96050", param); // put it in a collection
|
||||
map96050.put("keyC", "another-Value"); // put some stuff in the collection
|
||||
bar = (String) map96050.get("keyB-96050"); // get it back out
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00154")
|
||||
public class BenchmarkTest00154 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar;
|
||||
String guess = "ABC";
|
||||
char switchTarget = guess.charAt(2);
|
||||
|
||||
// Simple case statement that assigns param to bar on conditions 'A', 'C', or 'D'
|
||||
switch (switchTarget) {
|
||||
case 'A':
|
||||
bar = param;
|
||||
break;
|
||||
case 'B':
|
||||
bar = "bobs_your_uncle";
|
||||
break;
|
||||
case 'C':
|
||||
case 'D':
|
||||
bar = param;
|
||||
break;
|
||||
default:
|
||||
bar = "bobs_your_uncle";
|
||||
break;
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00155")
|
||||
public class BenchmarkTest00155 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
org.owasp.benchmark.helpers.ThingInterface thing =
|
||||
org.owasp.benchmark.helpers.ThingFactory.createThing();
|
||||
String bar = thing.doSomething(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00156")
|
||||
public class BenchmarkTest00156 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = "";
|
||||
if (param != null) {
|
||||
java.util.List<String> valuesList = new java.util.ArrayList<String>();
|
||||
valuesList.add("safe");
|
||||
valuesList.add(param);
|
||||
valuesList.add("moresafe");
|
||||
|
||||
valuesList.remove(0); // remove the 1st safe value
|
||||
|
||||
bar = valuesList.get(0); // get the param value
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().write(bar.toCharArray());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00157")
|
||||
public class BenchmarkTest00157 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("Referer") != null) {
|
||||
param = request.getHeader("Referer");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar;
|
||||
|
||||
// Simple ? condition that assigns param to bar on false condition
|
||||
int num = 106;
|
||||
|
||||
bar = (7 * 42) - num > 200 ? "This should never happen" : param;
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().write(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00276")
|
||||
public class BenchmarkTest00276 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar;
|
||||
|
||||
// Simple ? condition that assigns param to bar on false condition
|
||||
int num = 106;
|
||||
|
||||
bar = (7 * 42) - num > 200 ? "This should never happen" : param;
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().print(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00278")
|
||||
public class BenchmarkTest00278 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = org.springframework.web.util.HtmlUtils.htmlEscape(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().print(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00279")
|
||||
public class BenchmarkTest00279 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = "";
|
||||
if (param != null) {
|
||||
java.util.List<String> valuesList = new java.util.ArrayList<String>();
|
||||
valuesList.add("safe");
|
||||
valuesList.add(param);
|
||||
valuesList.add("moresafe");
|
||||
|
||||
valuesList.remove(0); // remove the 1st safe value
|
||||
|
||||
bar = valuesList.get(0); // get the param value
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().print(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,77 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00280")
|
||||
public class BenchmarkTest00280 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar;
|
||||
String guess = "ABC";
|
||||
char switchTarget = guess.charAt(2);
|
||||
|
||||
// Simple case statement that assigns param to bar on conditions 'A', 'C', or 'D'
|
||||
switch (switchTarget) {
|
||||
case 'A':
|
||||
bar = param;
|
||||
break;
|
||||
case 'B':
|
||||
bar = "bobs_your_uncle";
|
||||
break;
|
||||
case 'C':
|
||||
case 'D':
|
||||
bar = param;
|
||||
break;
|
||||
default:
|
||||
bar = "bobs_your_uncle";
|
||||
break;
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().print(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00281")
|
||||
public class BenchmarkTest00281 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar;
|
||||
|
||||
// Simple ? condition that assigns constant to bar on true condition
|
||||
int num = 106;
|
||||
|
||||
bar = (7 * 18) + num > 200 ? "This_should_always_happen" : param;
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().printf(java.util.Locale.US, bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00282")
|
||||
public class BenchmarkTest00282 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = org.owasp.esapi.ESAPI.encoder().encodeForHTML(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {bar, "b"};
|
||||
