PluggableUploadFileServlet extends HttpServlet implements Servlet { protected void doPost( HttpServletRequest request, HttpServletResponse response ) throws ServletException, IOException { try { IUploadFileServletPlugin uploaderPlugin = getUploaderBean( getDispatchKey( request ), response ); if ( uploaderPlugin == null ) { return; } response.setContentType( "text/plain" ); FileItem uploadItem = getFileItem( request, uploaderPlugin.getMaxFileSize() ); if ( uploadItem == null ) { response.getWriter().write( Messages.getInstance().getErrorString( "PluggableUploadFileServlet.ERROR_0001_NO_FILE_TO_UPLOAD" ) ); return; } String path = PentahoSystem.getApplicationContext().getSolutionPath( uploaderPlugin.getTargetFolder() ); File pathDir = new File( path ); if ( !pathDir.exists() ) { pathDir.mkdirs(); } if ( uploadItem.getSize() + getFolderSize( pathDir ) > uploaderPlugin.getMaxFolderSize() ) { response.getWriter().write( Messages.getInstance().getErrorString( "PluggableUploadFileServlet.ERROR_0004_FOLDER_SIZE_LIMIT_REACHED" ) ); return; } UUID id = UUIDUtil.getUUID(); String filename = id.toString() + uploaderPlugin.getFileExtension(); File outFile = new File( path, filename ); if ( doesFileExists( outFile ) ) { response.getWriter().write( Messages.getInstance().getErrorString( "PluggableUploadFileServlet.ERROR_0002_FILE_ALREADY_EXIST" ) ); return; } InputStream fileInputStream = uploadItem.getInputStream(); FileOutputStream outputStream = new FileOutputStream( outFile ); try { IOUtils.copy( fileInputStream, outputStream ); } finally { if ( outputStream != null ) { outputStream.close(); } if ( fileInputStream != null ) { fileInputStream.close(); } } uploaderPlugin.onSuccess( outFile.getAbsolutePath(), response ); } catch ( Exception e ) { response.getWriter().write( Messages.getInstance().getErrorString( "PluggableUploadFileServlet.ERROR_0005_UNKNOWN_ERROR", e.getLocalizedMessage() ) ); } }  String getDispatchKey( HttpServletRequest request );  }
@Test public void testXSSUsingPathInfo() throws Exception { when( httpServletRequest.getPathInfo() ).thenReturn( "<script>alert('XSS')</script>" ); IPluginManager pluginManager = mock( IPluginManager.class ); when( pluginManager.isBeanRegistered( anyString() ) ).thenReturn( false ); PentahoSystem.registerObject( pluginManager ); try ( StringWriter stringWriter = new StringWriter(); PrintWriter printWriter = new PrintWriter( stringWriter ) ) { when( httpServletResponse.getWriter() ).thenReturn( printWriter ); pluggableUploadFileServlet.doPost( httpServletRequest, httpServletResponse ); assertTrue( stringWriter.toString().contains( "&lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;" ) ); } }