add othermethods for fetching parameter from servlet

yaklang · Jul 23, 2024 · 53b0434 · 53b0434
1 parent 5269bea
commit 53b0434
Show file tree

Hide file tree

Showing 3 changed files with 52 additions and 0 deletions.
diff --git a/...sample/src/main/java/com/example/demo/controller/contextreq/ContextRequestController.java b/...sample/src/main/java/com/example/demo/controller/contextreq/ContextRequestController.java
@@ -1,9 +1,11 @@
 package com.example.demo.controller.contextreq;
 
+import com.example.demo.controller.utils.DummyUtil;
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.context.request.RequestContextHolder;
 import org.springframework.web.context.request.ServletRequestAttributes;
 import org.springframework.web.servlet.ModelAndView;
@@ -36,4 +38,27 @@ public ModelAndView unstandardRequestHandler2() {
         mav.addObject("name", request.getParameter("name"));
         return mav;
     }
+
+    @RequestMapping("/xss/mvc/holderreq-cross")
+    public ModelAndView unstandardRequestHandlerHolder2() {
+        ModelAndView mav = new ModelAndView("welcome");
+        if (request == null) {
+            mav.addObject("name", "Cotton Eye Joe");
+            return mav;
+        }
+        mav.addObject("name", DummyUtil.getParameter("name"));
+        return mav;
+    }
+
+    @RequestMapping("/xss/mvc/holderreq-cross-2")
+    public String unstandardRequestHandlerHolder3() {
+        // this is a hard case, we need to check the request object
+        // and the DummyUtil.getParameter() method
+        HttpServletRequest request = DummyUtil.getRequest();
+        if (request == null) {
+            return "welcome";
+        }
+        request.setAttribute("name", request.getParameter("name"));
+        return "welcome";
+    }
 }
diff --git a/...le/src/main/java/com/example/demo/controller/contextreq/RestContextRequestController.java b/...le/src/main/java/com/example/demo/controller/contextreq/RestContextRequestController.java
@@ -1,5 +1,6 @@
 package com.example.demo.controller.contextreq;
 
+import com.example.demo.controller.utils.DummyUtil;
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -28,4 +29,9 @@ public String unstandardRequestHandlerHolder() {
         request.getParameter("name");
         return "Name: " + request.getParameter("name") + "RequestURI: " + request.getRequestURI();
     }
+
+    @RequestMapping("/xss/holderreq-cross")
+    public String unstandardRequestHandlerHolder2() {
+        return "Name: " + DummyUtil.getParameter("name");
+    }
 }
diff --git a/java-realworld/sample/src/main/java/com/example/demo/controller/utils/DummyUtil.java b/java-realworld/sample/src/main/java/com/example/demo/controller/utils/DummyUtil.java
@@ -1,5 +1,9 @@
 package com.example.demo.controller.utils;
 
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
 public class DummyUtil {
     public static String filterXSS(String s) {
         return s.replaceAll("<", "&lt;").replaceAll(">", "&gt;");
@@ -8,4 +12,21 @@ public static String filterXSS(String s) {
     public static String nothing(String s) {
         return s;
     }
+
+    public static String getParameter(String s) {
+        ServletRequestAttributes sra = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
+        if (sra == null) {
+            return "";
+        }
+        HttpServletRequest req = sra.getRequest();
+        return req.getParameter(s);
+    }
+
+    public static HttpServletRequest getRequest() {
+        ServletRequestAttributes sra = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
+        if (sra == null) {
+            return null;
+        }
+        return sra.getRequest();
+    }
 }