SecurityXssFilter extends OncePerRequestFilter { @SuppressWarnings("unused") @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { if (request.getMethod().equalsIgnoreCase("POST") || request.getMethod().equalsIgnoreCase("PUT")) { HttpServletRequest requestToCache = new ContentCachingRequestWrapper(request); HttpServletResponse responseToCache = new ContentCachingResponseWrapper(response); filterChain.doFilter(requestToCache, responseToCache); String requestData = getRequestData(requestToCache); String responseData = getResponseData(responseToCache); if (StringUtils.isNotBlank(requestData) && validator.denyXSS(requestData)) { throw new SecurityException(BAD_REQUEST); } } else { filterChain.doFilter(request, response); } }    }
@Test public void testGets() throws ServletException, IOException { SecurityXssFilter filter = new SecurityXssFilter(); assertNotNull(filter); MockHttpServletRequest request = new MockHttpServletRequest(); request.setMethod("POST"); request.setBodyContent("testBody"); request.setupAddParameter("testKey", "testVal"); request.setAttribute("testKey", "testVal"); request.setRequestURI("testVal"); request.setRequestURL("testVal"); MockHttpServletResponse response = new MockHttpServletResponse(); FilterChain filterChain = Mockito.mock(FilterChain.class); filter.doFilterInternal(request, response, filterChain); assertEquals(response.getStatusCode(), HttpServletResponse.SC_OK); }