response.getWriter().printf("Formatted like: %1$s and %2$s.", obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00283")
|
||||
public class BenchmarkTest00283 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = org.owasp.esapi.ESAPI.encoder().encodeForHTML(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar.toCharArray());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00284")
|
||||
public class BenchmarkTest00284 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = param;
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00285")
|
||||
public class BenchmarkTest00285 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = org.owasp.esapi.ESAPI.encoder().encodeForHTML(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00286")
|
||||
public class BenchmarkTest00286 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = org.apache.commons.lang.StringEscapeUtils.escapeHtml(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().write(bar.toCharArray());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00287")
|
||||
public class BenchmarkTest00287 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = param;
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
int length = 1;
|
||||
if (bar != null) {
|
||||
length = bar.length();
|
||||
response.getWriter().write(bar.toCharArray(), 0, length);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00288")
|
||||
public class BenchmarkTest00288 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = "safe!";
|
||||
java.util.HashMap<String, Object> map34285 = new java.util.HashMap<String, Object>();
|
||||
map34285.put("keyA-34285", "a_Value"); // put some stuff in the collection
|
||||
map34285.put("keyB-34285", param); // put it in a collection
|
||||
map34285.put("keyC", "another_Value"); // put some stuff in the collection
|
||||
bar = (String) map34285.get("keyB-34285"); // get it back out
|
||||
bar = (String) map34285.get("keyA-34285"); // get safe value back out
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
int length = 1;
|
||||
if (bar != null) {
|
||||
length = bar.length();
|
||||
response.getWriter().write(bar.toCharArray(), 0, length);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00289")
|
||||
public class BenchmarkTest00289 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = org.owasp.esapi.ESAPI.encoder().encodeForHTML(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().write(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00290")
|
||||
public class BenchmarkTest00290 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
StringBuilder sbxyz73567 = new StringBuilder(param);
|
||||
String bar = sbxyz73567.append("_SafeStuff").toString();
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().write(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00291")
|
||||
public class BenchmarkTest00291 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = param;
|
||||
if (param != null && param.length() > 1) {
|
||||
bar = param.substring(0, param.length() - 1);
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().write(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00292")
|
||||
public class BenchmarkTest00292 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = param;
|
||||
if (param != null && param.length() > 1) {
|
||||
bar = param.substring(0, param.length() - 1);
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
int length = 1;
|
||||
if (bar != null) {
|
||||
length = bar.length();
|
||||
response.getWriter().write(bar, 0, length);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00301")
|
||||
public class BenchmarkTest00301 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> headers = request.getHeaders("Referer");
|
||||
|
||||
if (headers != null && headers.hasMoreElements()) {
|
||||
param = headers.nextElement(); // just grab first element
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String bar = "safe!";
|
||||
java.util.HashMap<String, Object> map16074 = new java.util.HashMap<String, Object>();
|
||||
map16074.put("keyA-16074", "a-Value"); // put some stuff in the collection
|
||||
map16074.put("keyB-16074", param); // put it in a collection
|
||||
map16074.put("keyC", "another-Value"); // put some stuff in the collection
|
||||
bar = (String) map16074.get("keyB-16074"); // get it back out
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().write("Parameter value: " + bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00375")
|
||||
public class BenchmarkTest00375 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00375");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar = "";
|
||||
if (param != null) bar = param.split(" ")[0];
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().format(java.util.Locale.US, bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00376")
|
||||
public class BenchmarkTest00376 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00376");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar;
