public void testWithNullResolvedCommand() throws Exception { try { tag.setCommandName(null); tag.doStartTag(); fail("Must not be able to have a command name that resolves to null"); } catch (IllegalArgumentException ex) { // expected } }
/* * See http://opensource.atlassian.com/projects/spring/browse/SPR-2645 */ public void testXSSScriptingExploitWhenActionIsResolvedFromQueryString() throws Exception { String xssQueryString = QUERY_STRING + "&stuff=\"><script>alert('XSS!')</script>"; request.setQueryString(xssQueryString); tag.doStartTag(); assertEquals( "<form id=\"command\" action=\"/my/form?foo=bar&stuff="><script>alert('XSS!')</script>\" method=\"post\">", getOutput()); }