├── .gitignore
├── LICENSE
├── README.md
├── lib
    ├── esapi.js
    ├── public
    │   ├── esapi-compressed.js
    │   ├── esapi.js
    │   └── resources
    │   │   ├── Base.esapi.properties.js
    │   │   └── i18n
    │   │       └── ESAPI_Standard_en_US.properties.js
    └── utils.js
├── package.json
└── test
    └── test.js


/.gitignore:
--------------------------------------------------------------------------------
 1 | lib-cov
 2 | *.seed
 3 | *.log
 4 | *.csv
 5 | *.dat
 6 | *.out
 7 | *.pid
 8 | *.gz
 9 | 
10 | pids
11 | logs
12 | results
13 | 
14 | npm-debug.log
15 | node_modules
16 | .idea
17 | lib/esapi4js.js


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | The MIT License (MIT)
 2 | 
 3 | Copyright (c) 2014 Karl Düüna
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy of
 6 | this software and associated documentation files (the "Software"), to deal in
 7 | the Software without restriction, including without limitation the rights to
 8 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
 9 | the Software, and to permit persons to whom the Software is furnished to do so,
10 | subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
17 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
18 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
19 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
20 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
21 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | [node-esapi](https://github.com/DeadAlready/node-esapi) is a minimal port of the ESAPI4JS (Enterprise Security API for JavaScript)
 2 | encoder.
 3 | 
 4 | # Installation
 5 | 
 6 |     $ npm install node-esapi
 7 | 
 8 | # Usage
 9 | 
10 | 	var ESAPI = require('node-esapi');
11 | 	ESAPI.encoder().encodeForHTML('<p>This is a test</p>');
12 | 
13 | # Encoder Functions
14 | 
15 | The encoder() returns an object with the following main functions:
16 | 
17 | + encodeForHTML
18 | + encodeForCSS
19 | + encodeForJS = encodeForJavaScript = encodeForJavascript
20 | + encodeForURL
21 | + encodeForHTMLAttribute
22 | + encodeForBase64
23 | 
24 | # Middleware
25 | 
26 | The ESAPI has a function for creating express middleware to serve client side scripts of ESAPI.
27 | 
28 | 	app.use(ESAPI.middleware());
29 | 
30 | 	// Now in your HTML you can do
31 | 	<script src="/esapi/esapi.js"></script>
32 | 	<script src="/esapi/resources/i18n/ESAPI_Standard_en_US.properties.js"></script>
33 | 	<script src="/esapi/resources/Base.esapi.properties.js"></script>
34 | 	<script>
35 | 		org.owasp.esapi.ESAPI.initialize();
36 | 		//Here you have access to the $ESAPI object and can do
37 | 		$ESAPI.encoder().encodeForHTML('<p>This is a test</p>');
38 | 	</script>
39 | 
40 | # Licence
41 | 
42 | ## ESAPI Licence
43 | 
44 | The BSD License
45 | 
46 | Copyright (c) 2007, The OWASP Foundation
47 | All rights reserved.
48 | 
49 | Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
50 | 
51 | Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
52 | Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
53 | Neither the name of the OWASP Foundation nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
54 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
55 | 
56 | ## node-esapi Licence
57 | 
58 | The MIT License (MIT)
59 | 
60 | Copyright (c) 2014 Karl Düüna
61 | 
62 | Permission is hereby granted, free of charge, to any person obtaining a copy of
63 | this software and associated documentation files (the "Software"), to deal in
64 | the Software without restriction, including without limitation the rights to
65 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
66 | the Software, and to permit persons to whom the Software is furnished to do so,
67 | subject to the following conditions:
68 | 
69 | The above copyright notice and this permission notice shall be included in all
70 | copies or substantial portions of the Software.
71 | 
72 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
73 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
74 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
75 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
76 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
77 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
78 | 


--------------------------------------------------------------------------------
/lib/esapi.js:
--------------------------------------------------------------------------------
   1 | 'use strict';
   2 | 
   3 | var utils = require('./utils');
   4 | 
   5 | var esapi = {
   6 |     codecs: {}
   7 | };
   8 | 
   9 | 
  10 | esapi.codecs.Codec = function() {
  11 |     return {
  12 |         /**
  13 |          * Encode a String so that it can be safely used in a specific context.
  14 |          *
  15 |          * @param aImmune
  16 |          *              array of immune characters
  17 |          * @param sInput
  18 |          *              the String to encode
  19 |          * @return the encoded String
  20 |          */
  21 |         encode: function(aImmune, sInput) {
  22 |             var out = '';
  23 |             for (var i = 0; i < sInput.length; i ++) {
  24 |                 var c = sInput.charAt(i);
  25 |                 out += this.encodeCharacter(aImmune, c);
  26 |             }
  27 |             return out;
  28 |         },
  29 | 
  30 |         /**
  31 |          * Default implementation that should be overridden in specific codecs.
