UIServlet extends ServletBase { @Override protected void doGet( final HttpServletRequest request, final HttpServletResponse response ) throws ServletException, IOException { PentahoSystem.systemEntryPoint(); try { OutputStream outputStream = response.getOutputStream(); String path = request.getContextPath(); IPentahoSession userSession = getPentahoSession( request ); HttpSession session = request.getSession(); String type = MediaType.valueOf( request.getParameter( "type" ) ).toString(); if ( type == null ) { type = "text/html"; } String componentName = StringEscapeUtils.escapeHtml( request.getParameter( "component" ) ); if ( componentName == null ) { response.setContentType( "text/html" ); StringBuffer buffer = new StringBuffer(); formatErrorMessage( userSession, buffer, "UIServlet.ERROR_0001_COMPONENT_NOT_SPECIFIED" ); outputStream.write( buffer.toString().getBytes( LocaleHelper.getSystemEncoding() ) ); return; } response.setCharacterEncoding( LocaleHelper.getSystemEncoding() ); IUIComponent component = (IUIComponent) session.getAttribute( componentName ); if ( component == null ) { component = getComponent( componentName ); if ( component == null ) { response.setContentType( "text/html" ); StringBuffer buffer = new StringBuffer(); formatErrorMessage( userSession, buffer, "UIServlet.ERROR_0002_COMPONENT_INVALID" ); outputStream.write( buffer.toString().getBytes( LocaleHelper.getSystemEncoding() ) ); return; } session.setAttribute( componentName, component ); } if ( !component.validate() ) { return; } String baseUrl = request.getScheme() + ": response.setContentType( type ); HttpOutputHandler outputHandler = new HttpOutputHandler( response, outputStream, true ); SimpleUrlFactory urlFactory = new SimpleUrlFactory( baseUrl ); HttpServletRequestHandler requestHandler = new HttpServletRequestHandler( userSession, null, request, outputHandler, urlFactory ); requestHandler.handleUIRequest( component, type ); } finally { PentahoSystem.systemExitPoint(); } }  @Override Log getLogger();  }
@Test public void testDoGet() throws Exception { doReturn( responseOutputStream ).when( response ).getOutputStream(); doReturn( session ).when( request ).getSession(); doNothing().when( session ).setAttribute( anyString(), anyObject() ); doReturn( "application/json" ).when( request ).getParameter( "type" ); doReturn( "/><system.alert(\"hi!\")/><" ).doReturn( "UIServlet" ).when( request ).getParameter( "component" ); uiServlet.doGet( request, response ); verify( response ).setContentType( "text/html" ); verify( uiServlet ).getComponent( "/&gt;&lt;system.alert(&quot;hi!&quot;)/&gt;&lt;" ); uiServlet.doGet( request, response ); verify( uiServlet ).getComponent( "UIServlet" ); }