/**
 *  @(#)ServletUtils.java 0.01 22/02/2011
 *  Copyright (C) 2011 - 2017 MER-C
 *
 *  This program is free software: you can redistribute it and/or modify
 *  it under the terms of the GNU Affero General Public License as
 *  published by the Free Software Foundation, either version 3 of the
 *  License, or (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU Affero General Public License for more details.

 *  You should have received a copy of the GNU Affero General Public License
 *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

package org.wikipedia.servlets;

import java.util.*;

/**
 *  Common servlet code so that I can maintain it easier.
 *  @author MER-C
 */
public class ServletUtils
{
   
    /**
     *  Strips &lt; &gt; and other unwanted stuff that leads to XSS attacks.
     *  Borrowed from http://greatwebguy.com/programming/java/simple-cross-site-scripting-xss-servlet-filter
     *  @param input an input string
     *  @return <tt>input</tt>, sanitized
     */
    public static String sanitize(String input)
    {
        input = input.replaceAll("<", "&lt;").replaceAll(">", "&gt;");
        input = input.replaceAll("\\(", "&#40;").replaceAll("\\)", "&#41;");
        input = input.replaceAll("'", "&#39;");
        input = input.replaceAll("eval\\((.*)\\)", "");
        input = input.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
        input = input.replaceAll("script", "");
        return input;
    }
    
    /**
     *  Generates a HTML combo box.
     *  @param param the form parameter for the combo box
     *  @param options a map, where key = option value, value = what is displayed
     *  to the user in the order that they are specified
     *  @param selected the initially selected option value
     *  @param disabled whether this element is disabled
     *  @return HTML text that displays a combo box
     */
    public static String generateComboBox(String param, LinkedHashMap<String, String> options, String selected, boolean disabled)
    {
        StringBuilder temp = new StringBuilder(500);
        temp.append("<select name=\"");
        temp.append(param);
        temp.append("\" id=\"");
        temp.append(param);
        temp.append("\"");
        if (disabled)
            temp.append(" disabled");
        temp.append(">\n");
        for (Map.Entry<String, String> entry : options.entrySet())
        {
            temp.append("<option value=\"");
            temp.append(entry.getKey());
            if (selected == null || selected.equals(entry.getKey()))
            {
                temp.append("\" selected>");
                selected = entry.getKey();
            }
            else
                temp.append("\">");
            temp.append(entry.getValue());
            temp.append("</option>\n");
        }
        temp.append("</select>\n");
        return temp.toString();
    }
}

@@ -924,20 +924,16 @@
 Utils%0A%7B%0A
-   %0A
     /**%0A
@@ -945,221 +945,193 @@
 *  S
-trips &lt; &gt; and other unwanted stuff that leads to XSS attacks.%0A     *  Borrowed from http://greatwebguy.com/programming/java/simple-cross-site-scripting-xss-servlet-filter%0A     *  @param input an input string
+anitizes untrusted input for XSS destined for inclusion in the HTML%0A     *  body.%0A     *  @param input an input string%0A     *  @see https://www.owasp.org/index.php/XSS_Prevention Rule 1
 %0A   
@@ -1210,16 +1210,23 @@
 sanitize
+ForHTML
 (String 
@@ -1242,37 +1242,74 @@
   %7B%0A        
-input = input
+return input.replaceAll(%22&%22, %22&amp;%22)%0A            
 .replaceAll(
@@ -1344,17 +1344,16 @@
  %22&gt;%22)
-;
 %0A       
@@ -1349,37 +1349,28 @@
 ;%22)%0A        
-input = input
+    
 .replaceAll(
@@ -1374,19 +1374,18 @@
 ll(%22
-%5C%5C(
+'
 %22, %22&#
-40
+x27
 ;%22).
@@ -1401,22 +1401,21 @@
 l(%22%5C
-%5C)
+%22
 %22, %22&
-#41
+quot
 ;%22)
-;
 %0A   
@@ -1415,37 +1415,28 @@
 ;%22)%0A        
-input = input
+    
 .replaceAll(
@@ -1440,17 +1440,18 @@
 ll(%22
-'
+/
 %22, %22&#
-39
+x2F
 ;%22);
@@ -1459,223 +1459,402 @@
     
-    input = input.replaceAll(%22eval%5C%5C((.*)%5C%5C)%22, %22%22);
+%7D%0A    %0A    /**%0A     *  Sanitizes untrusted input for XSS destined for inclusion in boring%0A     *  HTML attributes.
 %0A     
+*
   
+@param
  input 
-=
+the
  input
-.replaceAll(%22%5B%5C%5C%5C%22%5C%5C%5C'%5D%5B%5C%5Cs%5D*javascript:(.*)%5B%5C%5C%5C%22%5C%5C%5C'%5D%22, %22%5C%22%5C%22%22);
+ to be sanitized%0A     *  @see https://www.owasp.org/index.php/XSS_Prevention Rule 2
 %0A     
+*
   
- input = input.replaceAll(%22script%22, %22%22);%0A        return input
+@return the sanitized input%0A     */%0A    public static String sanitizeForAttribute(String input)%0A    %7B%0A        return input.replaceAll(%22%5C%22%22, %22&quot;%22)
 ;%0A    %7D%0A
     
@@ -1841,36 +1841,32 @@
 &quot;%22);%0A    %7D%0A
-    
 %0A    /**%0A     * 

Improve XSS protection.