  32 |          *
  33 |          * @param aImmune
  34 |          *              array of immune characters
  35 |          * @param c
  36 |          *              the Character to encode
  37 |          * @return
  38 |          *              the encoded Character
  39 |          */
  40 |         encodeCharacter: function(aImmune, c) {
  41 |             return c;
  42 |         },
  43 | 
  44 |         /**
  45 |          * Decode a String that was encoded using the encode method in this Class
  46 |          *
  47 |          * @param sInput
  48 |          *              the String to decode
  49 |          * @return
  50 |          *              the decoded String
  51 |          */
  52 |         decode: function(sInput) {
  53 |             var out = '';
  54 |             var pbs = new esapi.codecs.PushbackString(sInput);
  55 |             while (pbs.hasNext()) {
  56 |                 var c = this.decodeCharacter(pbs);
  57 |                 if (c != null) {
  58 |                     out += c;
  59 |                 } else {
  60 |                     out += pbs.next();
  61 |                 }
  62 |             }
  63 |             return out;
  64 |         },
  65 | 
  66 |         /**
  67 |          * Returns the decoded version of the next character from the input string and advances the
  68 |          * current character in the PushbackString.  If the current character is not encoded, this
  69 |          * method MUST reset the PushbackString.
  70 |          *
  71 |          * @param oPushbackString the Character to decode
  72 |          * @return the decoded Character
  73 |          */
  74 |         decodeCharacter: function(oPushbackString) {
  75 |             return oPushbackString.next();
  76 |         }
  77 |     };
  78 | };
  79 | 
  80 | esapi.codecs.Codec.getHexForNonAlphanumeric = function(c) {
  81 |     if (c.charCodeAt(0) < 256) {
  82 |         return esapi.codecs.Codec.hex[c.charCodeAt(0)];
  83 |     }
  84 |     return c.charCodeAt(0).toString(16);
  85 | };
  86 | 
  87 | esapi.codecs.Codec.hex = [];
  88 | for ( var c = 0; c < 0xFF; c ++ ) {
  89 |     if ( c >= 0x30 && c <= 0x39 || c>= 0x41 && c <= 0x5A || c >= 0x61 && c <= 0x7A ) {
  90 |         esapi.codecs.Codec.hex[c] = null;
  91 |     } else {
  92 |         esapi.codecs.Codec.hex[c] = c.toString(16);
  93 |     }
  94 | };
  95 | 
  96 | esapi.codecs.Base64 = {
  97 |     _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
  98 | 
  99 |     encode: function(sInput) {
 100 |         if (!sInput) {
 101 |             return null;
 102 |         }
 103 | 
 104 |         var out = '';
 105 |         var ch1,ch2,ch3,enc1,enc2,enc3,enc4;
 106 |         var i = 0;
 107 | 
 108 |         var input = esapi.codecs.UTF8.encode(sInput);
 109 | 
 110 |         while (i < input.length) {
 111 |             ch1 = input.charCodeAt(i++);
 112 |             ch2 = input.charCodeAt(i++);
 113 |             ch3 = input.charCodeAt(i++);
 114 | 
 115 |             enc1 = ch1 >> 2;
 116 |             enc2 = ((ch1 & 3) << 4) | (ch2 >> 4);
 117 |             enc3 = ((ch2 & 15) << 2) | (ch3 >> 6);
 118 |             enc4 = ch3 & 63;
 119 | 
 120 |             if (isNaN(ch2)) {
 121 |                 enc3 = enc4 = 64;
 122 |             }
 123 |             else if (isNaN(ch3)) {
 124 |                 enc4 = 64;
 125 |             }
 126 | 
 127 |             out += this._keyStr.charAt(enc1) + this._keyStr.charAt(enc2) + this._keyStr.charAt(enc3) + this._keyStr.charAt(enc4);
 128 |         }
 129 | 
 130 |         return out;
 131 |     },
 132 | 
 133 |     decode: function(sInput) {
 134 |         if (!sInput) {
 135 |             return null;
 136 |         }
 137 | 
 138 |         var out = '';
 139 |         var ch1, ch2, ch3, enc1, enc2, enc3, enc4;
 140 |         var i = 0;
 141 | 
 142 |         var input = sInput.replace(/[^A-Za-z0-9\+\/\=]/g, "");
 143 | 
 144 |         while (i < input.length) {
 145 |             enc1 = this._keyStr.indexOf(input.charAt(i++));
 146 |             enc2 = this._keyStr.indexOf(input.charAt(i++));
 147 |             enc3 = this._keyStr.indexOf(input.charAt(i++));
 148 |             enc4 = this._keyStr.indexOf(input.charAt(i++));
 149 | 
 150 |             ch1 = (enc1 << 2) | (enc2 >> 4);
 151 |             ch2 = ((enc2 & 15) << 4) | (enc3 >> 2);
 152 |             ch3 = ((enc3 & 3) << 6) | enc4;
 153 | 
 154 |             out += String.fromCharCode(ch1);
 155 |             if (enc3 != 64) {
 156 |                 out += String.fromCharCode(ch2);
 157 |             }
 158 |             if (enc4 != 64) {
