This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For + * details, please see https://owasp.org/www-project-benchmark/. + * + *
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms + * of the GNU General Public License as published by the Free Software Foundation, version 2. + * + *
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Dave Wichers
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00013")
+public class BenchmarkTest00013 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ // some code
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Dave Wichers
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00014")
+public class BenchmarkTest00014 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ // some code
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Dave Wichers
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00030")
+public class BenchmarkTest00030 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ // some code
+ response.setContentType("text/html;charset=UTF-8");
+
+ java.util.Map This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Dave Wichers
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00036")
+public class BenchmarkTest00036 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ // some code
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ boolean flag = true;
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Dave Wichers
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00041")
+public class BenchmarkTest00041 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ // some code
+ response.setContentType("text/html;charset=UTF-8");
+
+ org.owasp.benchmark.helpers.SeparateClassRequest scr =
+ new org.owasp.benchmark.helpers.SeparateClassRequest(request);
+ String param = scr.getTheParameter("BenchmarkTest00041");
+ if (param == null) param = "";
+
+ response.setHeader("X-XSS-Protection", "0");
+ int length = 1;
+ if (param != null) {
+ length = param.length();
+ response.getWriter().write(param, 0, length);
+ }
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00144.java b/benchmarks/pairs/owasp/java/BenchmarkTest00144.java
new file mode 100644
index 0000000..4638da6
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00144.java
@@ -0,0 +1,67 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00144")
+public class BenchmarkTest00144 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar = "";
+ if (param != null) {
+ java.util.List This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00145")
+public class BenchmarkTest00145 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar = "safe!";
+ java.util.HashMap This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00146")
+public class BenchmarkTest00146 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar = param;
+ if (param != null && param.length() > 1) {
+ StringBuilder sbxyz67327 = new StringBuilder(param);
+ bar = sbxyz67327.replace(param.length() - "Z".length(), param.length(), "Z").toString();
+ }
+
+ response.setHeader("X-XSS-Protection", "0");
+ Object[] obj = {"a", "b"};
+ response.getWriter().format(java.util.Locale.US, bar, obj);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00148.java b/benchmarks/pairs/owasp/java/BenchmarkTest00148.java
new file mode 100644
index 0000000..368d66c
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00148.java
@@ -0,0 +1,62 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00148")
+public class BenchmarkTest00148 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar;
+
+ // Simple if statement that assigns param to bar on true condition
+ int num = 196;
+ if ((500 / 42) + num > 200) bar = param;
+ else bar = "This should never happen";
+
+ response.setHeader("X-XSS-Protection", "0");
+ Object[] obj = {"a", bar};
+ response.getWriter().format("Formatted like: %1$s and %2$s.", obj);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00149.java b/benchmarks/pairs/owasp/java/BenchmarkTest00149.java
new file mode 100644
index 0000000..329650d
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00149.java
@@ -0,0 +1,58 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00149")
+public class BenchmarkTest00149 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ StringBuilder sbxyz19132 = new StringBuilder(param);
+ String bar = sbxyz19132.append("_SafeStuff").toString();
+
+ response.setHeader("X-XSS-Protection", "0");
+ Object[] obj = {"a", bar};
+ response.getWriter().printf(java.util.Locale.US, "Formatted like: %1$s and %2$s.", obj);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00150.java b/benchmarks/pairs/owasp/java/BenchmarkTest00150.java
new file mode 100644
index 0000000..39baf14
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00150.java
@@ -0,0 +1,62 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00150")
+public class BenchmarkTest00150 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar;
+
+ // Simple if statement that assigns param to bar on true condition
+ int num = 196;
+ if ((500 / 42) + num > 200) bar = param;
+ else bar = "This should never happen";
+
+ response.setHeader("X-XSS-Protection", "0");
+ Object[] obj = {"a", bar};
+ response.getWriter().printf(java.util.Locale.US, "Formatted like: %1$s and %2$s.", obj);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00151.java b/benchmarks/pairs/owasp/java/BenchmarkTest00151.java
new file mode 100644
index 0000000..e530e70
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00151.java
@@ -0,0 +1,67 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00151")
+public class BenchmarkTest00151 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar = "alsosafe";
+ if (param != null) {
+ java.util.List This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00152")
