UserSettingsResource extends AbstractJaxRSResource { @POST @Path( "{setting : .+}" ) @Facet ( name = "Unsupported" ) @Produces( { APPLICATION_JSON, APPLICATION_XML } ) public Response setUserSetting( @PathParam( "setting" ) String setting, String settingValue ) { IUserSettingService settingsService = getUserSettingService(); settingValue = EscapeUtils.escapeJsonOrRaw( settingValue ); settingsService.setUserSetting( setting, settingValue ); return Response.ok( settingValue ).build(); } UserSettingsResource(); @GET @Path( "/list" ) @Produces( { APPLICATION_JSON, APPLICATION_XML } ) @Facet ( name = "Unsupported" ) ArrayList<Setting> getUserSettings(); @GET @Path( "{setting : .+}" ) @Facet ( name = "Unsupported" ) @Produces( { APPLICATION_JSON, APPLICATION_XML } ) Response getUserSetting( @PathParam( "setting" ) String setting ); @POST @Path( "{setting : .+}" ) @Facet ( name = "Unsupported" ) @Produces( { APPLICATION_JSON, APPLICATION_XML } ) Response setUserSetting( @PathParam( "setting" ) String setting, String settingValue );  }
@Test public void testSetUserSetting() throws Exception { when( userSettingsResource.getUserSettingService() ).thenCallRealMethod(); PentahoSystem.registerObject( userSettingService ); when( userSettingsResource.setUserSetting( anyString(), anyString() ) ).thenCallRealMethod(); Response response = userSettingsResource.setUserSetting( USER_SETTING_NAME, "[{\"fullPath\":\"/public/Steel Wheels/Top Customers (report).prpt\", \"title\":\"<script>if" + "(true&&'str'!='str2')alert(1)</script>\", \"lastUse\":0}]" ); verify( userSettingService ).setUserSetting( USER_SETTING_NAME, USER_SETTING_VALUE ); }