package com.bmc.servlet;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.Locale;
import java.util.ResourceBundle;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.log4j.Logger;
import com.bmc.inapp.reporting.yellowfin.config.OnboardingException;
public class AppExceptionHandler extends HttpServlet {
private static final long serialVersionUID = 1L;
Logger logger = Logger.getLogger(AppExceptionHandler.class);
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
processError(request, response);
}
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
processError(request, response);
}
private void processError(HttpServletRequest request, HttpServletResponse response) throws IOException {
logger.info("Processing Error Page...");
ResourceBundle bundle = null;
Locale locale = request.getLocale();
try {
bundle = ResourceBundle.getBundle("MessageBundle", locale);
} catch (Exception e) {
Locale.setDefault(new Locale("en", "US"));
bundle = ResourceBundle.getBundle("MessageBundle");
}
// Analyze the servlet exception
Throwable throwable = (Throwable) request
.getAttribute("javax.servlet.error.exception");
Integer statusCode = (Integer) request
.getAttribute("javax.servlet.error.status_code");
String requestUri = (String) request
.getAttribute("javax.servlet.error.request_uri");
if (requestUri == null) {
requestUri = "Unknown";
}
// Set response content type
response.setContentType("text/html");
PrintWriter out = response.getWriter();
out.write("Exception/Error Details");
if (throwable == null && statusCode == null){
out.println("Error information is missing
");
} else if(statusCode != 500){
out.write("Error Details
");
out.write("Status Code:"+cleanXSS(statusCode.toString())+"
");
out.write("Requested URI:"+cleanXSS(requestUri));
}else{
out.write("Exception Details
");
out.write("- Exception Message:"+cleanXSS(throwable.getMessage())+"
");
OnboardingException obe = (OnboardingException) throwable.getCause();
if (null != obe) {
out.write("- Error Details:"+cleanXSS(new Integer(obe.getError_code()).toString())+ ": "+cleanXSS(bundle.getString(obe.getError_msg()))+"
");
}
out.write("- Requested URI:"+cleanXSS(requestUri)+"
");
out.write("
");
}
out.write("
");
out.write("Home Page");
out.write("");
logger.info("Processing Error Page Completed...");
}
/**
* Check for XSS vulnerability and encode pure HTML code.
*
* @param value
* @return String
*/
public String cleanXSS(String value) {
//You'll need to remove the spaces from the html entities below
value = value.replaceAll("", "");
value = value.replaceAll("eval\\((.*)\\)", "");
value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
value = value.replaceAll("onload(.*?)=", "");
value = value.replaceAll("vbscript:", "");
value = value.replaceAll("expression\\((.*?)\\)", "");
value = value.replaceAll("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", "");
value = value.replaceAll("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", "");
value = value.replaceAll("", "& gt;");
value = value.replaceAll("\\(", "& #40;");
value = value.replaceAll("\\)", "& #41;");
value = value.replaceAll("'", "& #39;");
value = value.replaceAll("%", "& #37;");
value = value.replaceAll("\\+", "& #43;");
value = value.replaceAll("=", "& #61;");
value = value.replaceAll("\\?", "& #63;");
return value;
}
}