+public class BenchmarkTest00152 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar;
+ String guess = "ABC";
+ char switchTarget = guess.charAt(2);
+
+ // Simple case statement that assigns param to bar on conditions 'A', 'C', or 'D'
+ switch (switchTarget) {
+ case 'A':
+ bar = param;
+ break;
+ case 'B':
+ bar = "bobs_your_uncle";
+ break;
+ case 'C':
+ case 'D':
+ bar = param;
+ break;
+ default:
+ bar = "bobs_your_uncle";
+ break;
+ }
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().println(bar.toCharArray());
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00153.java b/benchmarks/pairs/owasp/java/BenchmarkTest00153.java
new file mode 100644
index 0000000..8441088
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00153.java
@@ -0,0 +1,61 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00153")
+public class BenchmarkTest00153 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar = "safe!";
+ java.util.HashMap This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00154")
+public class BenchmarkTest00154 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar;
+ String guess = "ABC";
+ char switchTarget = guess.charAt(2);
+
+ // Simple case statement that assigns param to bar on conditions 'A', 'C', or 'D'
+ switch (switchTarget) {
+ case 'A':
+ bar = param;
+ break;
+ case 'B':
+ bar = "bobs_your_uncle";
+ break;
+ case 'C':
+ case 'D':
+ bar = param;
+ break;
+ default:
+ bar = "bobs_your_uncle";
+ break;
+ }
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().println(bar);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00155.java b/benchmarks/pairs/owasp/java/BenchmarkTest00155.java
new file mode 100644
index 0000000..f709a01
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00155.java
@@ -0,0 +1,58 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00155")
+public class BenchmarkTest00155 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ org.owasp.benchmark.helpers.ThingInterface thing =
+ org.owasp.benchmark.helpers.ThingFactory.createThing();
+ String bar = thing.doSomething(param);
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().println(bar);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00156.java b/benchmarks/pairs/owasp/java/BenchmarkTest00156.java
new file mode 100644
index 0000000..d6b2b74
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00156.java
@@ -0,0 +1,66 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00156")
+public class BenchmarkTest00156 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar = "";
+ if (param != null) {
+ java.util.List This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00157")
+public class BenchmarkTest00157 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("Referer") != null) {
+ param = request.getHeader("Referer");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ String bar;
+
+ // Simple ? condition that assigns param to bar on false condition
+ int num = 106;
+
+ bar = (7 * 42) - num > 200 ? "This should never happen" : param;
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().write(bar);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00276.java b/benchmarks/pairs/owasp/java/BenchmarkTest00276.java
new file mode 100644
index 0000000..b889dc4
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00276.java
@@ -0,0 +1,63 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00276")
+public class BenchmarkTest00276 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00278")
+public class BenchmarkTest00278 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00279")
+public class BenchmarkTest00279 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00280")
+public class BenchmarkTest00280 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00281")
+public class BenchmarkTest00281 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00282")
+public class BenchmarkTest00282 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00283")
+public class BenchmarkTest00283 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00284")
+public class BenchmarkTest00284 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00285")
+public class BenchmarkTest00285 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00286")
+public class BenchmarkTest00286 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00287")
+public class BenchmarkTest00287 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00288")
+public class BenchmarkTest00288 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00289")
+public class BenchmarkTest00289 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00290")
+public class BenchmarkTest00290 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00291")
+public class BenchmarkTest00291 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00292")
+public class BenchmarkTest00292 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00301")
+public class BenchmarkTest00301 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00375")
+public class BenchmarkTest00375 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00375");
+ if (param == null) param = "";
+
+ String bar = "";
+ if (param != null) bar = param.split(" ")[0];
+
+ response.setHeader("X-XSS-Protection", "0");
+ Object[] obj = {"a", "b"};
+ response.getWriter().format(java.util.Locale.US, bar, obj);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00376.java b/benchmarks/pairs/owasp/java/BenchmarkTest00376.java
new file mode 100644
index 0000000..94b41e1
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00376.java
@@ -0,0 +1,57 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00376")
+public class BenchmarkTest00376 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00376");
+ if (param == null) param = "";
+
+ String bar;
+
