ParameterXmlContentHandler { Element createErrorElements( final ValidationResult vr ) { final Element errors = document.createElement( "errors" ); for ( final String property : vr.getProperties() ) { for ( final ValidationMessage message : vr.getErrors( property ) ) { final Element error = document.createElement( "error" ); error.setAttribute( "parameter", HtmlUtils.htmlEscape( property ) ); error.setAttribute( "message", message.getMessage() ); errors.appendChild( error ); } } final ValidationMessage[] globalMessages = vr.getErrors(); for ( final ValidationMessage globalMessage : globalMessages ) { final Element error = document.createElement( "global-error" ); error.setAttribute( "message", globalMessage.getMessage() ); errors.appendChild( error ); } return errors; } ParameterXmlContentHandler( final ParameterContentGenerator contentGenerator, final boolean paginate ); static String convertParameterValueToString( final ParameterDefinitionEntry parameter,
                                                      final ParameterContext context, final Object value,
                                                      final Class<?> type ); void createParameterContent( final OutputStream outputStream,
                                      final Serializable fileId,
                                      final String path,
                                      boolean overrideOutputType,
                                      final MasterReport sourceReport ); static final String SYS_PARAM_ACCEPTED_PAGE; static final String SYS_PARAM_RENDER_MODE; static final String SYS_PARAM_CONTENT_LINK; static final String SYS_PARAM_SESSION_ID; static final String SYS_SERVER_NAMESPACE; }
@Test public void createErrorElementsTest() throws ParserConfigurationException, XPathExpressionException { final ValidationResult vr = new ValidationResult(); vr.addError( "parameter1", new ValidationMessage( "not good" ) ); vr.addError( "parameter2", new ValidationMessage( "not good at all" ) ); vr.addError( new ValidationMessage( "kernel panic" ) ); final Map<String, String> attrMap = new HashMap(); attrMap.put( "parameter3", "" ); attrMap.put( "parameter2", "not good at all" ); attrMap.put( "parameter1", "not good" ); handler.document = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument(); final Element el = handler.createErrorElements( vr ); handler.document.appendChild( el ); assertNotNull( el ); assertEquals( 3, el.getChildNodes().getLength() ); final XPath xpath = xpathFactory.newXPath(); final NodeList found = NodeList.class.cast( xpath.evaluate( "/errors/error", handler.document, XPathConstants.NODESET ) ); assertNotNull( found ); for ( int i = 0; i < found.getLength(); i++ ) { final Node node = found.item( i ); assertEquals( "error", node.getNodeName() ); final Element oneError = (Element) node; final String paramName = oneError.getAttribute( "parameter" ); assertTrue( attrMap.containsKey( paramName ) ); assertEquals( attrMap.get( paramName ), oneError.getAttribute( "message" ) ); } final Node globalError = (Node) xpath.evaluate( "/errors/global-error", handler.document, XPathConstants.NODE ); assertNotNull( globalError ); assertEquals( "global-error", globalError.getNodeName() ); final Element globalErrEl = Element.class.cast( globalError ); assertEquals( "kernel panic", globalErrEl.getAttribute( "message" ) ); }
@Test public void createErrorElementsXSSInjectionTest() throws ParserConfigurationException, XPathExpressionException { final ValidationResult vr = new ValidationResult(); String xssParameter = "<script>alert('xss');</script>"; vr.addError( xssParameter, new ValidationMessage( "not good" ) ); final Map<String, String> attrMap = new HashMap(); attrMap.put( xssParameter, "not good" ); handler.document = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument(); final Element el = handler.createErrorElements( vr ); handler.document.appendChild( el ); assertNotNull( el ); assertEquals( 1, el.getChildNodes().getLength() ); final XPath xpath = xpathFactory.newXPath(); final NodeList found = NodeList.class.cast( xpath.evaluate( "/errors/error", handler.document, XPathConstants.NODESET ) ); assertNotNull( found ); for ( int i = 0; i < found.getLength(); i++ ) { final Node node = found.item( i ); assertEquals( "error", node.getNodeName() ); final Element oneError = (Element) node; final String paramName = oneError.getAttribute( "parameter" ); assertEquals( HtmlUtils.htmlEscape( xssParameter ), paramName ); } }