|
||||
|
||||
// Simple ? condition that assigns param to bar on false condition
|
||||
int num = 106;
|
||||
|
||||
bar = (7 * 42) - num > 200 ? "This should never happen" : param;
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", bar};
|
||||
response.getWriter().format("Formatted like: %1$s and %2$s.", obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00377")
|
||||
public class BenchmarkTest00377 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00377");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar = "alsosafe";
|
||||
if (param != null) {
|
||||
java.util.List<String> valuesList = new java.util.ArrayList<String>();
|
||||
valuesList.add("safe");
|
||||
valuesList.add(param);
|
||||
valuesList.add("moresafe");
|
||||
|
||||
valuesList.remove(0); // remove the 1st safe value
|
||||
|
||||
bar = valuesList.get(1); // get the last 'safe' value
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", bar};
|
||||
response.getWriter().format("Formatted like: %1$s and %2$s.", obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00378")
|
||||
public class BenchmarkTest00378 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00378");
|
||||
if (param == null) param = "";
|
||||
|
||||
StringBuilder sbxyz85125 = new StringBuilder(param);
|
||||
String bar = sbxyz85125.append("_SafeStuff").toString();
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().format(bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00379")
|
||||
public class BenchmarkTest00379 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00379");
|
||||
if (param == null) param = "";
|
||||
|
||||
// Chain a bunch of propagators in sequence
|
||||
String a75704 = param; // assign
|
||||
StringBuilder b75704 = new StringBuilder(a75704); // stick in stringbuilder
|
||||
b75704.append(" SafeStuff"); // append some safe content
|
||||
b75704.replace(
|
||||
b75704.length() - "Chars".length(),
|
||||
b75704.length(),
|
||||
"Chars"); // replace some of the end content
|
||||
java.util.HashMap<String, Object> map75704 = new java.util.HashMap<String, Object>();
|
||||
map75704.put("key75704", b75704.toString()); // put in a collection
|
||||
String c75704 = (String) map75704.get("key75704"); // get it back out
|
||||
String d75704 = c75704.substring(0, c75704.length() - 1); // extract most of it
|
||||
String e75704 =
|
||||
new String(
|
||||
org.apache.commons.codec.binary.Base64.decodeBase64(
|
||||
org.apache.commons.codec.binary.Base64.encodeBase64(
|
||||
d75704.getBytes()))); // B64 encode and decode it
|
||||
String f75704 = e75704.split(" ")[0]; // split it on a space
|
||||
org.owasp.benchmark.helpers.ThingInterface thing =
|
||||
org.owasp.benchmark.helpers.ThingFactory.createThing();
|
||||
String g75704 = "barbarians_at_the_gate"; // This is static so this whole flow is 'safe'
|
||||
String bar = thing.doSomething(g75704); // reflection
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().print(bar.toCharArray());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,70 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00380")
|
||||
public class BenchmarkTest00380 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00380");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar;
|
||||
String guess = "ABC";
|
||||
char switchTarget = guess.charAt(2);
|
||||
|
||||
// Simple case statement that assigns param to bar on conditions 'A', 'C', or 'D'
|
||||
switch (switchTarget) {
|
||||
case 'A':
|
||||
bar = param;
|
||||
break;
|
||||
case 'B':
|
||||
bar = "bobs_your_uncle";
|
||||
break;
|
||||
case 'C':
|
||||
case 'D':
|
||||
bar = param;
|
||||
break;
|
||||
default:
|
||||
bar = "bobs_your_uncle";
|
||||
break;
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().print(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00381")
|
||||
public class BenchmarkTest00381 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00381");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar = org.owasp.esapi.ESAPI.encoder().encodeForHTML(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", bar};
|
||||
response.getWriter().printf(java.util.Locale.US, "Formatted like: %1$s and %2$s.", obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00382")
|
||||
public class BenchmarkTest00382 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00382");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar = "";
|
||||
if (param != null) {
|
||||
java.util.List<String> valuesList = new java.util.ArrayList<String>();
|
||||
valuesList.add("safe");
|
||||
valuesList.add(param);
|
||||
valuesList.add("moresafe");
|
||||
|
||||
valuesList.remove(0); // remove the 1st safe value
|
||||
|
||||
bar = valuesList.get(0); // get the param value