+ // Simple ? condition that assigns param to bar on false condition
+ int num = 106;
+
+ bar = (7 * 42) - num > 200 ? "This should never happen" : param;
+
+ response.setHeader("X-XSS-Protection", "0");
+ Object[] obj = {"a", bar};
+ response.getWriter().format("Formatted like: %1$s and %2$s.", obj);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00377.java b/benchmarks/pairs/owasp/java/BenchmarkTest00377.java
new file mode 100644
index 0000000..75ce724
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00377.java
@@ -0,0 +1,62 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00377")
+public class BenchmarkTest00377 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00377");
+ if (param == null) param = "";
+
+ String bar = "alsosafe";
+ if (param != null) {
+ java.util.List This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00378")
+public class BenchmarkTest00378 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00378");
+ if (param == null) param = "";
+
+ StringBuilder sbxyz85125 = new StringBuilder(param);
+ String bar = sbxyz85125.append("_SafeStuff").toString();
+
+ response.setHeader("X-XSS-Protection", "0");
+ Object[] obj = {"a", "b"};
+ response.getWriter().format(bar, obj);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00379.java b/benchmarks/pairs/owasp/java/BenchmarkTest00379.java
new file mode 100644
index 0000000..b3279cd
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00379.java
@@ -0,0 +1,72 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00379")
+public class BenchmarkTest00379 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00379");
+ if (param == null) param = "";
+
+ // Chain a bunch of propagators in sequence
+ String a75704 = param; // assign
+ StringBuilder b75704 = new StringBuilder(a75704); // stick in stringbuilder
+ b75704.append(" SafeStuff"); // append some safe content
+ b75704.replace(
+ b75704.length() - "Chars".length(),
+ b75704.length(),
+ "Chars"); // replace some of the end content
+ java.util.HashMap This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00380")
+public class BenchmarkTest00380 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00380");
+ if (param == null) param = "";
+
+ String bar;
+ String guess = "ABC";
+ char switchTarget = guess.charAt(2);
+
+ // Simple case statement that assigns param to bar on conditions 'A', 'C', or 'D'
+ switch (switchTarget) {
+ case 'A':
+ bar = param;
+ break;
+ case 'B':
+ bar = "bobs_your_uncle";
+ break;
+ case 'C':
+ case 'D':
+ bar = param;
+ break;
+ default:
+ bar = "bobs_your_uncle";
+ break;
+ }
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().print(bar);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00381.java b/benchmarks/pairs/owasp/java/BenchmarkTest00381.java
new file mode 100644
index 0000000..5c365ac
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00381.java
@@ -0,0 +1,52 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00381")
+public class BenchmarkTest00381 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00381");
+ if (param == null) param = "";
+
+ String bar = org.owasp.esapi.ESAPI.encoder().encodeForHTML(param);
+
+ response.setHeader("X-XSS-Protection", "0");
+ Object[] obj = {"a", bar};
+ response.getWriter().printf(java.util.Locale.US, "Formatted like: %1$s and %2$s.", obj);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00382.java b/benchmarks/pairs/owasp/java/BenchmarkTest00382.java
new file mode 100644
index 0000000..e78fb70
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00382.java
@@ -0,0 +1,62 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00382")
+public class BenchmarkTest00382 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00382");
+ if (param == null) param = "";
+
+ String bar = "";
+ if (param != null) {
+ java.util.List This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00383")
+public class BenchmarkTest00383 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00383");
+ if (param == null) param = "";
+
+ // Chain a bunch of propagators in sequence
+ String a2196 = param; // assign
+ StringBuilder b2196 = new StringBuilder(a2196); // stick in stringbuilder
+ b2196.append(" SafeStuff"); // append some safe content
+ b2196.replace(
+ b2196.length() - "Chars".length(),
+ b2196.length(),
+ "Chars"); // replace some of the end content
+ java.util.HashMap This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00384")
+public class BenchmarkTest00384 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00384");
+ if (param == null) param = "";
+
+ org.owasp.benchmark.helpers.ThingInterface thing =
+ org.owasp.benchmark.helpers.ThingFactory.createThing();
+ String bar = thing.doSomething(param);
+
+ response.setHeader("X-XSS-Protection", "0");
+ Object[] obj = {"a", "b"};
+ response.getWriter().printf(java.util.Locale.US, bar, obj);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00385.java b/benchmarks/pairs/owasp/java/BenchmarkTest00385.java
new file mode 100644
index 0000000..0426889
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00385.java
@@ -0,0 +1,72 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00385")
+public class BenchmarkTest00385 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00385");
+ if (param == null) param = "";
+
+ // Chain a bunch of propagators in sequence
+ String a21475 = param; // assign
+ StringBuilder b21475 = new StringBuilder(a21475); // stick in stringbuilder
+ b21475.append(" SafeStuff"); // append some safe content
+ b21475.replace(
+ b21475.length() - "Chars".length(),
+ b21475.length(),
+ "Chars"); // replace some of the end content
+ java.util.HashMap This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00387")
+public class BenchmarkTest00387 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00387");
