Click here to Skip to main content
15,892,480 members
Articles / Programming Languages / Java

XSS vulnarability detection tool for JSP

Rate me:
Please Sign up or sign in to vote.
4.94/5 (11 votes)
30 Jul 2013CPOL7 min read 48.2K   536   8  
A tool to detect unsafe use of EL which leads to XSS vulnarability.
/*----------------------------------------------------------------------------------------------------------------------
 * PACKAGE  : org.apache.tomcat.jasper
 * FILE     : JSPCOptions.java
 * CREATED  : Feb 28, 2013 4:33:31 PM
 * COPYRIGHT: Copyright (c) 2008, Fundtech INDIA Ltd.
 *--------------------------------------------------------------------------------------------------------------------*/
package org.apache.jasper.compiler;

import java.io.File;
import java.util.Map;

import org.apache.jasper.Options;
import org.apache.jasper.compiler.JspConfig;
import org.apache.jasper.compiler.TagPluginManager;
import org.apache.jasper.compiler.TldLocationsCache;

/**
 * @author Prasad P. Khandekar
 * @version $Id$
 */
public class JSPCOptions implements Options
{
	private JspConfig cfg = null;
	private TagPluginManager plugMgr = null;
	private TldLocationsCache cache = null;

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#genStringAsCharArray()
	 */
	@Override
	public boolean genStringAsCharArray()
	{
		return false;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getCache()
	 */
	@SuppressWarnings("rawtypes")
	@Override
	public Map getCache()
	{
		return null;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getCheckInterval()
	 */
	@Override
	public int getCheckInterval()
	{
		return 3600;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getClassDebugInfo()
	 */
	@Override
	public boolean getClassDebugInfo()
	{
		return true;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getClassPath()
	 */
	@Override
	public String getClassPath()
	{
		return null;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getCompiler()
	 */
	@Override
	public String getCompiler()
	{
		return "jasper";
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getCompilerClassName()
	 */
	@Override
	public String getCompilerClassName()
	{
		return "org.apache.jasper.compiler.JDTCompiler";
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getCompilerSourceVM()
	 */
	@Override
	public String getCompilerSourceVM()
	{
		return "1.5";
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getCompilerTargetVM()
	 */
	@Override
	public String getCompilerTargetVM()
	{
		return "1.5";
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getDevelopment()
	 */
	@Override
	public boolean getDevelopment()
	{
		return true;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getDisplaySourceFragment()
	 */
	@Override
	public boolean getDisplaySourceFragment()
	{
		return true;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getErrorOnUseBeanInvalidClassAttribute()
	 */
	@Override
	public boolean getErrorOnUseBeanInvalidClassAttribute()
	{
		return true;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getFork()
	 */
	@Override
	public boolean getFork()
	{
		return false;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getIeClassId()
	 */
	@Override
	public String getIeClassId()
	{
		return "clsid:8AD9C840-044E-11D1-B3E9-00805F499D93";
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getJavaEncoding()
	 */
	@Override
	public String getJavaEncoding()
	{
		return "UTF8";
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getJspConfig()
	 */
	@Override
	public JspConfig getJspConfig()
	{
		return cfg;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getKeepGenerated()
	 */
	@Override
	public boolean getKeepGenerated()
	{
		return false;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getMappedFile()
	 */
	@Override
	public boolean getMappedFile()
	{
		return true;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getModificationTestInterval()
	 */
	@Override
	public int getModificationTestInterval()
	{
		return 3600;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getRecompileOnFail()
	 */
	@Override
	public boolean getRecompileOnFail()
	{
		return false;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getScratchDir()
	 */
	@Override
	public File getScratchDir()
	{
		String strDir = null;

		strDir = System.getProperty("java.io.tmpdir");
		return new File(strDir);
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getSendErrorToClient()
	 */
	@Override
	@Deprecated
	public boolean getSendErrorToClient()
	{
		return false;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getTagPluginManager()
	 */
	@Override
	public TagPluginManager getTagPluginManager()
	{
		return plugMgr;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getTldLocationsCache()
	 */
	@Override
	public TldLocationsCache getTldLocationsCache()
	{
		return cache;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#getTrimSpaces()
	 */
	@Override
	public boolean getTrimSpaces()
	{
		return true;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#isCaching()
	 */
	@Override
	public boolean isCaching()
	{
		return false;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#isPoolingEnabled()
	 */
	@Override
	public boolean isPoolingEnabled()
	{
		return false;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#isSmapDumped()
	 */
	@Override
	public boolean isSmapDumped()
	{
		return true;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#isSmapSuppressed()
	 */
	@Override
	public boolean isSmapSuppressed()
	{
		return false;
	}

	/* (non-Javadoc)
	 * @see org.apache.jasper.Options#isXpoweredBy()
	 */
	@Override
	public boolean isXpoweredBy()
	{
		return false;
	}

	public void setJspConfig(JspConfig jspConfig)
	{
		cfg = jspConfig;
	}

	public void setTldLocationCache(TldLocationsCache tldCache)
	{
		cache = tldCache;
	}

	public void setTagPluginmanager(TagPluginManager mgr)
	{
		plugMgr = mgr;
	}
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Software Developer (Senior) Freelancer
India India
I am a software professional with over 20 years of commercial business applications design and development experience.

My programming experience includes Java, Spring, .NET, Classic VB & ASP, Scripting, Power Builder, PHP, Magic & far far ago FoxPro, C, Assembly and COBOL.

From last 11 years I am mostly working with Java Technology. I am currently available to take up new assignments.

Comments and Discussions