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().printf(java.util.Locale.US, bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00383")
|
||||
public class BenchmarkTest00383 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00383");
|
||||
if (param == null) param = "";
|
||||
|
||||
// Chain a bunch of propagators in sequence
|
||||
String a2196 = param; // assign
|
||||
StringBuilder b2196 = new StringBuilder(a2196); // stick in stringbuilder
|
||||
b2196.append(" SafeStuff"); // append some safe content
|
||||
b2196.replace(
|
||||
b2196.length() - "Chars".length(),
|
||||
b2196.length(),
|
||||
"Chars"); // replace some of the end content
|
||||
java.util.HashMap<String, Object> map2196 = new java.util.HashMap<String, Object>();
|
||||
map2196.put("key2196", b2196.toString()); // put in a collection
|
||||
String c2196 = (String) map2196.get("key2196"); // get it back out
|
||||
String d2196 = c2196.substring(0, c2196.length() - 1); // extract most of it
|
||||
String e2196 =
|
||||
new String(
|
||||
org.apache.commons.codec.binary.Base64.decodeBase64(
|
||||
org.apache.commons.codec.binary.Base64.encodeBase64(
|
||||
d2196.getBytes()))); // B64 encode and decode it
|
||||
String f2196 = e2196.split(" ")[0]; // split it on a space
|
||||
org.owasp.benchmark.helpers.ThingInterface thing =
|
||||
org.owasp.benchmark.helpers.ThingFactory.createThing();
|
||||
String bar = thing.doSomething(f2196); // reflection
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().printf(java.util.Locale.US, bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,54 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00384")
|
||||
public class BenchmarkTest00384 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00384");
|
||||
if (param == null) param = "";
|
||||
|
||||
org.owasp.benchmark.helpers.ThingInterface thing =
|
||||
org.owasp.benchmark.helpers.ThingFactory.createThing();
|
||||
String bar = thing.doSomething(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().printf(java.util.Locale.US, bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00385")
|
||||
public class BenchmarkTest00385 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00385");
|
||||
if (param == null) param = "";
|
||||
|
||||
// Chain a bunch of propagators in sequence
|
||||
String a21475 = param; // assign
|
||||
StringBuilder b21475 = new StringBuilder(a21475); // stick in stringbuilder
|
||||
b21475.append(" SafeStuff"); // append some safe content
|
||||
b21475.replace(
|
||||
b21475.length() - "Chars".length(),
|
||||
b21475.length(),
|
||||
"Chars"); // replace some of the end content
|
||||
java.util.HashMap<String, Object> map21475 = new java.util.HashMap<String, Object>();
|
||||
map21475.put("key21475", b21475.toString()); // put in a collection
|
||||
String c21475 = (String) map21475.get("key21475"); // get it back out
|
||||
String d21475 = c21475.substring(0, c21475.length() - 1); // extract most of it
|
||||
String e21475 =
|
||||
new String(
|
||||
org.apache.commons.codec.binary.Base64.decodeBase64(
|
||||
org.apache.commons.codec.binary.Base64.encodeBase64(
|
||||
d21475.getBytes()))); // B64 encode and decode it
|
||||
String f21475 = e21475.split(" ")[0]; // split it on a space
|
||||
org.owasp.benchmark.helpers.ThingInterface thing =
|
||||
org.owasp.benchmark.helpers.ThingFactory.createThing();
|
||||
String bar = thing.doSomething(f21475); // reflection
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {bar, "b"};
|
||||
response.getWriter().printf("Formatted like: %1$s and %2$s.", obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00387")
|
||||
public class BenchmarkTest00387 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00387");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar;
|
||||
|
||||
// Simple ? condition that assigns param to bar on false condition
|
||||
int num = 106;
|
||||
|
||||
bar = (7 * 42) - num > 200 ? "This should never happen" : param;
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar.toCharArray());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00388")
|
||||
public class BenchmarkTest00388 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00388");
|
||||
if (param == null) param = "";
|
||||
|
||||
StringBuilder sbxyz30382 = new StringBuilder(param);
|
||||
String bar = sbxyz30382.append("_SafeStuff").toString();
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar.toCharArray());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,51 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00389")
|
||||
public class BenchmarkTest00389 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00389");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar = org.apache.commons.lang.StringEscapeUtils.escapeHtml(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00390")
|
||||
public class BenchmarkTest00390 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00390");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar = "";
