|
| 1 | +// Copyright (c) 2026 OWASP |
| 2 | +// All rights reserved. |
| 3 | +// |
| 4 | +// Redistribution and use in source and binary forms, with or without |
| 5 | +// modification, are permitted provided that the following conditions |
| 6 | +// are met: |
| 7 | +// |
| 8 | +// * Redistributions of source code must retain the above |
| 9 | +// copyright notice, this list of conditions and the following |
| 10 | +// disclaimer. |
| 11 | +// |
| 12 | +// * Redistributions in binary form must reproduce the above |
| 13 | +// copyright notice, this list of conditions and the following |
| 14 | +// disclaimer in the documentation and/or other materials |
| 15 | +// provided with the distribution. |
| 16 | +// |
| 17 | +// * Neither the name of the OWASP nor the names of its |
| 18 | +// contributors may be used to endorse or promote products |
| 19 | +// derived from this software without specific prior written |
| 20 | +// permission. |
| 21 | +// |
| 22 | +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| 23 | +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| 24 | +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
| 25 | +// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
| 26 | +// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, |
| 27 | +// INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
| 28 | +// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR |
| 29 | +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 30 | +// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
| 31 | +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| 32 | +// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
| 33 | +// OF THE POSSIBILITY OF SUCH DAMAGE. |
| 34 | + |
| 35 | +package org.owasp.encoder; |
| 36 | + |
| 37 | +import java.io.StringWriter; |
| 38 | +import java.io.Writer; |
| 39 | +import java.lang.reflect.Field; |
| 40 | +import java.lang.reflect.Method; |
| 41 | +import java.lang.reflect.Modifier; |
| 42 | +import java.util.Arrays; |
| 43 | +import java.util.Set; |
| 44 | +import java.util.TreeSet; |
| 45 | +import junit.framework.TestCase; |
| 46 | + |
| 47 | +/** Guards the complete public facade, including legacy URI and XML 1.1. */ |
| 48 | +public class EncodeFacadeTest extends TestCase { |
| 49 | + public void testEveryContextAndOverloadHasAnExpectation() throws Exception { |
| 50 | + Set<String> names = new TreeSet<String>(); |
| 51 | + Set<String> methods = new TreeSet<String>(); |
| 52 | + for (EncoderContexts context : EncoderContexts.ALL) { |
| 53 | + assertTrue("duplicate context " + context.name, names.add(context.name)); |
| 54 | + assertTrue("duplicate method " + context.method, methods.add(context.method)); |
| 55 | + } |
| 56 | + Set<String> constants = new TreeSet<String>(); |
| 57 | + for (Field field : Encoders.class.getFields()) { |
| 58 | + if (Modifier.isStatic(field.getModifiers()) && Modifier.isFinal(field.getModifiers()) |
| 59 | + && field.getType() == String.class) { |
| 60 | + assertTrue("duplicate constant " + field, constants.add((String) field.get(null))); |
| 61 | + } |
| 62 | + } |
| 63 | + assertEquals("registry constants", constants, names); |
| 64 | + Set<String> stringMethods = new TreeSet<String>(); |
| 65 | + Set<String> writerMethods = new TreeSet<String>(); |
| 66 | + for (Method method : Encode.class.getMethods()) { |
| 67 | + if (!Modifier.isStatic(method.getModifiers()) || !method.getName().startsWith("for")) { |
| 68 | + continue; |
| 69 | + } |
| 70 | + if (Arrays.equals(new Class<?>[] {String.class}, method.getParameterTypes())) { |
| 71 | + assertEquals(String.class, method.getReturnType()); |
| 72 | + stringMethods.add(method.getName()); |
| 73 | + } else { |
| 74 | + assertTrue("unexpected overload " + method, Arrays.equals( |
| 75 | + new Class<?>[] {Writer.class, String.class}, method.getParameterTypes())); |
| 76 | + assertEquals(Void.TYPE, method.getReturnType()); |
| 77 | + writerMethods.add(method.getName()); |
| 78 | + } |
| 79 | + } |
| 80 | + assertEquals("String facade", methods, stringMethods); |
| 81 | + assertEquals("Writer facade", methods, writerMethods); |
| 82 | + } |
| 83 | + |
| 84 | + public void testFacadeDelegation() throws Exception { |
| 85 | + for (EncoderContexts context : EncoderContexts.ALL) { |
| 86 | + for (String input : new String[] {null, "", "plain text", EncoderContexts.probe()}) { |
| 87 | + assertFacade(context, input); |
| 88 | + } |
| 89 | + // Place unsafe text and surrogate pairs on both sides of buffer boundaries. |
| 90 | + for (int size : new int[] {1023, 1024, 1025, 2047, 2048, 2049}) { |
| 91 | + char[] padding = new char[size - 1]; |
| 92 | + Arrays.fill(padding, 'a'); |
| 93 | + // NUL requires encoding in every context, bypassing the safe |
| 94 | + // prefix fast path; the high surrogate starts at index size. |
| 95 | + assertFacade(context, "\0" + new String(padding) + "\ud83d\ude00" + EncoderContexts.probe()); |
| 96 | + } |
| 97 | + } |
| 98 | + } |
| 99 | + |
| 100 | + private void assertFacade(EncoderContexts context, String input) throws Exception { |
| 101 | + Encoder encoder = Encoders.forName(context.name); |
| 102 | + String expected = input == null ? "null" : Encode.encode(encoder, input); |
| 103 | + Method stringMethod = Encode.class.getMethod(context.method, String.class); |
| 104 | + Method writerMethod = Encode.class.getMethod(context.method, Writer.class, String.class); |
| 105 | + assertEquals(context.method + " String", expected, stringMethod.invoke(null, (Object) input)); |
| 106 | + StringWriter out = new StringWriter(); |
| 107 | + writerMethod.invoke(null, out, input); |
| 108 | + assertEquals(context.method + " Writer", expected, out.toString()); |
| 109 | + } |
| 110 | +} |
0 commit comments