DiningController

/**
 * Copyright 2011-2013 The Kuali Foundation Licensed under the Educational
 * Community License, Version 2.0 (the "License"); you may not use this file
 * except in compliance with the License. You may obtain a copy of the License
 * at
 *
 * http://www.osedu.org/licenses/ECL-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 * License for the specific language governing permissions and limitations under
 * the License.
 */
package org.kuali.mobility.dining.controllers;

import java.util.List;
import java.util.regex.Pattern;

import org.apache.log4j.Logger;
import org.kuali.mobility.dining.entity.Place;
import org.kuali.mobility.dining.entity.PlaceByCampusByType;
import org.kuali.mobility.dining.service.DiningService;
import org.kuali.mobility.dining.util.DiningUtil;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

import flexjson.JSONSerializer;
import javax.servlet.http.HttpServletRequest;
import org.kuali.mobility.security.user.api.User;
import org.kuali.mobility.shared.Constants;

@Controller
@RequestMapping("/dining")
public class DiningController {

	public static final Logger LOG = Logger.getLogger(DiningController.class);
	@Autowired
	private DiningService diningService;

	public void setDiningService(DiningService diningService) {
		this.diningService = diningService;
	}

	@RequestMapping(method = RequestMethod.GET)
	public String getPlaces(HttpServletRequest request, Model uiModel) {
		String viewName = null;
		User user = (User) request.getSession().getAttribute(Constants.KME_USER_KEY);
		String campus = null;
		if (user.getViewCampus() == null) {
			viewName = "redirect:/campus?toolName=dining";
		} else {
			campus = user.getViewCampus();
			List<PlaceByCampusByType> placeGroups = DiningUtil.convertPlaceListForUI((List<Place>) diningService.getPlaces());
			uiModel.addAttribute("placeGroups", placeGroups);
			viewName = "dining/alldining";
		}
		return viewName;
	}

	@RequestMapping(value = "/getPlaces", method = RequestMethod.GET, headers = "Accept=application/json")
	@ResponseBody
	public String getPlaceListJson() { //
		List<PlaceByCampusByType> placeGroups = DiningUtil.convertPlaceListForUI((List<Place>) diningService.getPlaces());
		return new JSONSerializer().exclude("*.class").deepSerialize(placeGroups);
	}

	@RequestMapping(value = "/menu", method = RequestMethod.GET)
	public String getMenus(HttpServletRequest request, Model uiModel, @RequestParam(value = "name", required = true) String name, @RequestParam(value = "location", required = false) String location) {
		String viewName = null;
		User user = (User) request.getSession().getAttribute(Constants.KME_USER_KEY);
		String campus = null;
		if (user.getViewCampus() == null) {
			viewName = "redirect:/campus?toolName=dining";
		} else {
            String filteredName = removeXSSAttack(name);
            String filteredLocation = removeXSSAttack(location);
			campus = user.getViewCampus();
			LOG.debug("getMenus() : name = " + filteredName + " location = " + filteredLocation);
			String place = ((filteredLocation == null || filteredLocation.trim().isEmpty()) ? filteredName : (filteredName + " at " + filteredLocation));
			uiModel.addAttribute("place", place);
			uiModel.addAttribute("name", filteredName);
			uiModel.addAttribute("location", filteredLocation);
			viewName = "dining/menus_all";
		}
		return viewName;
	}

	@RequestMapping(value = "/getMenu")
	@ResponseBody
	public String getMenusJson(@RequestParam(value = "name", required = true) String name, @RequestParam(value = "location", required = false) String location) {
        String filteredName = removeXSSAttack(name);
        String filteredLocation = removeXSSAttack(location);
		String jsonData = diningService.getMenusJson(filteredName, (null == filteredLocation || "".equalsIgnoreCase(filteredLocation) ? null : filteredLocation.trim()));

		return jsonData;
	}
	/*
	 @RequestMapping(method = RequestMethod.GET)
	 public String getList(Model uiModel) {
	 List<Menu> menus = diningService.getMenus("SE");
	 uiModel.addAttribute("menus", menus);
	 return "dining/list";
	 }

	 @RequestMapping(method = RequestMethod.GET, headers = "Accept=application/json")
	 @ResponseBody
	 public String getListJson() {
	 List<Menu> menus = diningService.getMenus("SE");
	 return new JSONSerializer().exclude("*.class").deepSerialize(menus);
	 }
	 */


    private String removeXSSAttack(String value) {
        if (value != null) {
            // Avoid null characters
            value = value.replaceAll("", "");

            // Avoid anything between script tags
            Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            // Avoid anything in a src='...' type of expression
            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            // Remove any lonesome </script> tag
            scriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            // Remove any lonesome <script ...> tag
            scriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            // Avoid eval(...) expressions
            scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            // Avoid expression(...) expressions
            scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            // Avoid javascript:... expressions
            scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            // Avoid vbscript:... expressions
            scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            // Avoid onload= expressions
            scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
        }

        return value;
    }

}