Skip to content

Commit 66421a3

Browse files
misonijnikmisonijnik
committed
Revert XSS complexity examples
1 parent 70c5c56 commit 66421a3

6 files changed

Lines changed: 297 additions & 0 deletions

File tree

‎src/main/java/org/seqra/complexity/DefaultFormatter.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
package org.seqra.complexity;
2+
3+
public class DefaultFormatter implements IFormatter {
4+
@Override
5+
public String format(String value) {
6+
return value;
7+
}
8+
}

‎src/main/java/org/seqra/complexity/EscapeFormatter.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
package org.seqra.complexity;
2+
3+
import org.springframework.web.util.HtmlUtils;
4+
5+
public class EscapeFormatter implements IFormatter {
6+
@Override
7+
public String format(String value) {
8+
return HtmlUtils.htmlEscape(value);
9+
}
10+
}

‎src/main/java/org/seqra/complexity/HtmlPageBuilder.java‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
package org.seqra.complexity;
2+
3+
import org.springframework.web.util.HtmlUtils;
4+
5+
public class HtmlPageBuilder {
6+
7+
private String message = "";
8+
9+
public HtmlPageBuilder message(String message) {
10+
this.message = message;
11+
return this;
12+
}
13+
14+
public HtmlPageBuilder escape() {
15+
this.message = HtmlUtils.htmlEscape(this.message);
16+
return this;
17+
}
18+
19+
public HtmlPageBuilder format(IFormatter formatter) {
20+
this.message = formatter.format(this.message);
21+
return this;
22+
}
23+
24+
public String buildPage() {
25+
return "<html><body><h1>Profile Message: " + message + "</h1></body></html>";
26+
}
27+
}

‎src/main/java/org/seqra/complexity/IFormatter.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
package org.seqra.complexity;
2+
3+
public interface IFormatter {
4+
String format(String value);
5+
}

‎src/main/java/org/seqra/complexity/Profile.java‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
package org.seqra.complexity;
2+
3+
import org.springframework.web.util.HtmlUtils;
4+
5+
public class Profile {
6+
// User profile data structure
7+
public static class UserProfile {
8+
public UserSettings settings;
9+
10+
public UserProfile(UserSettings settings) {
11+
this.settings = settings;
12+
}
13+
14+
public UserProfile(String text) {
15+
this.settings = new UserSettings(text);
16+
}
17+
}
18+
19+
public static class UserSettings {
20+
public NotificationConfig config;
21+
22+
public UserSettings(NotificationConfig config) {
23+
this.config = config;
24+
}
25+
26+
public UserSettings(String text) {
27+
this.config = new NotificationConfig(text);
28+
}
29+
}
30+
31+
public static class NotificationConfig {
32+
public MessageTemplate template;
33+
34+
public NotificationConfig(MessageTemplate template) {
35+
this.template = template;
36+
}
37+
38+
public NotificationConfig(String text) {
39+
this.template = new MessageTemplate(text);
40+
}
41+
}
42+
43+
public static class MessageTemplate {
44+
public MessageBody body;
45+
46+
public MessageTemplate(MessageBody body) {
47+
this.body = body;
48+
}
49+
50+
public MessageTemplate(String text) {
51+
this.body = new MessageBody("<html>" + text + "</html>");
52+
}
53+
}
54+
55+
public static class MessageBody {
56+
public MessageContent content;
57+
58+
public MessageBody(MessageContent content) {
59+
this.content = content;
60+
}
61+
62+
public MessageBody(String text) {
63+
this.content = new MessageContent("<body>" + text + "</body>");
64+
}
65+
}
66+
67+
public static class MessageContent {
68+
public String text;
69+
public String secureText;
70+
71+
public MessageContent(String text) {
72+
this.text = "<h1>Notification: " + text + "</h1>";
73+
this.secureText = "<h1>Notification: " + HtmlUtils.htmlEscape(text) + "</h1>";
74+
}
75+
}
76+
}

