java - Why my two test case failed for given Regex Pattern -


when run testcase program, 2 str29 , str32 testcase failed, need regex pattern can success test cases.

my test class given below :

package com.csam.wsc.enabling.core.util.test;  import java.util.regex.pattern;  public class regularextest {      private static pattern xssattackpattern;         // pattern whilte list character      private static final string xss_attack_regular_expression = "([a-za-z0-9,()[\\\\]{}\\\":./_\\\\s]|(?<!-)-)*";      public static void main(string arg[]) {         testsqlorxssinjectionaswhitelistapproach();     }      private static pattern getxssattackpattern() {         xssattackpattern = pattern.compile(xss_attack_regular_expression);         return xssattackpattern;     }      public static boolean hasxssattackorsqlinjection(string value) {         if (getxssattackpattern().matcher(value).matches())             return false;         return true;     }      public static void testsqlorxssinjectionaswhitelistapproach() {          string str0 = "";         string str1 = ",:4,5}{a{,}1{}r,'ee4534:r,p],[a},{1}}{a{,}345:,";         string str2 = "a";         string str3 = "a#";         string str4 = "#";         string str5 = "#'";         string str6 = "123";         string str7 = "as";         string str8 = "{#}";         string str9 = "#{}";         string str10 = "!";         string str11 = "'124";         string str12 = "123'";         string str13 = "'";         string str14 = "''";         string str15 = "hello";         string str16 = "<>";         string str17 = "<>/?\":;";         string str18 = "!@#$%^&*()_+}{|\":<>?,./[]\\";         string str19 = "good";         string str20 = "a\\%27";         string str21 = ".";         string str22 = "/";         string str23 = "_";         string str24 = ".'";         string str25 = "/_";         string str26 = "_.";         string str27 = "http://rss.cnn.com/rss/edition_business.rss";         string str28 = "http://rss.cnn.com/rss/edition_business.rss?id=121132511$@#$@$@#%242444+gfghgfhg";         string str29 = "communication in progress...";         string str30 = "(";         string str31 = ")";         string str32 = "(.:[]{} ";         string str33 = "(.:[]{} #";         string str34 = "&";         string str35 = "$";         string str36 = "-dsfdsfddsfd2112212s";         string str37 = "--dsfdsfddsfd2112212s";         string str38 = "-dsfdsfdd-sfd2112212s";         string str39 = "--";         string str40 = "-";           assertfalse(str0);         asserttrue(str1);         assertfalse(str2);         asserttrue(str3);         asserttrue(str4);         asserttrue(str5);         assertfalse(str6);         assertfalse(str7);         asserttrue(str8);         asserttrue(str9);         asserttrue(str10);         asserttrue(str11);         asserttrue(str12);         asserttrue(str13);         asserttrue(str14);         assertfalse(str15);         asserttrue(str16);         asserttrue(str17);         asserttrue(str18);         assertfalse(str19);         asserttrue(str20);         assertfalse(str21);         assertfalse(str22);         assertfalse(str23);         asserttrue(str24);         assertfalse(str25);         assertfalse(str26);         assertfalse(str27);         asserttrue(str28);         assertfalse(str29);         assertfalse(str30);         assertfalse(str31);         assertfalse(str32);         asserttrue(str33);         asserttrue(str34);         asserttrue(str35);         assertfalse(str36);         asserttrue(str37);         assertfalse(str38);         asserttrue(str39);         assertfalse(str40);       }      public static void assertfalse(string value) {         boolean result = hasxssattackorsqlinjection(value);         string var = "undefined";         if (result == false) {             var = "success";         } else {             var = "fail";         }         system.out.println("for given string -> " + value + " -> " + var);     }      public static void asserttrue(string value) {         boolean result = hasxssattackorsqlinjection(value);         string var = "undefined";         if (result == true) {             var = "success";         } else {             var = "fail";         }         system.out.println("for given string -> " + value + " -> " + var);     } }

here's regex string literal:

"([a-za-z0-9,()[\\\\]{}\\\":./_\\\\s]|(?<!-)-)*"

the real regex is:

([a-za-z0-9,()[\\]{}\":./_\\s]|(?<!-)-)*

i see 2 major problems here.