 159 |                 out += String.fromCharCode(ch3);
 160 |             }
 161 |         }
 162 | 
 163 |         out = esapi.codecs.UTF8.decode(out);
 164 |         return out;
 165 |     }
 166 | };
 167 | 
 168 | 
 169 | esapi.codecs.CSSCodec = function() {
 170 |     var _super = new esapi.codecs.Codec();
 171 | 
 172 |     return {
 173 |         encode: _super.encode,
 174 | 
 175 |         decode: _super.decode,
 176 | 
 177 |         encodeCharacter: function(aImmune, c) {
 178 |             if (utils.contains(aImmune, c)) {
 179 |                 return c;
 180 |             }
 181 | 
 182 |             var hex = esapi.codecs.Codec.getHexForNonAlphanumeric(c);
 183 |             if (hex == null) {
 184 |                 return c;
 185 |             }
 186 | 
 187 |             return "\\" + hex + " ";
 188 |         },
 189 | 
 190 |         decodeCharacter: function(oPushbackString) {
 191 |             oPushbackString.mark();
 192 |             var first = oPushbackString.next();
 193 |             if (first == null) {
 194 |                 oPushbackString.reset();
 195 |                 return null;
 196 |             }
 197 | 
 198 |             if (first != '\\') {
 199 |                 oPushbackString.reset();
 200 |                 return null;
 201 |             }
 202 | 
 203 |             var second = oPushbackString.next();
 204 |             if (second == null) {
 205 |                 oPushbackString.reset();
 206 |                 return null;
 207 |             }
 208 | 
 209 |             if (oPushbackString.isHexDigit(second)) {
 210 |                 var out = second;
 211 |                 for (var i = 0; i < 6; i ++) {
 212 |                     var c = oPushbackString.next();
 213 |                     if (c == null || c.charCodeAt(0) == 0x20) {
 214 |                         break;
 215 |                     }
 216 |                     if (oPushbackString.isHexDigit(c)) {
 217 |                         out += c;
 218 |                     } else {
 219 |                         input.pushback(c);
 220 |                         break;
 221 |                     }
 222 |                 }
 223 | 
 224 |                 try {
 225 |                     var n = parseInt(out, 16);
 226 |                     return String.fromCharCode(n);
 227 |                 } catch (e) {
 228 |                     oPushbackString.reset();
 229 |                     return null;
 230 |                 }
 231 |             }
 232 | 
 233 |             return second;
 234 |         }
 235 |     };
 236 | };
 237 | 
 238 | 
 239 | var entityToCharacterMap = [];
 240 | entityToCharacterMap["&quot"]        = "34";      /* 34 : quotation mark */
 241 | entityToCharacterMap["&amp"]         = "38";      /* 38 : ampersand */
 242 | entityToCharacterMap["&lt"]          = "60";        /* 60 : less-than sign */
 243 | entityToCharacterMap["&gt"]          = "62";        /* 62 : greater-than sign */
 244 | entityToCharacterMap["&nbsp"]        = "160";      /* 160 : no-break space */
 245 | entityToCharacterMap["&iexcl"]       = "161";     /* 161 : inverted exclamation mark */
 246 | entityToCharacterMap["&cent"]			= "162";	/* 162  : cent sign */
 247 | entityToCharacterMap["&pound"]			= "163";	/* 163  : pound sign */
 248 | entityToCharacterMap["&curren"]			= "164";	/* 164  : currency sign */
 249 | entityToCharacterMap["&yen"]			= "165";	/* 165  : yen sign */
 250 | entityToCharacterMap["&brvbar"]			= "166";	/* 166  : broken bar */
 251 | entityToCharacterMap["&sect"]			= "167";	/* 167  : section sign */
 252 | entityToCharacterMap["&uml"]			= "168";	/* 168  : diaeresis */
 253 | entityToCharacterMap["&copy"]			= "169";	/* 169  : copyright sign */
 254 | entityToCharacterMap["&ordf"]			= "170";	/* 170  : feminine ordinal indicator */
 255 | entityToCharacterMap["&laquo"]          = "171";    /* 171 : left-pointing double angle quotation mark */
 256 | entityToCharacterMap["&not"]			= "172";	/* 172  : not sign */
 257 | entityToCharacterMap["&shy"]			= "173";	/* 173  : soft hyphen */
 258 | entityToCharacterMap["&reg"]			= "174";	/* 174  : registered sign */
 259 | entityToCharacterMap["&macr"]			= "175";	/* 175  : macron */
 260 | entityToCharacterMap["&deg"]			= "176";	/* 176  : degree sign */
 261 | entityToCharacterMap["&plusmn"]         = "177";    /* 177 : plus-minus sign */
 262 | entityToCharacterMap["&sup2"]			= "178";	/* 178  : superscript two */
 263 | entityToCharacterMap["&sup3"]			= "179";	/* 179  : superscript three */
 264 | entityToCharacterMap["&acute"]			= "180";	/* 180  : acute accent */