‎src/main/java/org/seqra/complexity/UserProfileController.java‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
package org.seqra.complexity;
2+
3+
import org.springframework.stereotype.Controller;
4+
import org.springframework.web.bind.annotation.GetMapping;
5+
import org.springframework.web.bind.annotation.RequestParam;
6+
import org.springframework.web.bind.annotation.ResponseBody;
7+
import org.springframework.web.util.HtmlUtils;
8+
9+
@Controller
10+
public class UserProfileController {
11+
12+
// Display user profile with custom message
13+
@GetMapping("/profile/display")
14+
@ResponseBody
15+
public String displayUserProfile(
16+
@RequestParam(defaultValue = "Welcome") String message) {
17+
// Direct output without escaping
18+
return "<html><body><h1>Profile Message: " + message + "</h1></body></html>";
19+
}
20+
21+
// Display user profile with escaped message
22+
@GetMapping("/profile/secureDisplay")
23+
@ResponseBody
24+
public String displaySecureUserProfile(
25+
@RequestParam(defaultValue = "Welcome") String message) {
26+
// Properly escaped output
27+
return "<html><body><h1>Profile Message: " +
28+
HtmlUtils.htmlEscape(message) + "</h1></body></html>";
29+
}
30+
31+
// Display user status with local variable assignment
32+
@GetMapping("/profile/status")
33+
@ResponseBody
34+
public String displayUserStatus(
35+
@RequestParam(defaultValue = "Active") String message) {
36+
// Assign to local variable
37+
String htmlContent = "<html><body><h1>User Status: " +
38+
message + "</h1></body></html>";
39+
return htmlContent;
40+
}
41+
42+
// Display escaped user status with local variable assignment
43+
@GetMapping("/profile/secureStatus")
44+
@ResponseBody
45+
public String displaySecureUserStatus(
46+
@RequestParam(defaultValue = "Active") String message) {
47+
// Assign to local variable
48+
String htmlContent = "<html><body><h1>User Status: " +
49+
HtmlUtils.htmlEscape(message) + "</h1></body></html>";
50+
return htmlContent;
51+
}
52+
53+
// Generate user dashboard with escaped greeting
54+
@GetMapping("/dashboard/greeting")
55+
@ResponseBody
56+
public String generateDashboard(
57+
@RequestParam(defaultValue = "Welcome") String greeting) {
58+
String htmlContent = buildDashboardContent(greeting);
59+
return htmlContent;
60+
}
61+
62+
private static String buildDashboardContent(String greeting) {
63+
// Generate dashboard HTML content
64+
return "<html><body><h1>Dashboard: " + greeting + "</h1></body></html>";
65+
}
66+
67+
// Generate user dashboard with custom greeting
68+
@GetMapping("/dashboard/secureGreeting")
69+
@ResponseBody
70+
public String generateSecureDashboard(
71+
@RequestParam(defaultValue = "Welcome") String greeting) {
72+
String htmlContent = buildSecureDashboardContent(greeting);
73+
return htmlContent;
74+
}
75+
76+
private static String buildSecureDashboardContent(String greeting) {
77+
// Generate dashboard HTML content with escaped greeting
78+
return "<html><body><h1>Dashboard: " +
79+
HtmlUtils.htmlEscape(greeting) + "</h1></body></html>";
80+
}
81+
82+
// Generate message template
83+
@GetMapping("/notifications/template")
84+
@ResponseBody
85+
public String generateTemplate(
86+
@RequestParam(defaultValue = "New Message") String content) {
87+
Profile.MessageTemplate template = new Profile.MessageTemplate(content);
88+
// Return nested content
89+
return template.body.content.text;
90+
}
91+
92+
// Generate message template
93+
@GetMapping("/notifications/secureTemplate")
94+
@ResponseBody
95+
public String generateSecureTemplate(
96+
@RequestParam(defaultValue = "New Message") String content) {
97+
Profile.MessageTemplate template = new Profile.MessageTemplate(content);
98+
// Return nested escaped content
99+
return template.body.content.secureText;
100+
}
101+
102+
// Generate user notification with complex data structure
103+
@GetMapping("/notifications/generate")
104+
@ResponseBody
105+
public String generateNotification(
106+
@RequestParam(defaultValue = "New Message") String content) {
107+
// Create user profile with nested message structure using constructors
108+
Profile.UserProfile profile = new Profile.UserProfile(content);
109+
110+
// Return nested content
111+
return profile.settings.config.template.body.content.text;
112+
}
113+
114+
// Generate user notification with complex data structure
115+
@GetMapping("/notifications/secureGenerate")
116+
@ResponseBody
117+
public String generateSecureNotification(
118+
@RequestParam(defaultValue = "New Message") String content) {
119+
// Create user profile with nested message structure using constructors
120+
Profile.UserProfile profile = new Profile.UserProfile(content);
121+
122+
// Return nested content
123+
return profile.settings.config.template.body.content.secureText;
124+
}
125+
126+
// Display custom message
127+
@GetMapping("/message/display")
128+
@ResponseBody
129+
public String displayMessage(
130+
@RequestParam(defaultValue = "Welcome") String message) {
131+
// Construct a page using a chain of builders
132+
String page = new HtmlPageBuilder().message(message).buildPage();
133+
134+
return page;
135+
}
136+
137+
// Display custom message
138+
@GetMapping("/message/secureDisplay")
139+
@ResponseBody
140+
public String displaySecureMessage(
141+
@RequestParam(defaultValue = "Welcome") String message) {
142+
// Construct a page using a chain of builders
143+
String page = new HtmlPageBuilder().message(message).escape().buildPage();
144+
145+
return page;
146+
}
147+
148+
// Display formatted message
149+
@GetMapping("/message/format")
150+
@ResponseBody
151+
public String formatMessage(
152+
@RequestParam(defaultValue = "Welcome") String message) {
153+
// Construct a page using a formatter as a parameter for a chain of builders
154+
String page = new HtmlPageBuilder().message(message)
155+
.format(new DefaultFormatter()).buildPage();
156+
157+
return page;
158+
}
159+
160+
// Display escaped message
161+
@GetMapping("/message/escape")
162+
@ResponseBody
163+
public String escapeMessage(
164+
@RequestParam(defaultValue = "Welcome") String message) {
165+
// Construct a page using a formatter as a parameter for a chain of builders
166+
String page = new HtmlPageBuilder().message(message)
167+
.format(new EscapeFormatter()).buildPage();
168+
169+
return page;
170+
}
171+
}

0 commit comments

Comments
 (0)