|
||||
if (param != null) {
|
||||
bar =
|
||||
new String(
|
||||
org.apache.commons.codec.binary.Base64.decodeBase64(
|
||||
org.apache.commons.codec.binary.Base64.encodeBase64(
|
||||
param.getBytes())));
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,51 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00391")
|
||||
public class BenchmarkTest00391 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00391");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar = org.owasp.esapi.ESAPI.encoder().encodeForHTML(param);
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().println(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00392")
|
||||
public class BenchmarkTest00392 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00392");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar = param;
|
||||
if (param != null && param.length() > 1) {
|
||||
StringBuilder sbxyz38384 = new StringBuilder(param);
|
||||
bar = sbxyz38384.replace(param.length() - "Z".length(), param.length(), "Z").toString();
|
||||
}
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
int length = 1;
|
||||
if (bar != null) {
|
||||
length = bar.length();
|
||||
response.getWriter().write(bar.toCharArray(), 0, length);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00393")
|
||||
public class BenchmarkTest00393 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00393");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar;
|
||||
|
||||
// Simple ? condition that assigns constant to bar on true condition
|
||||
int num = 106;
|
||||
|
||||
bar = (7 * 18) + num > 200 ? "This_should_always_happen" : param;
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
response.getWriter().write(bar);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00395")
|
||||
public class BenchmarkTest00395 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = request.getParameter("BenchmarkTest00395");
|
||||
if (param == null) param = "";
|
||||
|
||||
String bar = "";
|
||||
if (param != null) bar = param.split(" ")[0];
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
int length = 1;
|
||||
if (bar != null) {
|
||||
length = bar.length();
|
||||
response.getWriter().write(bar, 0, length);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00467")
|
||||
public class BenchmarkTest00467 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
java.util.Map<String, String[]> map = request.getParameterMap();
|
||||
String param = "";
|
||||
if (!map.isEmpty()) {
|
||||
String[] values = map.get("BenchmarkTest00467");
|
||||
if (values != null) param = values[0];
|
||||
}
|
||||
|
||||
String bar = "safe!";
|
||||
java.util.HashMap<String, Object> map88136 = new java.util.HashMap<String, Object>();
|
||||
map88136.put("keyA-88136", "a-Value"); // put some stuff in the collection
|
||||
map88136.put("keyB-88136", param); // put it in a collection
|
||||
map88136.put("keyC", "another-Value"); // put some stuff in the collection
|
||||
bar = (String) map88136.get("keyB-88136"); // get it back out
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().format(java.util.Locale.US, bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/xss-00/BenchmarkTest00468")
|
||||
public class BenchmarkTest00468 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
java.util.Map<String, String[]> map = request.getParameterMap();
|
||||
String param = "";
|
||||
if (!map.isEmpty()) {
|
||||
String[] values = map.get("BenchmarkTest00468");
|
||||
if (values != null) param = values[0];
|
||||
}
|
||||
|
||||
String bar = "safe!";
|
||||
java.util.HashMap<String, Object> map50379 = new java.util.HashMap<String, Object>();
|
||||
map50379.put("keyA-50379", "a_Value"); // put some stuff in the collection
|
||||
map50379.put("keyB-50379", param); // put it in a collection
|
||||
map50379.put("keyC", "another_Value"); // put some stuff in the collection
|
||||
bar = (String) map50379.get("keyB-50379"); // get it back out
|
||||
bar = (String) map50379.get("keyA-50379"); // get safe value back out
|
||||
|
||||
response.setHeader("X-XSS-Protection", "0");
|
||||
Object[] obj = {"a", "b"};
|
||||
response.getWriter().format(java.util.Locale.US, bar, obj);
|
||||
}
|
||||
}
|
||||
@@ -48,16 +48,17 @@ DEFAULT_SAST_CATALOG = Path("benchmarks/pairs/sast/catalog.toml")
|
||||
DEFAULT_VFC_CATALOG = Path("benchmarks/pairs/vfc/catalog.toml")
|
||||
DEFAULT_VIBE_PY_CATALOG = Path("benchmarks/pairs/vibe-py/catalog.toml")
|
||||
DEFAULT_VFC_JS_CATALOG = Path("benchmarks/pairs/vfc-js/catalog.toml")
|
||||
DEFAULT_OWASP_CATALOG = Path("benchmarks/pairs/owasp/catalog.toml")
|
||||
DEFAULT_AGENT_VFC_CATALOG = Path("benchmarks/pairs/agent-vfc/catalog.toml")
|
||||
DEFAULT_DATASETS = Path("benchmarks/pairs/datasets.toml")
|
||||
DEFAULT_MECHANISMS = Path("benchmarks/pairs/mechanisms.toml")