 265 | entityToCharacterMap["&micro"]			= "181";	/* 181  : micro sign */
 266 | entityToCharacterMap["&para"]			= "182";	/* 182  : pilcrow sign */
 267 | entityToCharacterMap["&middot"]			= "183";	/* 183  : middle dot */
 268 | entityToCharacterMap["&cedil"]			= "184";	/* 184  : cedilla */
 269 | entityToCharacterMap["&sup1"]			= "185";	/* 185  : superscript one */
 270 | entityToCharacterMap["&ordm"]			= "186";	/* 186  : masculine ordinal indicator */
 271 | entityToCharacterMap["&raquo"]          = "187";    /* 187 : right-pointing double angle quotation mark */
 272 | entityToCharacterMap["&frac14"]			= "188";	/* 188  : vulgar fraction one quarter */
 273 | entityToCharacterMap["&frac12"]			= "189";	/* 189  : vulgar fraction one half */
 274 | entityToCharacterMap["&frac34"]			= "190";	/* 190  : vulgar fraction three quarters */
 275 | entityToCharacterMap["&iquest"]			= "191";	/* 191  : inverted question mark */
 276 | entityToCharacterMap["&Agrave"]			= "192";	/* 192  : Latin capital letter a with grave */
 277 | entityToCharacterMap["&Aacute"]			= "193";	/* 193  : Latin capital letter a with acute */
 278 | entityToCharacterMap["&Acirc"]			= "194";	/* 194  : Latin capital letter a with circumflex */
 279 | entityToCharacterMap["&Atilde"]			= "195";	/* 195  : Latin capital letter a with tilde */
 280 | entityToCharacterMap["&Auml"]			= "196";	/* 196  : Latin capital letter a with diaeresis */
 281 | entityToCharacterMap["&Aring"]			= "197";	/* 197  : Latin capital letter a with ring above */
 282 | entityToCharacterMap["&AElig"]			= "198";	/* 198  : Latin capital letter ae */
 283 | entityToCharacterMap["&Ccedil"]			= "199";	/* 199  : Latin capital letter c with cedilla */
 284 | entityToCharacterMap["&Egrave"]			= "200";	/* 200  : Latin capital letter e with grave */
 285 | entityToCharacterMap["&Eacute"]			= "201";	/* 201  : Latin capital letter e with acute */
 286 | entityToCharacterMap["&Ecirc"]			= "202";	/* 202  : Latin capital letter e with circumflex */
 287 | entityToCharacterMap["&Euml"]			= "203";	/* 203  : Latin capital letter e with diaeresis */
 288 | entityToCharacterMap["&Igrave"]			= "204";	/* 204  : Latin capital letter i with grave */
 289 | entityToCharacterMap["&Iacute"]			= "205";	/* 205  : Latin capital letter i with acute */
 290 | entityToCharacterMap["&Icirc"]			= "206";	/* 206  : Latin capital letter i with circumflex */
 291 | entityToCharacterMap["&Iuml"]			= "207";	/* 207  : Latin capital letter i with diaeresis */
 292 | entityToCharacterMap["&ETH"]			    = "208";	/* 208  : Latin capital letter eth */
 293 | entityToCharacterMap["&Ntilde"]			= "209";	/* 209  : Latin capital letter n with tilde */
 294 | entityToCharacterMap["&Ograve"]			= "210";	/* 210  : Latin capital letter o with grave */
 295 | entityToCharacterMap["&Oacute"]			= "211";	/* 211  : Latin capital letter o with acute */
 296 | entityToCharacterMap["&Ocirc"]           = "212";  /* 212 : Latin capital letter o with circumflex */
 297 | entityToCharacterMap["&Otilde"]			= "213";	 /* 213 : Latin capital letter o with tilde */
 298 | entityToCharacterMap["&Ouml"]			= "214";	 /* 214 : Latin capital letter o with diaeresis */
 299 | entityToCharacterMap["&times"]			= "215";	 /* 215 : multiplication sign */
 300 | entityToCharacterMap["&Oslash"]			= "216";	 /* 216 : Latin capital letter o with stroke */
 301 | entityToCharacterMap["&Ugrave"]			= "217";	 /* 217 : Latin capital letter u with grave */
 302 | entityToCharacterMap["&Uacute"]			= "218";	 /* 218 : Latin capital letter u with acute */
 303 | entityToCharacterMap["&Ucirc"]			= "219";	 /* 219 : Latin capital letter u with circumflex */
 304 | entityToCharacterMap["&Uuml"]			= "220";	 /* 220 : Latin capital letter u with diaeresis */
 305 | entityToCharacterMap["&Yacute"]			= "221";	 /* 221 : Latin capital letter y with acute */
 306 | entityToCharacterMap["&THORN"]			= "222";	 /* 222 : Latin capital letter thorn */
 307 | entityToCharacterMap["&szlig"]           = "223";   /* 223 : Latin small letter sharp s, German Eszett */
 308 | entityToCharacterMap["&agrave"]			= "224";	 /* 224 : Latin small letter a with grave */
 309 | entityToCharacterMap["&aacute"]			= "225";	 /* 225 : Latin small letter a with acute */
 310 | entityToCharacterMap["&acirc"]			= "226";	 /* 226 : Latin small letter a with circumflex */
 311 | entityToCharacterMap["&atilde"]			= "227";	 /* 227 : Latin small letter a with tilde */
 312 | entityToCharacterMap["&auml"]			= "228";	 /* 228 : Latin small letter a with diaeresis */
 313 | entityToCharacterMap["&aring"]			= "229";	 /* 229 : Latin small letter a with ring above */
