// Copyright 2011 Google Inc.
// 
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
// 
//      http://www.apache.org/licenses/LICENSE-2.0
// 
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package com.google.dotorg.translation_workflow.servlet;

/**
 * Never, under any circumstances, trust data that comes from the browser
 * 
 * @author Brian Douglas Skinner
 */
public class Validator {
  // Accept only A-Z, a-z, 0-9, -, _, and the space character. Discard everything else.
  public static final Validator ALPHA_NUMERIC = new Validator("[^-_ \\da-zA-Z]");
  
  private String filterOutRegex;
  
  private Validator(String filterOutRegex) {
    this.filterOutRegex = filterOutRegex;
  }
  
  public String filter(String input) {
    if (input == null) {
      return "";
    }
    return input.replaceAll(filterOutRegex,"");
  }
}

@@ -793,43 +793,442 @@
 %7B%0A  
-// Accept only
+private static final String LATIN_HTML_SAFE_CHARACTERS = %22%5Cu0041-%5Cu0240%22;  // unicode block%0A  private static final String COMBINING_DIACRITICAL_MARKS = %22%5Cu0300-%5Cu036F%22; // unicode block%0A  private static final String WHITELISTED_CHARACTERS = %22-._ %5C%5Cd%22; // regex%0A  private static final String ACCEPTED_CHARACTERS =%0A      LATIN_HTML_SAFE_CHARACTERS + COMBINING_DIACRITICAL_MARKS + WHITELISTED_CHARACTERS;%0A  %0A  /* Accept
  A-Z
-,
  a-z
-,
  0-9
-,
  -
-,
  _
-,
+ .
  and
@@ -1253,32 +1253,155 @@
 er. 
-Discard everything else.
+%0A   * Accept Unicode points for individual diacritical marks.%0A   * Accept Unicode points for Latin characters that include diacritical marks.%0A   */
 %0A  p
@@ -1466,20 +1466,35 @@
 (%22%5B%5E
--_ %5C%5Cda-zA-Z
+%22 + ACCEPTED_CHARACTERS + %22
 %5D%22);

Fix input validation for all fields (project name, project description, volunteer nickname) to allow Diacritical marks while still banning HTML characters like < > " ' &