HttpUtil { public static String escapeForHTML(final String raw) { if (StringUtils.isNotBlank(raw)) { if (raw.indexOf('%') != -1) { return NO_TAGS.matcher(decodeUtf8UriParam(raw)).replaceAll(""); } return NO_TAGS.matcher(raw).replaceAll(""); } return raw; }  static String dumpRequest(final HttpServletRequest request); static String decodeUtf8UriParam(final String value); static String encodeUtf8UriParam(final String value); static Map<String, List<String>> getParameters(final String requestURL,
                                                          final Set<String> pathVariables); static Map<String, List<String>> getParameters(final String requestURL,
                                                          final Set<String> pathVariables,
                                                          final boolean removeDuplicates); static Map<String, List<String>> getParameters(final HttpServletRequest request,
                                                          final Set<String> pathVariables); static Map<String, List<String>> getParameters(final HttpServletRequest request,
                                                          final Set<String> pathVariables,
                                                          final boolean removeDuplicates); static Map<String, List<String>> allParameters(final HttpServletRequest request,
                                                          final Set<String> pathVariables); static Map<String, List<String>> allParameters(final HttpServletRequest request,
                                                          final Set<String> pathVariables,
                                                          final boolean removeDuplicates); static String getSingleValue(final Object param); static String escapeForHTML(final String raw); static String escapeForHTMLAttribute(final String raw);  }
@Test public void testEscapeForHTML() throws Exception { assertNull(HttpUtil.escapeForHTML(null)); assertEquals(" ", HttpUtil.escapeForHTML(" ")); assertEquals("abc", HttpUtil.escapeForHTML("abc")); assertEquals("abc=alert(\"XSS\")&def=xyz", HttpUtil.escapeForHTML("abc=</script><script>alert(\"XSS\")</script>&def=xyz")); assertEquals("abc=alert('XSS')&def=xyz", HttpUtil.escapeForHTML("abc=%3C/script%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E&def=xyz")); }