// Path: src/utils/Responses.java
// @Immutable
// public final class Responses {
// 
//   private Responses() {}
// 
//   /**
//    * Sends a "normal" response, with all the standard headers. 
//    */
//   public static void sendNormalPage(HttpServletResponse response, String body) throws IOException {
//     response.setHeader(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, must-revalidate");
//     response.setHeader(HttpHeaders.PRAGMA, "no-cache");
//     response.setDateHeader(HttpHeaders.EXPIRES, 0);
//     response.setHeader(HttpHeaders.CONTENT_TYPE, "text/html; charset=utf-8");
//     response.setStatus(200);
//     response.getWriter().write(body);
//   }
// 
//   /**
//    * Sends an XSS response. 
//    */
//   public static void sendXssed(HttpServletResponse response, String body) throws IOException {
//     sendXssed(response, body, "text/html; charset=utf-8");
//   }
// 
//   /**
//    * Sends an HTML XSSed response with the given status. 
//    */
//   public static void sendXssed(HttpServletResponse response, String body, int status)
//       throws IOException {
//     sendXssed(response, body, "text/html; charset=utf-8", status);
//   }
// 
//   /**
//    * Sends an XSS response of a given type. 
//    */
//   public static void sendXssed(HttpServletResponse response, String body, String contentType)
//       throws IOException {
//     sendXssed(response, body, contentType, 200);
//   }
// 
//   /**
//    * Sends an XSS response of a given type. 
//    */
//   public static void sendXssed(HttpServletResponse response, String body, String contentType,
//       int status) throws IOException {
//     response.setHeader(HttpHeaders.X_XSS_PROTECTION, "0");
//     response.setHeader(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, must-revalidate");
//     response.setHeader(HttpHeaders.PRAGMA, "no-cache");
//     response.setDateHeader(HttpHeaders.EXPIRES, 0);
//     response.setHeader(HttpHeaders.CONTENT_TYPE, contentType);
//     response.setStatus(status);
//     response.getWriter().write(body);
//   }
// 
//   /**
//    * Sends an error to the user with the given {@code status} and body.
//    */
//   public static void sendError(HttpServletResponse response, String body, int status)
//       throws IOException {
//     Preconditions.checkArgument(status > 300);
//     response.setStatus(status);
//     response.setHeader(HttpHeaders.CONTENT_TYPE, "text/plain");
//     response.getWriter().write(Escaper.escapeHtml(body));
//   }
//   
//   /**
//    * Sends a response with the content type text/javascript.
//    */
//   public static void sendJavaScript(HttpServletResponse response, String body)
//       throws IOException {
//     response.setHeader(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, must-revalidate");
//     response.setHeader(HttpHeaders.PRAGMA, "no-cache");
//     response.setDateHeader(HttpHeaders.EXPIRES, 0);
//     response.setHeader(HttpHeaders.CONTENT_TYPE, "text/javascript");
//     response.setStatus(200);
//     response.getWriter().write(body);
//   }
// 
//   /**
//    * Sends a redirect to the user.
//    */
//   public static void sendRedirect(HttpServletResponse response, String location) {
//     response.setStatus(302);
//     response.setHeader(HttpHeaders.LOCATION, location);
//   }
// }


import com.google.common.base.Strings;
import com.google.testing.security.firingrange.utils.Responses;
import java.io.IOException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/*
 * Copyright 2016 Google Inc. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
 * in compliance with the License. You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software distributed under the License
 * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
 * or implied. See the License for the specific language governing permissions and limitations under
 * the License.
 */

package com.google.testing.security.firingrange.tests.urldom;




/**
 * Provides JSONP Endpoint service.
 */
public class JsonpEndpoint extends HttpServlet {
  static final String CALLBACK_REGEX = "[a-zA-Z0-9][a-zA-Z0-9\\._]*";
  static final String ECHOED_PARAM = "callback";
  static final int MAX_CALLBACK_LENGTH = 100;

