Page History

public class BadOutput {
  public static void display() {
    // description and input are String variables containing values obtained from a database
    // description = "description"&quot;description&quot; and input = "<script>&quot;&lt;script&gt; XSS </script>"&lt;/script&gt;&quot;
    
    // display to the user or pass description and input to another system
  }
}

public class ValidateOutput {
  // allows only alphanumeric characters and spaces
  private Pattern pattern = Pattern.compile(""^[a-zA-Z0-9\\s]{0,20}$"");

  // validates and encodes the input field based on a whitelist
  private String validate(String name, String input) throws ValidationException {
    String canonical = normalize(input);

    if(!pattern.matcher(canonical).matches()) {
      throw new ValidationException( ""Improper format in "" + name + "" field"");
    }
    
    // performs output encoding for non valid characters 
    canonical = HTMLEntityEncode(canonical);
    return canonical;
  }

  // normalizes to known instances 	
  private String normalize(String input) {
    String canonical = java.text.Normalizer.normalize(input, Normalizer.Form.NFKC);
    return canonical;
  }

  // Encodes non valid data
  public static String HTMLEntityEncode(String input) {
    StringBuffer sb = new StringBuffer();

    for (int i = 0;i <&lt; input.length();++i) {
      char ch = input.charAt(i);
        if (Character.isLetterOrDigit(ch) || Character.isWhitespace(ch)) {
          sb.append(ch);
        } else {
          sb.append("&quot;&amp;#"&quot; + (int)ch + ";"&quot;;&quot;);
        }
    }
    return sb.toString();
  }

  public static void display() throws ValidationException {
    // description and input are String variables containing values obtained from a database
    // description = "description"&quot;description&quot; and input = "&quot;2 items available"&quot;
    ValidateOutput vo = new ValidateOutput();
    vo.validate(description, input);
    // pass to another system or display to the user
  }
}