@Test public void shouldEscapeHTMLInExperience() throws Exception { Map<String, String> experience = new HashMap<>(); experience.put(Profile.EXPERIENCES_ID, "1"); experience.put(Profile.EXPERIENCES_COMPANY, "<script>alert(1)</script>"); experience.put(Profile.EXPERIENCES_POSITION, "<script>alert(2)</script>"); experience.put(Profile.EXPERIENCES_DESCRIPTION, "<svg onload=alert(3) experience.put(Profile.EXPERIENCES_SKILLS, "<svg onload=alert(4) experience.put(Profile.EXPERIENCES_IS_CURRENT, "false"); Map<String, String> escapedExperience = UserProfileHelper.escapeExperience(experience); assertNotNull(escapedExperience); assertEquals("1", escapedExperience.get(Profile.EXPERIENCES_ID)); assertEquals("&lt;script&gt;alert(1)&lt;/script&gt;", escapedExperience.get(Profile.EXPERIENCES_COMPANY)); assertEquals("&lt;script&gt;alert(2)&lt;/script&gt;", escapedExperience.get(Profile.EXPERIENCES_POSITION)); assertEquals("&lt;svg onload=alert(3) assertEquals("&lt;svg onload=alert(4) }
public static Map<String, String> escapeExperience(Map<String, String> experience) { Map<String, String> escapedExperience = new LinkedHashMap<>(); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_ID); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_COMPANY); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_POSITION); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_DESCRIPTION); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_SKILLS); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_START_DATE); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_END_DATE); return escapedExperience; }
UserProfileHelper { public static Map<String, String> escapeExperience(Map<String, String> experience) { Map<String, String> escapedExperience = new LinkedHashMap<>(); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_ID); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_COMPANY); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_POSITION); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_DESCRIPTION); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_SKILLS); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_START_DATE); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_END_DATE); return escapedExperience; } }
UserProfileHelper { public static Map<String, String> escapeExperience(Map<String, String> experience) { Map<String, String> escapedExperience = new LinkedHashMap<>(); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_ID); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_COMPANY); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_POSITION); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_DESCRIPTION); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_SKILLS); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_START_DATE); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_END_DATE); return escapedExperience; }  }
UserProfileHelper { public static Map<String, String> escapeExperience(Map<String, String> experience) { Map<String, String> escapedExperience = new LinkedHashMap<>(); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_ID); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_COMPANY); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_POSITION); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_DESCRIPTION); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_SKILLS); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_START_DATE); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_END_DATE); return escapedExperience; }  static Map<String, Object> getDisplayProfileInfo(Profile currentProfile); static List<Map<String, String>> getSortedExperiences(Profile currentProfile); static List<Map<String, String>> getMultiValues(Profile currentProfile, String key); static List<String> getURLValues(Profile currentProfile); static boolean isString(Object s); static boolean isURL(String key); static String toAbsoluteURL(String url); static boolean isIMs(String key); static boolean isGender(String key); static String getIconCss(String key); static Map<String, String> escapeExperience(Map<String, String> experience); static String getLabel(WebuiRequestContext context, String key); static boolean isExistingEmail(String email); }
UserProfileHelper { public static Map<String, String> escapeExperience(Map<String, String> experience) { Map<String, String> escapedExperience = new LinkedHashMap<>(); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_ID); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_COMPANY); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_POSITION); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_DESCRIPTION); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_SKILLS); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_START_DATE); putExperienceData(experience, escapedExperience, Profile.EXPERIENCES_END_DATE); return escapedExperience; }  static Map<String, Object> getDisplayProfileInfo(Profile currentProfile); static List<Map<String, String>> getSortedExperiences(Profile currentProfile); static List<Map<String, String>> getMultiValues(Profile currentProfile, String key); static List<String> getURLValues(Profile currentProfile); static boolean isString(Object s); static boolean isURL(String key); static String toAbsoluteURL(String url); static boolean isIMs(String key); static boolean isGender(String key); static String getIconCss(String key); static Map<String, String> escapeExperience(Map<String, String> experience); static String getLabel(WebuiRequestContext context, String key); static boolean isExistingEmail(String email); static final String CSS_ICON_PREFIX; final static String KEY; final static String VALUE; final static String URL_KEY; final static String OTHER_KEY; final static String DEFAULT_PROTOCOL; final static DateTimeFormatter DATE_TIME_FORMATTER; }