Miscellaneous bug fixes
divide by zero, inaccurate discount and totals, reflection of user input git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@273 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
rogan.dawes
225
main/project/JavaSource/org/owasp/webgoat/util/HtmlEncoder.java
Normal file
225
main/project/JavaSource/org/owasp/webgoat/util/HtmlEncoder.java
Normal file
@ -0,0 +1,225 @@
|
||||
package org.owasp.webgoat.util;
|
||||
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class HtmlEncoder
|
||||
{
|
||||
|
||||
static Map<String, Integer> e2i = new HashMap<String, Integer>();
|
||||
|
||||
static Map<Integer, String> i2e = new HashMap<Integer, String>();
|
||||
|
||||
// html entity list
|
||||
private static Object[][] entities = { { "quot", new Integer(34) }, // " - double-quote
|
||||
{ "amp", new Integer(38) }, // & - ampersand
|
||||
{ "lt", new Integer(60) }, // < - less-than
|
||||
{ "gt", new Integer(62) }, // > - greater-than
|
||||
{ "nbsp", new Integer(160) }, // non-breaking space
|
||||
{ "copy", new Integer(169) }, // <20> - copyright
|
||||
{ "reg", new Integer(174) }, // <20> - registered trademark
|
||||
{ "Agrave", new Integer(192) }, // <20> - uppercase A, grave accent
|
||||
{ "Aacute", new Integer(193) }, // <20> - uppercase A, acute accent
|
||||
{ "Acirc", new Integer(194) }, // <20> - uppercase A, circumflex accent
|
||||
{ "Atilde", new Integer(195) }, // <20> - uppercase A, tilde
|
||||
{ "Auml", new Integer(196) }, // <20> - uppercase A, umlaut
|
||||
{ "Aring", new Integer(197) }, // <20> - uppercase A, ring
|
||||
{ "AElig", new Integer(198) }, // <20> - uppercase AE
|
||||
{ "Ccedil", new Integer(199) }, // <20> - uppercase C, cedilla
|
||||
{ "Egrave", new Integer(200) }, // <20> - uppercase E, grave accent
|
||||
{ "Eacute", new Integer(201) }, // <20> - uppercase E, acute accent
|
||||
{ "Ecirc", new Integer(202) }, // <20> - uppercase E, circumflex accent
|
||||
{ "Euml", new Integer(203) }, // <20> - uppercase E, umlaut
|
||||
{ "Igrave", new Integer(204) }, // <20> - uppercase I, grave accent
|
||||
{ "Iacute", new Integer(205) }, // <20> - uppercase I, acute accent
|
||||
{ "Icirc", new Integer(206) }, // <20> - uppercase I, circumflex accent
|
||||
{ "Iuml", new Integer(207) }, // <20> - uppercase I, umlaut
|
||||
{ "ETH", new Integer(208) }, // <20> - uppercase Eth, Icelandic
|
||||
{ "Ntilde", new Integer(209) }, // <20> - uppercase N, tilde
|
||||
{ "Ograve", new Integer(210) }, // <20> - uppercase O, grave accent
|
||||
{ "Oacute", new Integer(211) }, // <20> - uppercase O, acute accent
|
||||
{ "Ocirc", new Integer(212) }, // <20> - uppercase O, circumflex accent
|
||||
{ "Otilde", new Integer(213) }, // <20> - uppercase O, tilde
|
||||
{ "Ouml", new Integer(214) }, // <20> - uppercase O, umlaut
|
||||
{ "Oslash", new Integer(216) }, // <20> - uppercase O, slash
|
||||
{ "Ugrave", new Integer(217) }, // <20> - uppercase U, grave accent
|
||||
{ "Uacute", new Integer(218) }, // <20> - uppercase U, acute accent
|
||||
{ "Ucirc", new Integer(219) }, // <20> - uppercase U, circumflex accent
|
||||
{ "Uuml", new Integer(220) }, // <20> - uppercase U, umlaut
|
||||
{ "Yacute", new Integer(221) }, // <20> - uppercase Y, acute accent
|
||||
{ "THORN", new Integer(222) }, // <20> - uppercase THORN, Icelandic
|
||||
{ "szlig", new Integer(223) }, // <20> - lowercase sharps, German
|
||||
{ "agrave", new Integer(224) }, // <20> - lowercase a, grave accent
|
||||
{ "aacute", new Integer(225) }, // <20> - lowercase a, acute accent
|
||||
{ "acirc", new Integer(226) }, // <20> - lowercase a, circumflex accent
|
||||
{ "atilde", new Integer(227) }, // <20> - lowercase a, tilde
|
||||
{ "auml", new Integer(228) }, // <20> - lowercase a, umlaut
|
||||
{ "aring", new Integer(229) }, // <20> - lowercase a, ring
|
||||
{ "aelig", new Integer(230) }, // <20> - lowercase ae
|
||||
{ "ccedil", new Integer(231) }, // <20> - lowercase c, cedilla
|
||||
{ "egrave", new Integer(232) }, // <20> - lowercase e, grave accent
|
||||
{ "eacute", new Integer(233) }, // <20> - lowercase e, acute accent
|
||||
{ "ecirc", new Integer(234) }, // <20> - lowercase e, circumflex accent
|
||||
{ "euml", new Integer(235) }, // <20> - lowercase e, umlaut
|
||||
{ "igrave", new Integer(236) }, // <20> - lowercase i, grave accent