 314 | entityToCharacterMap["&aelig"]			= "230";	 /* 230 : Latin lowercase ligature ae */
 315 | entityToCharacterMap["&ccedil"]			= "231";	 /* 231 : Latin small letter c with cedilla */
 316 | entityToCharacterMap["&egrave"]			= "232";	 /* 232 : Latin small letter e with grave */
 317 | entityToCharacterMap["&eacute"]			= "233";	 /* 233 : Latin small letter e with acute */
 318 | entityToCharacterMap["&ecirc"]			= "234";	 /* 234 : Latin small letter e with circumflex */
 319 | entityToCharacterMap["&euml"]			= "235";	 /* 235 : Latin small letter e with diaeresis */
 320 | entityToCharacterMap["&igrave"]			= "236";	 /* 236 : Latin small letter i with grave */
 321 | entityToCharacterMap["&iacute"]			= "237";	 /* 237 : Latin small letter i with acute */
 322 | entityToCharacterMap["&icirc"]			= "238";	 /* 238 : Latin small letter i with circumflex */
 323 | entityToCharacterMap["&iuml"]			= "239";	 /* 239 : Latin small letter i with diaeresis */
 324 | entityToCharacterMap["&eth"]			    = "240";	 /* 240 : Latin small letter eth */
 325 | entityToCharacterMap["&ntilde"]			= "241";	 /* 241 : Latin small letter n with tilde */
 326 | entityToCharacterMap["&ograve"]			= "242";	 /* 242 : Latin small letter o with grave */
 327 | entityToCharacterMap["&oacute"]			= "243";	 /* 243 : Latin small letter o with acute */
 328 | entityToCharacterMap["&ocirc"]			= "244";	 /* 244 : Latin small letter o with circumflex */
 329 | entityToCharacterMap["&otilde"]			= "245";	 /* 245 : Latin small letter o with tilde */
 330 | entityToCharacterMap["&ouml"]			= "246";	 /* 246 : Latin small letter o with diaeresis */
 331 | entityToCharacterMap["&divide"]			= "247";	 /* 247 : division sign */
 332 | entityToCharacterMap["&oslash"]			= "248";	 /* 248 : Latin small letter o with stroke */
 333 | entityToCharacterMap["&ugrave"]			= "249";	 /* 249 : Latin small letter u with grave */
 334 | entityToCharacterMap["&uacute"]			= "250";	 /* 250 : Latin small letter u with acute */
 335 | entityToCharacterMap["&ucirc"]			= "251";	 /* 251 : Latin small letter u with circumflex */
 336 | entityToCharacterMap["&uuml"]			= "252";	 /* 252 : Latin small letter u with diaeresis */
 337 | entityToCharacterMap["&yacute"]			= "253";	 /* 253 : Latin small letter y with acute */
 338 | entityToCharacterMap["&thorn"]			= "254";	 /* 254 : Latin small letter thorn */
 339 | entityToCharacterMap["&yuml"]			= "255";	 /* 255 : Latin small letter y with diaeresis */
 340 | entityToCharacterMap["&OElig"]			= "338";	 /* 338 : Latin capital ligature oe */
 341 | entityToCharacterMap["&oelig"]			= "339";	 /* 339 : Latin small ligature oe */
 342 | entityToCharacterMap["&Scaron"]			= "352";	 /* 352 : Latin capital letter s with caron */
 343 | entityToCharacterMap["&scaron"]			= "353";	 /* 353 : Latin small letter s with caron */
 344 | entityToCharacterMap["&Yuml"]			= "376";	 /* 376 : Latin capital letter y with diaeresis */
 345 | entityToCharacterMap["&fnof"]			= "402";	 /* 402 : Latin small letter f with hook */
 346 | entityToCharacterMap["&circ"]			= "710";	 /* 710 : modifier letter circumflex accent */
 347 | entityToCharacterMap["&tilde"]			= "732";	 /* 732 : small tilde */
 348 | entityToCharacterMap["&Alpha"]			= "913";	 /* 913 : Greek capital letter alpha */
 349 | entityToCharacterMap["&Beta"]			= "914";	 /* 914 : Greek capital letter beta */
 350 | entityToCharacterMap["&Gamma"]			= "915";	 /* 915 : Greek capital letter gamma */
 351 | entityToCharacterMap["&Delta"]			= "916";	 /* 916 : Greek capital letter delta */
 352 | entityToCharacterMap["&Epsilon"]			= "917";	 /* 917 : Greek capital letter epsilon */
 353 | entityToCharacterMap["&Zeta"]			= "918";	 /* 918 : Greek capital letter zeta */
 354 | entityToCharacterMap["&Eta"]			    = "919";	 /* 919 : Greek capital letter eta */
 355 | entityToCharacterMap["&Theta"]			= "920";	 /* 920 : Greek capital letter theta */
 356 | entityToCharacterMap["&Iota"]			= "921";	 /* 921 : Greek capital letter iota */
 357 | entityToCharacterMap["&Kappa"]			= "922";	 /* 922 : Greek capital letter kappa */
 358 | entityToCharacterMap["&Lambda"]			= "923";	 /* 923 : Greek capital letter lambda */
 359 | entityToCharacterMap["&Mu"]			= "924";	 /* 924 : Greek capital letter mu */
 360 | entityToCharacterMap["&Nu"]			= "925";	 /* 925 : Greek capital letter nu */
 361 | entityToCharacterMap["&Xi"]			= "926";	 /* 926 : Greek capital letter xi */
 362 | entityToCharacterMap["&Omicron"]			= "927";	 /* 927 : Greek capital letter omicron */
 363 | entityToCharacterMap["&Pi"]			= "928";	 /* 928 : Greek capital letter pi */