|
||||
|
||||
# Slices scored on overlay dispositions (inventory fallback when nothing adjudicates).
|
||||
OVERLAY_SLICES = frozenset({"sast", "vfc", "vibe-py", "vfc-js", "agent-vfc"})
|
||||
OVERLAY_SLICES = frozenset({"sast", "vfc", "vibe-py", "vfc-js", "agent-vfc", "owasp"})
|
||||
# Harvested function slices: every label must name the function (design §LabelSchema); "<anon>" does not scope.
|
||||
FUNCTION_REQUIRED_SLICES = OVERLAY_SLICES - {"sast"}
|
||||
FunctionRanges = dict[str, tuple[tuple[str, int, int], ...]]
|
||||
SLICE_NAMES = ("all", "local", "github", "sast", "vfc", "vibe-py", "vfc-js", "agent-vfc")
|
||||
SLICE_NAMES = ("all", "local", "github", "sast", "vfc", "vibe-py", "vfc-js", "agent-vfc", "owasp")
|
||||
PROVENANCES = frozenset({"human", "agent", "mixed", "synthetic"})
|
||||
SPLITS = frozenset({"train", "holdout"})
|
||||
# Req 9: how a label was established. Only seeded and reviewed pairs steer the improve loop.
|
||||
@@ -235,6 +236,7 @@ def load_pair_catalog(path: Path = DEFAULT_CATALOG) -> tuple[PairCase, ...]:
|
||||
DEFAULT_VIBE_PY_CATALOG,
|
||||
DEFAULT_VFC_JS_CATALOG,
|
||||
DEFAULT_AGENT_VFC_CATALOG,
|
||||
DEFAULT_OWASP_CATALOG,
|
||||
):
|
||||
if extra.exists():
|
||||
cases = cases + _load_catalog_file(extra)
|
||||
|
||||
@@ -15,7 +15,11 @@ IDENTICAL_TWINS = {
|
||||
"vampi-books-get-by-title",
|
||||
"vulnpy-deserialization-do-pickle-load",
|
||||
}
|
||||
VENDORED_PER_SLICE = {"local": 3, "github": 6, "sast": 11, "vibe-py": 35, "vfc-js": 17, "vfc": 176, "agent-vfc": 29}
|
||||
# `owasp` added 2026-09-08: 40 generated BenchmarkJava xss pairs, the only harvested category the model was
|
||||
# shown to distinguish before vendoring. This guard exists so a corpus change is never silent — updating it
|
||||
# is the acknowledgement.
|
||||
VENDORED_PER_SLICE = {"local": 3, "github": 6, "sast": 11, "vibe-py": 35, "vfc-js": 17, "vfc": 176,
|
||||
"agent-vfc": 29, "owasp": 40}
|
||||
|
||||
|
||||
def test_identical_twins_are_unscorable_and_no_row_is_dropped() -> None:
|
||||
|
||||
@@ -403,7 +403,8 @@ def test_the_vendored_count_is_unchanged_by_the_re_harvest() -> None:
|
||||
per_slice: dict[str, int] = {}
|
||||
for case in cases:
|
||||
per_slice[case.slice] = per_slice.get(case.slice, 0) + 1
|
||||
assert per_slice == {"agent-vfc": 29, "github": 6, "local": 3, "sast": 11, "vfc": 176, "vfc-js": 17, "vibe-py": 35}
|
||||
assert per_slice == {"agent-vfc": 29, "github": 6, "local": 3, "owasp": 40, "sast": 11, "vfc": 176,
|
||||
"vfc-js": 17, "vibe-py": 35}
|
||||
|
||||
|
||||
def test_prose_inside_a_decorator_never_grants_a_guard(tmp_path: Path) -> None:
|
||||
|
||||
Reference in New Issue
Block a user