GetGeoPointDataService { public JSONObject getWMSFeatureInfo(final GFIRequestParams params) { final String gfiResponse = makeGFIcall(params.getGFIUrl(), params.getLayer().getUsername(), params.getLayer().getPassword()); if (gfiResponse == null || gfiResponse.trim().isEmpty()) { return null; } final JSONObject response = new JSONObject(); JSONHelper.putValue(response, TYPE, params.getLayer().getType()); JSONHelper.putValue(response, LAYER_ID, params.getLayer().getId()); final String xslt = params.getLayer().getGfiXslt(); JSONObject respObj = null; if (xslt != null && !xslt.isEmpty()) { final String transformedResult = transformResponse(xslt, gfiResponse); respObj = JSONHelper.createJSONObject(transformedResult); if(respObj != null) { JSONHelper.putValue(response, PRESENTATION_TYPE, PRESENTATION_TYPE_JSON); JSONHelper.putValue(response, CONTENT, respObj); } } if(respObj == null) { JSONHelper.putValue(response, PRESENTATION_TYPE, PRESENTATION_TYPE_TEXT); JSONHelper.putValue(response, CONTENT, getSafeHtmlContent(gfiResponse, params.getGFIUrl())); } final String gfiContent = params.getLayer().getGfiContent(); if (gfiContent != null) { JSONHelper.putValue(response, GFI_CONTENT, gfiContent); } return response; }  JSONObject getWMSFeatureInfo(final GFIRequestParams params); static String getSafeHtmlContent(String response, String url); JSONObject getRESTFeatureInfo(final GFIRestQueryParams params); static String getFormattedJSONString(Document document, StreamSource stylesource); static final String TYPE; static final String LAYER_ID; static final String PRESENTATION_TYPE; static final String CONTENT; static final String PARSED; static final String GFI_CONTENT; static final String KEY_INFO; static final String MESSAGE_NO_SUPPORT; static final String REST_KEY_FEATURES; static final String REST_KEY_ATTRIBUTES; static final String PRESENTATION_TYPE_JSON; static final String PRESENTATION_TYPE_TEXT; }
@Test public void testResponseCleaning() throws Exception { final String dirty = "<html><head><title>Document title</title><style></style><script>alert('illegal!')</script></head><body><h4>Allowed</h4></body></html>"; GetGeoPointDataService partialMock = PowerMockito.spy(new GetGeoPointDataService()); PowerMockito.doReturn(dirty).when(partialMock, "makeGFIcall", anyString(), anyString(), anyString()); GFIRequestParams params = new GFIRequestParams(); final OskariLayer layer = new OskariLayer(); layer.setUsername("name"); layer.setPassword("anything"); layer.setUrl("http: layer.setName("layerName"); params.setLayer(layer); JSONObject response = partialMock.getWMSFeatureInfo(params); assertEquals("Should have cleaned html", response.optString("content"), "<h4>Allowed</h4>"); }