cleanup app

Author: omursahin

core-tests/e2e-tests/spring/spring-rest-bb/src/main/kotlin/com/foo/rest/examples/bb/cleanupmismatch/BBCleanUpMismatchApplication.kt

@@ -27,12 +27,21 @@ open class BBCleanUpMismatchApplication {
         }
     }
 
+    private fun containsUnsafeUrlCharacters(str: String): Boolean {
+        // Characters that are problematic in URL path parameters
+        val unsafeChars = setOf('<', '>', '"', '\'', '&', '/', '\\', '{', '}', '|', '^', '[', ']', '`', ' ')
+        return str.any { it in unsafeChars || it.code < 32 || it.code > 126 }
+    }
 
     @PostMapping(path = ["/items"], consumes = [MediaType.APPLICATION_JSON_VALUE], produces = [MediaType.APPLICATION_JSON_VALUE])
     fun postCreate(@RequestBody dto: BBCleanUpDto) : ResponseEntity<BBCleanUpDto> {
 
         if(dto.id.isNullOrBlank() || dto.x == null) return ResponseEntity.status(400).build()
 
+        if(containsUnsafeUrlCharacters(dto.id!!)) {
+            return ResponseEntity.status(400).build()
+        }
+
         if(data.containsKey(dto.id)){
             return ResponseEntity.status(409).build()
         }

core/src/main/kotlin/org/evomaster/core/problem/rest/oracle/RestSecurityOracle.kt

@@ -228,8 +228,16 @@ object RestSecurityOracle {
         "<img src=x onerror=alert('XSS')>",
         "<svg onload=alert('XSS')>",
         "<details open ontoggle=alert('XSS')>",
-        "<script>alert('XSS')</script>",
-        "<iframe src='javascript:alert(\"XSS\")'></iframe>"
+        //TODO if payload contains "/" it causes StackOverflow:
+        //java.lang.StackOverflowError
+        //	at org.evomaster.core.search.StructuralElement.<init>(StructuralElement.kt:107)
+        //	at org.evomaster.core.search.StructuralElement.<init>(StructuralElement.kt:19)
+        //	at org.evomaster.core.search.gene.Gene.<init>(Gene.kt:58)
+        //	at org.evomaster.core.search.gene.root.SimpleGene.<init>(SimpleGene.kt:13)
+        //	at org.evomaster.core.search.gene.collection.EnumGene.<init>(EnumGene.kt:25)
+        //	at org.evomaster.core.search.gene.collection.EnumGene.copyContent(EnumGene.kt:111)
+//        "<script>alert('XSS')</script>",
+//        "<iframe src='javascript:alert(\"XSS\")'></iframe>"
     )