  @Override
  public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
    String echoedParam = Strings.nullToEmpty(request.getParameter(ECHOED_PARAM));
    if (!echoedParam.matches(CALLBACK_REGEX) || echoedParam.length() > MAX_CALLBACK_LENGTH) {
// Path: src/utils/Responses.java
// @Immutable
// public final class Responses {
// 
//   private Responses() {}
// 
//   /**
//    * Sends a "normal" response, with all the standard headers. 
//    */
//   public static void sendNormalPage(HttpServletResponse response, String body) throws IOException {
//     response.setHeader(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, must-revalidate");
//     response.setHeader(HttpHeaders.PRAGMA, "no-cache");
//     response.setDateHeader(HttpHeaders.EXPIRES, 0);
//     response.setHeader(HttpHeaders.CONTENT_TYPE, "text/html; charset=utf-8");
//     response.setStatus(200);
//     response.getWriter().write(body);
//   }
// 
//   /**
//    * Sends an XSS response. 
//    */
//   public static void sendXssed(HttpServletResponse response, String body) throws IOException {
//     sendXssed(response, body, "text/html; charset=utf-8");
//   }
// 
//   /**
//    * Sends an HTML XSSed response with the given status. 
//    */
//   public static void sendXssed(HttpServletResponse response, String body, int status)
//       throws IOException {
//     sendXssed(response, body, "text/html; charset=utf-8", status);
//   }
// 
//   /**
//    * Sends an XSS response of a given type. 
//    */
//   public static void sendXssed(HttpServletResponse response, String body, String contentType)
//       throws IOException {
//     sendXssed(response, body, contentType, 200);
//   }
// 
//   /**
//    * Sends an XSS response of a given type. 
//    */
//   public static void sendXssed(HttpServletResponse response, String body, String contentType,
//       int status) throws IOException {
//     response.setHeader(HttpHeaders.X_XSS_PROTECTION, "0");
//     response.setHeader(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, must-revalidate");
//     response.setHeader(HttpHeaders.PRAGMA, "no-cache");
//     response.setDateHeader(HttpHeaders.EXPIRES, 0);
//     response.setHeader(HttpHeaders.CONTENT_TYPE, contentType);
//     response.setStatus(status);
//     response.getWriter().write(body);
//   }
// 
//   /**
//    * Sends an error to the user with the given {@code status} and body.
//    */
//   public static void sendError(HttpServletResponse response, String body, int status)
//       throws IOException {
//     Preconditions.checkArgument(status > 300);
//     response.setStatus(status);
//     response.setHeader(HttpHeaders.CONTENT_TYPE, "text/plain");
//     response.getWriter().write(Escaper.escapeHtml(body));
//   }
//   
//   /**
//    * Sends a response with the content type text/javascript.
//    */
//   public static void sendJavaScript(HttpServletResponse response, String body)
//       throws IOException {
//     response.setHeader(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, must-revalidate");
//     response.setHeader(HttpHeaders.PRAGMA, "no-cache");
//     response.setDateHeader(HttpHeaders.EXPIRES, 0);
//     response.setHeader(HttpHeaders.CONTENT_TYPE, "text/javascript");
//     response.setStatus(200);
//     response.getWriter().write(body);
//   }
// 
//   /**
//    * Sends a redirect to the user.
//    */
//   public static void sendRedirect(HttpServletResponse response, String location) {
//     response.setStatus(302);
//     response.setHeader(HttpHeaders.LOCATION, location);
//   }
// }


// Path: src/tests/urldom/JsonpEndpoint.java
import com.google.common.base.Strings;
import com.google.testing.security.firingrange.utils.Responses;
import java.io.IOException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/*
 * Copyright 2016 Google Inc. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
 * in compliance with the License. You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software distributed under the License
 * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
 * or implied. See the License for the specific language governing permissions and limitations under
 * the License.
 */

package com.google.testing.security.firingrange.tests.urldom;




/**
 * Provides JSONP Endpoint service.
 */
public class JsonpEndpoint extends HttpServlet {
  static final String CALLBACK_REGEX = "[a-zA-Z0-9][a-zA-Z0-9\\._]*";
  static final String ECHOED_PARAM = "callback";
  static final int MAX_CALLBACK_LENGTH = 100;

  @Override
  public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
    String echoedParam = Strings.nullToEmpty(request.getParameter(ECHOED_PARAM));
    if (!echoedParam.matches(CALLBACK_REGEX) || echoedParam.length() > MAX_CALLBACK_LENGTH) {
      Responses.sendError(response,