Added CSS, updated dependencies, added more output escaping samples

dschadow · dschadow · commit 070d2ebbb557 · 2013-08-24T20:29:42.000+02:00
diff --git a/Ch04_OutputEscaping/pom.xml b/Ch04_OutputEscaping/pom.xml
@@ -8,7 +8,7 @@
 	<name>Ch04_OutputEscaping</name>
 	<description>Chapter 4 Output Escaping sample project. Requires a server like Apache Tomcat.
 
-Open the web application in your browser at http://localhost:8080/OutputEscaping/</description>
+Open the web application in your browser at http://localhost:8080/Ch04_OutputEscaping</description>
 	<url>https://github.com/dschadow/JavaWebAppSecurity</url>
 
 	<properties>
@@ -20,11 +20,17 @@ Open the web application in your browser at http://localhost:8080/OutputEscaping
 			<groupId>org.owasp.esapi</groupId>
 			<artifactId>esapi</artifactId>
 			<version>2.0.1</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>javax.servlet</groupId>
+                    <artifactId>servlet-api</artifactId>
+                </exclusion>
+            </exclusions>
 		</dependency>
 	</dependencies>
 
 	<build>
-		<finalName>OutputEscaping</finalName>
+		<finalName>Ch04_OutputEscaping</finalName>
 		<plugins>
 			<plugin>
 				<artifactId>maven-compiler-plugin</artifactId>
diff --git a/Ch04_OutputEscaping/src/main/webapp/index.jsp b/Ch04_OutputEscaping/src/main/webapp/index.jsp
@@ -3,6 +3,7 @@
 <html>
 <head>
 	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+    <link rel="stylesheet" type="text/css" href="styles.css" />
 	<title>Output-Escaping</title>
 </head>
 <body>
@@ -13,9 +14,9 @@
 	<form name="noOutputEscaping" method="post" action="noOutputEscaping.jsp">
 		<table>
 			<tr>
-				<td>Name</td>
-				<td><input type="text" name="name"></td>
-				<td><input type="submit" value="Submit"></td>
+				<td><label for="unprotected" title="Name">Name</label></td>
+				<td><input type="text" id="unprotected" name="unprotected" /></td>
+				<td><input type="submit" value="Submit" /></td>
 			</tr>
 		</table>
 	</form>
@@ -25,9 +26,9 @@
 	<form name="withOutputEscaping" method="post" action="withOutputEscaping.jsp">
 		<table>
 			<tr>
-				<td>Name</td>
-				<td><input type="text" name="name"></td>
-				<td><input type="submit" name="submit" value="Submit"></td>
+				<td><label for="protected" title="Name">Name</label></td>
+				<td><input type="text" id="protected" name="protected" /></td>
+				<td><input type="submit" name="submit" value="Submit" /></td>
 			</tr>
 		</table>
 	</form>
diff --git a/Ch04_OutputEscaping/src/main/webapp/noOutputEscaping.jsp b/Ch04_OutputEscaping/src/main/webapp/noOutputEscaping.jsp
@@ -3,9 +3,11 @@
 <html>
 <head>
 	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+    <link rel="stylesheet" type="text/css" href="styles.css" />
 	<title>Without Output-Escaping</title>
 </head>
 <body>
-	<strong>Hello</strong> <%= request.getParameter("name") %>
+    <h1>Without Output-Escaping</h1>
+	<strong>Hello</strong> <%= request.getParameter("unprotected") %>
 </body>
 </html>
diff --git a/Ch04_OutputEscaping/src/main/webapp/styles.css b/Ch04_OutputEscaping/src/main/webapp/styles.css
@@ -0,0 +1,19 @@
+.text-input {
+    width: 250px;
+}
+
+.send-button {
+	font-size: 115%;
+}
+
+h1 {
+	font-size: 150%;
+}
+
+h2 {
+	font-size: 125%;
+}
+
+td {
+	font-size: 115%;
+}
diff --git a/Ch04_OutputEscaping/src/main/webapp/withOutputEscaping.jsp b/Ch04_OutputEscaping/src/main/webapp/withOutputEscaping.jsp
@@ -3,11 +3,15 @@
 <html>
 <head>
 	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-	<title>With Output-Escaping</title>
+    <link rel="stylesheet" type="text/css" href="styles.css" />
+	<title>With ESAPI Output-Escaping</title>
 </head>
 <body>
-	<h1>ESAPI</h1>
+	<h1>With ESAPI Output-Escaping</h1>
 	<%@ page import="org.owasp.esapi.ESAPI" %>
-	<strong>Hello</strong> <%= ESAPI.encoder().encodeForHTML(request.getParameter("name")) %>
+	<p>(html) <strong>Hello</strong> <%= ESAPI.encoder().encodeForHTML(request.getParameter("protected")) %></p>
+    <p>(html attribute) <strong>Hello</strong> <%= ESAPI.encoder().encodeForHTMLAttribute(request.getParameter("protected")) %></p>
+    <p>(css) <strong>Hello</strong> <%= ESAPI.encoder().encodeForCSS(request.getParameter("protected")) %></p>
+    <p>(xml) <strong>Hello</strong> <%= ESAPI.encoder().encodeForXML(request.getParameter("protected")) %></p>
 </body>
 </html>