+ if (param == null) param = "";
+
+ String bar;
+
+ // Simple ? condition that assigns param to bar on false condition
+ int num = 106;
+
+ bar = (7 * 42) - num > 200 ? "This should never happen" : param;
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().println(bar.toCharArray());
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00388.java b/benchmarks/pairs/owasp/java/BenchmarkTest00388.java
new file mode 100644
index 0000000..b8bb389
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00388.java
@@ -0,0 +1,52 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00388")
+public class BenchmarkTest00388 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00388");
+ if (param == null) param = "";
+
+ StringBuilder sbxyz30382 = new StringBuilder(param);
+ String bar = sbxyz30382.append("_SafeStuff").toString();
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().println(bar.toCharArray());
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00389.java b/benchmarks/pairs/owasp/java/BenchmarkTest00389.java
new file mode 100644
index 0000000..7b99d89
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00389.java
@@ -0,0 +1,51 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00389")
+public class BenchmarkTest00389 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00389");
+ if (param == null) param = "";
+
+ String bar = org.apache.commons.lang.StringEscapeUtils.escapeHtml(param);
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().println(bar);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00390.java b/benchmarks/pairs/owasp/java/BenchmarkTest00390.java
new file mode 100644
index 0000000..ae95854
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00390.java
@@ -0,0 +1,58 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00390")
+public class BenchmarkTest00390 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00390");
+ if (param == null) param = "";
+
+ String bar = "";
+ if (param != null) {
+ bar =
+ new String(
+ org.apache.commons.codec.binary.Base64.decodeBase64(
+ org.apache.commons.codec.binary.Base64.encodeBase64(
+ param.getBytes())));
+ }
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().println(bar);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00391.java b/benchmarks/pairs/owasp/java/BenchmarkTest00391.java
new file mode 100644
index 0000000..6fea39c
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00391.java
@@ -0,0 +1,51 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00391")
+public class BenchmarkTest00391 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00391");
+ if (param == null) param = "";
+
+ String bar = org.owasp.esapi.ESAPI.encoder().encodeForHTML(param);
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().println(bar);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00392.java b/benchmarks/pairs/owasp/java/BenchmarkTest00392.java
new file mode 100644
index 0000000..43a3394
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00392.java
@@ -0,0 +1,59 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00392")
+public class BenchmarkTest00392 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00392");
+ if (param == null) param = "";
+
+ String bar = param;
+ if (param != null && param.length() > 1) {
+ StringBuilder sbxyz38384 = new StringBuilder(param);
+ bar = sbxyz38384.replace(param.length() - "Z".length(), param.length(), "Z").toString();
+ }
+
+ response.setHeader("X-XSS-Protection", "0");
+ int length = 1;
+ if (bar != null) {
+ length = bar.length();
+ response.getWriter().write(bar.toCharArray(), 0, length);
+ }
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00393.java b/benchmarks/pairs/owasp/java/BenchmarkTest00393.java
new file mode 100644
index 0000000..f16359f
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00393.java
@@ -0,0 +1,56 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00393")
+public class BenchmarkTest00393 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00393");
+ if (param == null) param = "";
+
+ String bar;
+
+ // Simple ? condition that assigns constant to bar on true condition
+ int num = 106;
+
+ bar = (7 * 18) + num > 200 ? "This_should_always_happen" : param;
+
+ response.setHeader("X-XSS-Protection", "0");
+ response.getWriter().write(bar);
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00395.java b/benchmarks/pairs/owasp/java/BenchmarkTest00395.java
new file mode 100644
index 0000000..6fcc651
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00395.java
@@ -0,0 +1,56 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00395")
+public class BenchmarkTest00395 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = request.getParameter("BenchmarkTest00395");
+ if (param == null) param = "";
+
+ String bar = "";
+ if (param != null) bar = param.split(" ")[0];
+
+ response.setHeader("X-XSS-Protection", "0");
+ int length = 1;
+ if (bar != null) {
+ length = bar.length();
+ response.getWriter().write(bar, 0, length);
+ }
+ }
+}
diff --git a/benchmarks/pairs/owasp/java/BenchmarkTest00467.java b/benchmarks/pairs/owasp/java/BenchmarkTest00467.java
new file mode 100644
index 0000000..de85fdc
--- /dev/null
+++ b/benchmarks/pairs/owasp/java/BenchmarkTest00467.java
@@ -0,0 +1,61 @@
+/**
+ * OWASP Benchmark Project v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00467")
+public class BenchmarkTest00467 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ java.util.Map This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Nick Sanidas
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/xss-00/BenchmarkTest00468")
+public class BenchmarkTest00468 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ response.setContentType("text/html;charset=UTF-8");
+
+ java.util.Map