 364 | entityToCharacterMap["&Rho"]			= "929";	 /* 929 : Greek capital letter rho */
 365 | entityToCharacterMap["&Sigma"]			= "931";	 /* 931 : Greek capital letter sigma */
 366 | entityToCharacterMap["&Tau"]			= "932";	 /* 932 : Greek capital letter tau */
 367 | entityToCharacterMap["&Upsilon"]			= "933";	 /* 933 : Greek capital letter upsilon */
 368 | entityToCharacterMap["&Phi"]			= "934";	 /* 934 : Greek capital letter phi */
 369 | entityToCharacterMap["&Chi"]			= "935";	 /* 935 : Greek capital letter chi */
 370 | entityToCharacterMap["&Psi"]			= "936";	 /* 936 : Greek capital letter psi */
 371 | entityToCharacterMap["&Omega"]			= "937";	 /* 937 : Greek capital letter omega */
 372 | entityToCharacterMap["&alpha"]			= "945";	 /* 945 : Greek small letter alpha */
 373 | entityToCharacterMap["&beta"]			= "946";	 /* 946 : Greek small letter beta */
 374 | entityToCharacterMap["&gamma"]			= "947";	 /* 947 : Greek small letter gamma */
 375 | entityToCharacterMap["&delta"]			= "948";	 /* 948 : Greek small letter delta */
 376 | entityToCharacterMap["&epsilon"]			= "949";	 /* 949 : Greek small letter epsilon */
 377 | entityToCharacterMap["&zeta"]			= "950";	 /* 950 : Greek small letter zeta */
 378 | entityToCharacterMap["&eta"]			= "951";	 /* 951 : Greek small letter eta */
 379 | entityToCharacterMap["&theta"]			= "952";	 /* 952 : Greek small letter theta */
 380 | entityToCharacterMap["&iota"]			= "953";	 /* 953 : Greek small letter iota */
 381 | entityToCharacterMap["&kappa"]			= "954";	 /* 954 : Greek small letter kappa */
 382 | entityToCharacterMap["&lambda"]			= "955";	 /* 955 : Greek small letter lambda */
 383 | entityToCharacterMap["&mu"]			= "956";	 /* 956 : Greek small letter mu */
 384 | entityToCharacterMap["&nu"]			= "957";	 /* 957 : Greek small letter nu */
 385 | entityToCharacterMap["&xi"]			= "958";	 /* 958 : Greek small letter xi */
 386 | entityToCharacterMap["&omicron"]			= "959";	 /* 959 : Greek small letter omicron */
 387 | entityToCharacterMap["&pi"]			= "960";	 /* 960 : Greek small letter pi */
 388 | entityToCharacterMap["&rho"]			= "961";	 /* 961 : Greek small letter rho */
 389 | entityToCharacterMap["&sigmaf"]			= "962";	 /* 962 : Greek small letter final sigma */
 390 | entityToCharacterMap["&sigma"]			= "963";	 /* 963 : Greek small letter sigma */
 391 | entityToCharacterMap["&tau"]			= "964";	 /* 964 : Greek small letter tau */
 392 | entityToCharacterMap["&upsilon"]			= "965";	 /* 965 : Greek small letter upsilon */
 393 | entityToCharacterMap["&phi"]			= "966";	 /* 966 : Greek small letter phi */
 394 | entityToCharacterMap["&chi"]			= "967";	 /* 967 : Greek small letter chi */
 395 | entityToCharacterMap["&psi"]			= "968";	 /* 968 : Greek small letter psi */
 396 | entityToCharacterMap["&omega"]			= "969";	 /* 969 : Greek small letter omega */
 397 | entityToCharacterMap["&thetasym"]			= "977";	 /* 977 : Greek theta symbol */
 398 | entityToCharacterMap["&upsih"]			= "978";	 /* 978 : Greek upsilon with hook symbol */
 399 | entityToCharacterMap["&piv"]			= "982";	 /* 982 : Greek pi symbol */
 400 | entityToCharacterMap["&ensp"]			= "8194";	 /* 8194 : en space */
 401 | entityToCharacterMap["&emsp"]			= "8195";	 /* 8195 : em space */
 402 | entityToCharacterMap["&thinsp"]			= "8201";	 /* 8201 : thin space */
 403 | entityToCharacterMap["&zwnj"]            = "8204"; /* 8204 : zero width non-joiner */
 404 | entityToCharacterMap["&zwj"]			= "8205";	 /* 8205 : zero width joiner */
 405 | entityToCharacterMap["&lrm"]             = "8206"; /* 8206 : left-to-right mark */
 406 | entityToCharacterMap["&rlm"]             = "8207"; /* 8207 : right-to-left mark */
 407 | entityToCharacterMap["&ndash"]			= "8211";	 /* 8211 : en dash */
 408 | entityToCharacterMap["&mdash"]			= "8212";	 /* 8212 : em dash */
 409 | entityToCharacterMap["&lsquo"]			= "8216";	 /* 8216 : left single quotation mark */
 410 | entityToCharacterMap["&rsquo"]			= "8217";	 /* 8217 : right single quotation mark */
 411 | entityToCharacterMap["&sbquo"]           = "8218";  /* 8218 : single low-9 quotation mark */
 412 | entityToCharacterMap["&ldquo"]			= "8220";	 /* 8220 : left double quotation mark */
 413 | entityToCharacterMap["&rdquo"]			= "8221";	 /* 8221 : right double quotation mark */
 414 | entityToCharacterMap["&bdquo"]           = "8222";  /* 8222 : double low-9 quotation mark */
 415 | entityToCharacterMap["&dagger"]			= "8224";	 /* 8224 : dagger */
 416 | entityToCharacterMap["&Dagger"]			= "8225";	 /* 8225 : double dagger */
 417 | entityToCharacterMap["&bull"]			= "8226";	 /* 8226 : bullet */
