The filterString() method in this code example normalizes the input string, validates that the input does...
Fantastic news! We've Found the answer you've been seeking!
Question:
Transcribed Image Text:
The filterString() method in this code example normalizes the input string, validates that the input does not contain a <script> tag, and then removes any noncharacter code points from the input string. Because input validation is performed before the removal of any noncharacter code points, an attacker can include noncharacter code points in the <script> tag to bypass the validation checks. Modify the program to replace all noncharacter code points with Unicode FFFD before validating input. import java.text.Normalizer; import java.text.Normalizer.Form; import java.util.regex.Matcher; import java.util.regex.Pattern; public class TagFilter { public static String filterString (String str) { String s = Normalizer.normalize (str, Form.NFKC); } } // Validate input Pattern pattern Matcher matcher if (matcher.find()) { throw new IllegalArgumentException ("Invalid input"); } } = = Pattern.compile("<script>"); pattern.matcher(s); // Deletes noncharacter code points S = s.replaceAll("[\\p{Cn}]", ""); return s; public static void main(String[] args) { // "\uFDEF" is a noncharacter code point String maliciousInput = "<scr" + "\uFDEF" +"ipt>"; String sb = filterString (maliciousInput); // sb = "<script>" X The filterString() method in this code example normalizes the input string, validates that the input does not contain a <script> tag, and then removes any noncharacter code points from the input string. Because input validation is performed before the removal of any noncharacter code points, an attacker can include noncharacter code points in the <script> tag to bypass the validation checks. Modify the program to replace all noncharacter code points with Unicode FFFD before validating input. import java.text.Normalizer; import java.text.Normalizer.Form; import java.util.regex.Matcher; import java.util.regex.Pattern; public class TagFilter { public static String filterString (String str) { String s = Normalizer.normalize (str, Form.NFKC); } } // Validate input Pattern pattern Matcher matcher if (matcher.find()) { throw new IllegalArgumentException ("Invalid input"); } } = = Pattern.compile("<script>"); pattern.matcher(s); // Deletes noncharacter code points S = s.replaceAll("[\\p{Cn}]", ""); return s; public static void main(String[] args) { // "\uFDEF" is a noncharacter code point String maliciousInput = "<scr" + "\uFDEF" +"ipt>"; String sb = filterString (maliciousInput); // sb = "<script>" X
Expert Answer:
Answer rating: 100% (QA)
To replace all noncharacter code points with Unicode FFD before validating input you can m... View the full answer
Related Book For
Income Tax Fundamentals 2013
ISBN: 9781285586618
31st Edition
Authors: Gerald E. Whittenburg, Martha Altus Buller, Steven L Gill
Posted Date:
Students also viewed these programming questions
-
Match the following, discussing the negotiation process: Column A 1 .Use your power to get the other party to give you what you want. 2. Make the first offer concession. 3. Start by asking for their...
-
Answer the questiong correctly, show approprite code and output of compiled code. Balanced Parentheses A stack is a data structure where data is accessed using the LIFO (last in first out) principle....
-
Planning is one of the most important management functions in any business. A front office managers first step in planning should involve determine the departments goals. Planning also includes...
-
1. Learn the detail background on ERP systems. Discuss how you would integrate ERP systems internal and external across your entire organization or an organization of your choice? Then discuss the...
-
Menthene, a hydrocarbon found in mint plants, has the systematic name 1-isopropyl-4-methylcyclohexene. Draw its structure.
-
Harry and Sally are on opposite sides of the room at a wedding reception. They simultaneously (in the frame of the room) take flash pictures of the bride and groom cutting the cake in the center of...
-
S. Hudson uses subsidiary ledgers and special journals in his accounting system. The accounts in the accounts payable subsidiary ledger for the most recent month are shown below: Required (a) Prepare...
-
Nick Bosch has prepared the following list of statements about bonds. 1. Bonds are a form of interest-bearing notes payable. 2. When seeking long-term financing, an advantage of issuing bonds over...
-
A student addresses a bully mocking another student, " what you're doing isn't even clever or funny, everyone has a right ti express who they are.. you know like we say every morning.. liberty and...
-
There are n chocolates and the weight of the chocolates is given as an array of integers weights/n, where weights] denote the weight of the chocolate. Every day, one can pick one chocolate, eat half...
-
Two parallel disks, 60 cm in diameter, are separated by a distance of 15 cm and completely surrounded by a large enclosure at 100C. The properties of the surfaces are T 1 = 540C, 1 = 0.7, T 2 =...
-
Give three examples of objects that belong to the String class. Give an example of an object that belongs to the PrintStream class. Name two methods that belong to the String class but not the...
-
What side effect, if any, do the following three methods have? public class Coin: { } public public void print () System.out.println(name + } } public void print (PrintStream stream) {...
-
Declare and initialize variables for holding the price and the description of an article that is available for sale.
-
Find the errors in the following statements: a. b. c. d. Rectangle r= (5, 10, 15, 20);
-
For faster sorting of letters, the U.S. Postal Service encourages companies that send large volumes of mail to use a bar code denoting the ZIP code (see Figure 8). The encoding scheme for a...
-
The Calvin cycle reactions Place the images of the Calvin cycle in the correct order. 3 CO 6.JPG C 6 ADP+6 P 6 3PG Cs; 6 ATP-6 ADP +6 P 6 BPG G 6 NADPH JADP+P 6NAD 6 BPG Cs; 6 NADPH-6 NADP- SGAP 6 3...
-
In the synthesis of the keto acid just given, the dicarboxylic acid decarboxylates in a specific way; it gives Explain. HO rather than HO
-
Skyler is covered by his company's health insurance plan. The health insurance costs his company $3,500 a year. During the year, Skyler is diagnosed with a serious illness and the health insurance...
-
For each of the following situations, indicate whether the taxpayer(s) is (are) required to file a tax return for 2012. Explain your answer. a. Helen is a single taxpayer with interest income in 2012...
-
The following additional information is available for the Dr. Ivan and Irene Incisor family from Chapters 1-6. On December 12, Irene purchased the building where her store is located. She paid...
-
Eugene Fama and Robert Shiller recently won the Nobel Prize in economics. Go to http://nobelprize.org/nobel_prizes/economics/ and locate the press release on Eugene Fama and Robert Shiller. What was...
-
Visit the Bloomberg Markets website at www.bloomberg.com/markets/stocks. Their interactive graph allows you to see cumulative returns for individual stocks as well as market indices. Over the last...
-
Compute the price of a share of stock that pays a \($5\) per year dividend and that you expect to be able to sell in one year for \($40\), assuming you require a 5% return.
Study smarter with the SolutionInn App