  1. unlike flavors, java allows embed character class in character class. regex not match square brackets ([ or ]) because [\\] interpreted embedded character class matches backslash.

  2. \\\\s in string literal becomes \\s in regex. meant \s, class shorthand whitespace character, it's literal backslash followed s.

you need escape square brackets , fix escaping of \s. regex matches sample strings:

([a-za-z0-9,()\[\]{}":./_\s\\]|(?<!-)-)*

when create character class literal backslash in it, put backslash last. find little easier read way, , if mess things up, it's more throw exception silently match wrong thing.

note quotation mark (") doesn't need escaped regex parser, java parser. means need 1 backslash in string literal, not three. here's final, string literal form of regex:

"([a-za-z0-9,()\\[\\]{}\":./_\\s\\\\]|(?<!-)-)*"

Comments

Post a Comment

Popular posts from this blog

.htaccess - First slash is removed after domain when entering a webpage in the browser -

sometimes when hit address of webpage in browser, removes first slash after domain. examples: www.mywebsite.com/scripts/script_6.php -> trying load www.mywebsite.comscripts/script_6.php www.mywebsite.com/test.php -> trying load www.mywebsite.comtest.php after entering again, loads page. a .htaccess settings must wrong: rewritebase / errordocument 404 http://www.mywebsite.com/oops.php errordocument 401 /notallowed.php rewriteengine on # turn on rewriting engine #gzip <ifmodule mod_deflate.c> addoutputfilterbytype deflate text/text text/html text/plain text/xml text/css application/x- javascript application/javascript </ifmodule> #end gzip rewritecond %{http_host} ^mywebsite\.com rewriterule ^(.*)$ http://www.mywebsite.com$1 [r=permanent,l] directoryindex index6.php rewriterule ^termsofuse/?$ termsofuse.php [nc,l] # handle requests "adpolicy" rewriterule ^privacy-policy/?$ privacy-policy.php [nc,l] # handle requ...
Read more

Automatically create pages in phpfox -

i have array of information of places , wanna use them create multiple pages in phpfox site. first tried manually insert data in phpfox database (in tables of phpfox_pages , phpfox_pages_text ). the page shown in site when opening it's link, site says: the page looking cannot found. do know other tables should manipulate make work? or know plugin phpfox same? thanks, solved ( @purefan guide): "pages" has user if take @ phpfox_user table, you'll found out how fetch new records on that. there 2 ambiguous fields in table ( password & password_salt ). can use script create values fields: <?php function generaterandomstring() { $length = 164; $characters = '-_0123456789abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz'; $randomstring = ''; ($i = 0; $i < $length; $i++) { $randomstring .= $characters[rand(0, strlen($characters) - 1)]; } return $randomstring; } $ssalt = '';...
Read more

c# - Farseer ContactListener is not working -

i'm using farseer in xna project, have trouble contactlistener. created class contactlistener these 2 error messages , don't know how fix problems. the type or namespace name 'contactlistener' not found (are missing using directive or assembly reference?) the type or namespace name 'contactimpulse' not found (are missing using directive or assembly reference?) what wrong contactlistener class? class mycontactlistener: contactlistener { void begincontact(contact contact) { /* handle begin event */ } void endcontact(contact contact) { /* handle end event */ } void presolve(contact contact, ref manifold oldmanifold) { fixture fixturea = contact.fixturea; fixture fixtureb = contact.fixtureb; if (fixtureb.collisioncategories == category.cat10) { contact.enabled = false; } } void postsolve(contact contact, ref contactimpulse impulse) { /* handle post-solve event */ } }...
Read more