 418 | entityToCharacterMap["&hellip"]			= "8230";	 /* 8230 : horizontal ellipsis */
 419 | entityToCharacterMap["&permil"]			= "8240";	 /* 8240 : per mille sign */
 420 | entityToCharacterMap["&prime"]			= "8242";	 /* 8242 : prime */
 421 | entityToCharacterMap["&Prime"]			= "8243";	 /* 8243 : double prime */
 422 | entityToCharacterMap["&lsaquo"]          = "8249";  /* 8249 : single left-pointing angle quotation mark */
 423 | entityToCharacterMap["&rsaquo"]          = "8250";  /* 8250 : single right-pointing angle quotation mark */
 424 | entityToCharacterMap["&oline"]			= "8254";	 /* 8254 : overline */
 425 | entityToCharacterMap["&frasl"]			= "8260";	 /* 8260 : fraction slash */
 426 | entityToCharacterMap["&euro"]			= "8364";	 /* 8364 : euro sign */
 427 | entityToCharacterMap["&image"]           = "8365";  /* 8465 : black-letter capital i */
 428 | entityToCharacterMap["&weierp"]          = "8472";  /* 8472 : script capital p, Weierstrass p */
 429 | entityToCharacterMap["&real"]            = "8476";  /* 8476 : black-letter capital r */
 430 | entityToCharacterMap["&trade"]			= "8482";	 /* 8482 : trademark sign */
 431 | entityToCharacterMap["&alefsym"]			= "8501";	 /* 8501 : alef symbol */
 432 | entityToCharacterMap["&larr"]			= "8592";	 /* 8592 : leftwards arrow */
 433 | entityToCharacterMap["&uarr"]			= "8593";	 /* 8593 : upwards arrow */
 434 | entityToCharacterMap["&rarr"]			= "8594";	 /* 8594 : rightwards arrow */
 435 | entityToCharacterMap["&darr"]			= "8595";	 /* 8595 : downwards arrow */
 436 | entityToCharacterMap["&harr"]			= "8596";	 /* 8596 : left right arrow */
 437 | entityToCharacterMap["&crarr"]			= "8629";	 /* 8629 : downwards arrow with corner leftwards */
 438 | entityToCharacterMap["&lArr"]			= "8656";	 /* 8656 : leftwards double arrow */
 439 | entityToCharacterMap["&uArr"]			= "8657";	 /* 8657 : upwards double arrow */
 440 | entityToCharacterMap["&rArr"]			= "8658";	 /* 8658 : rightwards double arrow */
 441 | entityToCharacterMap["&dArr"]			= "8659";	 /* 8659 : downwards double arrow */
 442 | entityToCharacterMap["&hArr"]			= "8660";	 /* 8660 : left right double arrow */
 443 | entityToCharacterMap["&forall"]			= "8704";	 /* 8704 : for all */
 444 | entityToCharacterMap["&part"]			= "8706";	 /* 8706 : partial differential */
 445 | entityToCharacterMap["&exist"]			= "8707";	 /* 8707 : there exists */
 446 | entityToCharacterMap["&empty"]			= "8709";	 /* 8709 : empty set */
 447 | entityToCharacterMap["&nabla"]			= "8711";	 /* 8711 : nabla */
 448 | entityToCharacterMap["&isin"]			= "8712";	 /* 8712 : element of */
 449 | entityToCharacterMap["&notin"]			= "8713";	 /* 8713 : not an element of */
 450 | entityToCharacterMap["&ni"]			    = "8715";	 /* 8715 : contains as member */
 451 | entityToCharacterMap["&prod"]            = "8719";  /* 8719 : n-ary product */
 452 | entityToCharacterMap["&sum"]             = "8721";  /* 8721 : n-ary summation */
 453 | entityToCharacterMap["&minus"]			= "8722";	 /* 8722 : minus sign */
 454 | entityToCharacterMap["&lowast"]			= "8727";	 /* 8727 : asterisk operator */
 455 | entityToCharacterMap["&radic"]			= "8730";	 /* 8730 : square root */
 456 | entityToCharacterMap["&prop"]			= "8733";	 /* 8733 : proportional to */
 457 | entityToCharacterMap["&infin"]			= "8734";	 /* 8734 : infinity */
 458 | entityToCharacterMap["&ang"]			= "8736";	 /* 8736 : angle */
 459 | entityToCharacterMap["&and"]			= "8743";	 /* 8743 : logical and */
 460 | entityToCharacterMap["&or"]			= "8744";	 /* 8744 : logical or */
 461 | entityToCharacterMap["&cap"]			= "8745";	 /* 8745 : intersection */
 462 | entityToCharacterMap["&cup"]			= "8746";	 /* 8746 : union */
 463 | entityToCharacterMap["&int"]			= "8747";	 /* 8747 : integral */
 464 | entityToCharacterMap["&there4"]			= "8756";	 /* 8756 : therefore */
 465 | entityToCharacterMap["&sim"]			= "8764";	 /* 8764 : tilde operator */
 466 | entityToCharacterMap["&cong"]			= "8773";	 /* 8773 : congruent to */
 467 | entityToCharacterMap["&asymp"]			= "8776";	 /* 8776 : almost equal to */
 468 | entityToCharacterMap["&ne"]			= "8800";	 /* 8800 : not equal to */
 469 | entityToCharacterMap["&equiv"]           = "8801";   /* 8801 : identical to, equivalent to */
 470 | entityToCharacterMap["&le"]              = "8804"; /* 8804 : less-than or equal to */
 471 | entityToCharacterMap["&ge"]              = "8805"; /* 8805 : greater-than or equal to */
 472 | entityToCharacterMap["&sub"]			= "8834";	 /* 8834 : subset of */
 473 | entityToCharacterMap["&sup"]			= "8835";	 /* 8835 : superset of */
