/**
    * Copyright 2011-2013 The Kuali Foundation Licensed under the
    * Educational Community License, Version 2.0 (the "License"); you may
    * not use this file except in compliance with the License. You may
    * obtain a copy of the License at
    *
    * http://www.osedu.org/licenses/ECL-2.0
    *
    * Unless required by applicable law or agreed to in writing,
   * software distributed under the License is distributed on an "AS IS"
   * BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
   * or implied. See the License for the specific language governing
   * permissions and limitations under the License.
   */
  
  package org.kuali.mobility.shared.interceptors;
  
  import org.kuali.mobility.shared.XSSAttackRemoverConstants;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  import org.springframework.web.servlet.HandlerInterceptor;
  import org.springframework.web.servlet.ModelAndView;
  
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import java.util.Enumeration;
  import java.util.regex.Pattern;
  
  
  /**
   * @author Kuali Mobility Team (mobility.collab@kuali.org)
   */
  public class XSSAttackRemoverInterceptor implements HandlerInterceptor {
      private static final Logger LOG = LoggerFactory.getLogger( XSSAttackRemoverInterceptor.class );
  
      @Override
      public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
          Enumeration paramNames = request.getParameterNames();
          while(paramNames.hasMoreElements())
          {
              String paramName = (String)paramNames.nextElement();
              if((XSSAttackRemoverConstants.KME_EVENT_CATEGORY_ID).equalsIgnoreCase(paramName)) {
                  String categoryId = request.getParameter("categoryId");
                  String actualCategoryId = removeXSSAttack(categoryId);
                  request.getSession().setAttribute("categoryId", actualCategoryId);
              }
              if((XSSAttackRemoverConstants.KME_CAMPUS).equalsIgnoreCase(paramName)) {
                  String campus = request.getParameter("campus");
                  String actualCampus = removeXSSAttack(campus);
                  request.getSession().setAttribute("campus", actualCampus);
              }
              if((XSSAttackRemoverConstants.KME_EVENT_ID).equalsIgnoreCase(paramName)) {
                  String eventId = request.getParameter("eventId");
                  String actualEventId = removeXSSAttack(eventId);
                  request.getSession().setAttribute("eventId", actualEventId);
              }
              if((XSSAttackRemoverConstants.KME_DINING_NAME).equalsIgnoreCase(paramName)) {
                  String name = request.getParameter("name");
                  String actualName = removeXSSAttack(name);
                  request.getSession().setAttribute("name", actualName);
              }
              if((XSSAttackRemoverConstants.KME_DINING_LOCATION).equalsIgnoreCase(paramName)) {
                  String location = request.getParameter("location");
                  String actualLocation = removeXSSAttack(location);
                  request.getSession().setAttribute("location", actualLocation);
              }
          }
          return true;
      }
  
      @Override
      public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {}
  
      @Override
      public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {}
  
      /*
      removeXSSAttack() method will remove all special characters, script tag etc from the input value entered by the user
      */
      private String removeXSSAttack(String value) {
          if (value != null) {
              // Avoid null characters
              value = value.replaceAll("", "");
  
              // Avoid anything between script tags
              Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);
              value = scriptPattern.matcher(value).replaceAll("");
  
              // Avoid anything in a src='...' type of expression
              scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
              value = scriptPattern.matcher(value).replaceAll("");
  
              scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
              value = scriptPattern.matcher(value).replaceAll("");
  
              // Remove any lonesome </script> tag
              scriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);
              value = scriptPattern.matcher(value).replaceAll("");
  
             // Remove any lonesome <script ...> tag
             scriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
             value = scriptPattern.matcher(value).replaceAll("");
 
             // Avoid eval(...) expressions
             scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
             value = scriptPattern.matcher(value).replaceAll("");
 
             // Avoid expression(...) expressions
             scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
             value = scriptPattern.matcher(value).replaceAll("");
 
             // Avoid javascript:... expressions
             scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);
             value = scriptPattern.matcher(value).replaceAll("");
 
             // Avoid vbscript:... expressions
             scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);
             value = scriptPattern.matcher(value).replaceAll("");
 
             // Avoid onload= expressions
             scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
             value = scriptPattern.matcher(value).replaceAll("");
         }
         return value;
     }
 }