@@ -0,0 +1,1497 @@
+%0Aimport java.io.*;%0Aimport javax.servlet.ServletException;%0Aimport javax.servlet.http.HttpServlet;%0Aimport javax.servlet.http.HttpServletRequest;%0Aimport javax.servlet.http.HttpServletResponse;%0A%0Aimport org.owasp.esapi.ESAPI;%0A%0Apublic final class DirTraversalTest extends HttpServlet %7B%0A%09%0A%09private static final long serialVersionUID = 1L;%0A%09private static final int MAX_FILE_SIZE = 1024;%0A%09private static final String DIR = %22/home/student/downloads/%22;%0A%0A%09public void doGet(HttpServletRequest request, HttpServletResponse response)%0A%09%09throws IOException, ServletException %7B%0A%09%09%0A%09%09// validate the file name here%0A%09%09String fileName = request.getParameter(%22fName%22);%0A%09%09boolean isValid = ESAPI.validator().isValidFileName(%22HelloServlet%22, fileName, false);%0A%09%09if (!isValid) %7B%0A%09%09%09response.sendError(HttpServletResponse.SC_FORBIDDEN);%0A%09%09%09return;%0A%09%09%7D%0A%09%09%0A%09%09byte data%5B%5D = new byte%5BMAX_FILE_SIZE%5D;%0A%09%09int numBytes = 0;%0A%09%09int totalBytesRead = 0;%0A%09%09FileInputStream fis = null;%0A%09%09OutputStream out = null;%0A%09%09%0A%09%09try %7B%0A%09%09%09fis = new FileInputStream (DIR + fileName);%0A%09%09%09while (numBytes != -1 && totalBytesRead %3C MAX_FILE_SIZE) %7B%0A%09%09        numBytes = fis.read(data, totalBytesRead, MAX_FILE_SIZE - totalBytesRead);%0A%09%09        totalBytesRead += numBytes;%0A%09%09    %7D%0A%09%09%09%0A%09%09%09response.setContentType(%22text/html%22);%0A%09%09%09out = response.getOutputStream();%0A%09%09%09out.write(data, 0, totalBytesRead);%0A%09%09%7D catch(IOException e) %7B%0A%09%09%09response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);%0A%09%09%7D finally %7B%0A%09%09%09fis.close();%0A%09%09%09out.close();%0A%09%09%7D%0A%09%7D%0A%7D%0A

Create DirTraversalTest.java