|
||||
{ "iacute", new Integer(237) }, // <20> - lowercase i, acute accent
|
||||
{ "icirc", new Integer(238) }, // <20> - lowercase i, circumflex accent
|
||||
{ "iuml", new Integer(239) }, // <20> - lowercase i, umlaut
|
||||
{ "igrave", new Integer(236) }, // <20> - lowercase i, grave accent
|
||||
{ "iacute", new Integer(237) }, // <20> - lowercase i, acute accent
|
||||
{ "icirc", new Integer(238) }, // <20> - lowercase i, circumflex accent
|
||||
{ "iuml", new Integer(239) }, // <20> - lowercase i, umlaut
|
||||
{ "eth", new Integer(240) }, // <20> - lowercase eth, Icelandic
|
||||
{ "ntilde", new Integer(241) }, // <20> - lowercase n, tilde
|
||||
{ "ograve", new Integer(242) }, // <20> - lowercase o, grave accent
|
||||
{ "oacute", new Integer(243) }, // <20> - lowercase o, acute accent
|
||||
{ "ocirc", new Integer(244) }, // <20> - lowercase o, circumflex accent
|
||||
{ "otilde", new Integer(245) }, // <20> - lowercase o, tilde
|
||||
{ "ouml", new Integer(246) }, // <20> - lowercase o, umlaut
|
||||
{ "oslash", new Integer(248) }, // <20> - lowercase o, slash
|
||||
{ "ugrave", new Integer(249) }, // <20> - lowercase u, grave accent
|
||||
{ "uacute", new Integer(250) }, // <20> - lowercase u, acute accent
|
||||
{ "ucirc", new Integer(251) }, // <20> - lowercase u, circumflex accent
|
||||
{ "uuml", new Integer(252) }, // <20> - lowercase u, umlaut
|
||||
{ "yacute", new Integer(253) }, // <20> - lowercase y, acute accent
|
||||
{ "thorn", new Integer(254) }, // <20> - lowercase thorn, Icelandic
|
||||
{ "yuml", new Integer(255) }, // <20> - lowercase y, umlaut
|
||||
{ "euro", new Integer(8364) },// Euro symbol
|
||||
};
|
||||
|
||||
|
||||
public HtmlEncoder()
|
||||
{
|
||||
for (int i = 0; i < entities.length; i++)
|
||||
e2i.put((String)entities[i][0], (Integer)entities[i][1]);
|
||||
for (int i = 0; i < entities.length; i++)
|
||||
i2e.put((Integer)entities[i][1], (String)entities[i][0]);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Turns funky characters into HTML entity equivalents<p>
|
||||
*
|
||||
* e.g. <tt>"bread" & "butter"</tt> => <tt>&quot;bread&quot; &amp;
|
||||
* &quot;butter&quot;</tt> . Update: supports nearly all HTML entities, including funky
|
||||
* accents. See the source code for more detail. Adapted from
|
||||
* http://www.purpletech.com/code/src/com/purpletech/util/Utils.java.
|
||||
*
|
||||
* @param s1 Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public static String encode(String s1)
|
||||
{
|
||||
StringBuffer buf = new StringBuffer();
|
||||
|
||||
int i;
|
||||
for (i = 0; i < s1.length(); ++i)
|
||||
{
|
||||
char ch = s1.charAt(i);
|
||||
|
||||
String entity = i2e.get(new Integer((int) ch));
|
||||
|
||||
if (entity == null)
|
||||
{
|
||||
if (((int) ch) > 128)
|
||||
{
|
||||
buf.append("&#" + ((int) ch) + ";");
|
||||
}
|
||||
else
|
||||
{
|
||||
buf.append(ch);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
buf.append("&" + entity + ";");
|
||||
}
|
||||
}
|
||||
|
||||
return buf.toString();
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Given a string containing entity escapes, returns a string containing the actual Unicode
|
||||
* characters corresponding to the escapes. Adapted from
|
||||
* http://www.purpletech.com/code/src/com/purpletech/util/Utils.java.
|
||||
*
|
||||
* @param s1 Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public static String decode(String s1)
|
||||
{
|
||||
StringBuffer buf = new StringBuffer();
|
||||
|
||||
int i;
|
||||
for (i = 0; i < s1.length(); ++i)
|
||||
{
|
||||
char ch = s1.charAt(i);
|
||||
|
||||
if (ch == '&')
|
||||
{
|
||||
int semi = s1.indexOf(';', i + 1);
|
||||
if (semi == -1)
|
||||
{
|
||||
buf.append(ch);
|
||||
continue;
|
||||
}
|
||||
String entity = s1.substring(i + 1, semi);
|
||||
Integer iso;
|
||||
if (entity.charAt(0) == '#')
|
||||
{
|
||||
iso = new Integer(entity.substring(1));
|
||||
}
|
||||
else
|
||||
{
|
||||
iso = e2i.get(entity);
|
||||
}
|
||||
if (iso == null)
|
||||
{
|
||||
buf.append("&" + entity + ";");
|
||||
}
|
||||
else
|
||||
{
|
||||
buf.append((char) (iso.intValue()));
|
||||
}
|
||||
i = semi;
|
||||
}
|
||||
else
|
||||
{
|
||||
buf.append(ch);
|
||||
}
|
||||
}
|
||||
|
||||
return buf.toString();
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user