public void testWithNullResolvedCommand() throws Exception {
try {
tag.setCommandName(null);
tag.doStartTag();
fail("Must not be able to have a command name that resolves to null");
} catch (IllegalArgumentException ex) {
// expected
}
}
/*
* See http://opensource.atlassian.com/projects/spring/browse/SPR-2645
*/
public void testXSSScriptingExploitWhenActionIsResolvedFromQueryString() throws Exception {
String xssQueryString = QUERY_STRING + "&stuff=\"><script>alert('XSS!')</script>";
request.setQueryString(xssQueryString);
tag.doStartTag();
assertEquals(
"<form id=\"command\" action=\"/my/form?foo=bar&stuff="><script>alert('XSS!')</script>\" method=\"post\">",
getOutput());
}