 474 | entityToCharacterMap["&nsub"]			= "8836";	 /* 8836 : not a subset of */
 475 | entityToCharacterMap["&sube"]			= "8838";	 /* 8838 : subset of or equal to */
 476 | entityToCharacterMap["&supe"]			= "8839";	 /* 8839 : superset of or equal to */
 477 | entityToCharacterMap["&oplus"]			= "8853";	 /* 8853 : circled plus */
 478 | entityToCharacterMap["&otimes"]			= "8855";	 /* 8855 : circled times */
 479 | entityToCharacterMap["&perp"]			= "8869";	 /* 8869 : up tack */
 480 | entityToCharacterMap["&sdot"]			= "8901";	 /* 8901 : dot operator */
 481 | entityToCharacterMap["&lceil"]			= "8968";	 /* 8968 : left ceiling */
 482 | entityToCharacterMap["&rceil"]			= "8969";	 /* 8969 : right ceiling */
 483 | entityToCharacterMap["&lfloor"]			= "8970";	 /* 8970 : left floor */
 484 | entityToCharacterMap["&rfloor"]			= "8971";	 /* 8971 : right floor */
 485 | entityToCharacterMap["&lang"]            = "9001";  /* 9001 : left-pointing angle bracket */
 486 | entityToCharacterMap["&rang"]            = "9002";  /* 9002 : right-pointing angle bracket */
 487 | entityToCharacterMap["&loz"]			= "9674";	 /* 9674 : lozenge */
 488 | entityToCharacterMap["&spades"]			= "9824";	 /* 9824 : black spade suit */
 489 | entityToCharacterMap["&clubs"]			= "9827";	 /* 9827 : black club suit */
 490 | entityToCharacterMap["&hearts"]			= "9829";	 /* 9829 : black heart suit */
 491 | entityToCharacterMap["&diams"]			= "9830";	 /* 9830 : black diamond suit */
 492 | 
 493 | var characterToEntityMap = [];
 494 | 
 495 | for ( var entity in entityToCharacterMap ) {
 496 |     characterToEntityMap[entityToCharacterMap[entity]] = entity;
 497 | }
 498 | 
 499 | esapi.codecs.HTMLEntityCodec = function() {
 500 |     var _super = new esapi.codecs.Codec();
 501 | 
 502 |     var getNumericEntity = function(input) {
 503 |         var first = input.peek();
 504 |         if (first == null) {
 505 |             return null;
 506 |         }
 507 | 
 508 |         if (first == 'x' || first == 'X') {
 509 |             input.next();
 510 |             return parseHex(input);
 511 |         }
 512 |         return parseNumber(input);
 513 |     };
 514 | 
 515 |     var parseNumber = function(input) {
 516 |         var out = '';
 517 |         while (input.hasNext()) {
 518 |             var c = input.peek();
 519 |             if (c.match(/[0-9]/)) {
 520 |                 out += c;
 521 |                 input.next();
 522 |             } else if (c == ';') {
 523 |                 input.next();
 524 |                 break;
 525 |             } else {
 526 |                 break;
 527 |             }
 528 |         }
 529 | 
 530 |         try {
 531 |             return parseInt(out);
 532 |         } catch (e) {
 533 |             return null;
 534 |         }
 535 |     };
 536 | 
 537 |     var parseHex = function(input) {
 538 |         var out = '';
 539 |         while (input.hasNext()) {
 540 |             var c = input.peek();
 541 |             if (c.match(/[0-9A-Fa-f]/)) {
 542 |                 out += c;
 543 |                 input.next();
 544 |             } else if (c == ';') {
 545 |                 input.next();
 546 |                 break;
 547 |             } else {
 548 |                 break;
 549 |             }
 550 |         }
 551 |         try {
 552 |             return parseInt(out, 16);
 553 |         } catch (e) {
 554 |             return null;
 555 |         }
 556 |     };
 557 | 
 558 |     var getNamedEntity = function(input) {
 559 |         var entity = '';
 560 |         while (input.hasNext()) {
 561 |             var c = input.peek();
 562 |             if (c.match(/[A-Za-z]/)) {
 563 |                 entity += c;
 564 |                 input.next();
 565 |                 if (utils.containsKey(entityToCharacterMap, '&' + entity)) {
 566 |                     if (input.peek(';')) input.next();
 567 |                     break;
 568 |                 }
 569 |             } else if (c == ';') {
 570 |                 input.next();
 571 |             } else {
 572 |                 break;
 573 |             }
 574 |         }
 575 | 
 576 |         return String.fromCharCode(entityToCharacterMap.getCaseInsensitive('&' + entity));
 577 |     };
 578 | 
 579 |     return {
 580 |         encode: _super.encode,
 581 | 
 582 |         decode: _super.decode,
 583 | 
 584 |         encodeCharacter: function(aImmune, c) {
 585 |             if (utils.contains(aImmune, c)) {
 586 |                 return c;
 587 |             }
 588 | 
 589 |             var hex = esapi.codecs.Codec.getHexForNonAlphanumeric(c);
 590 |             if (hex == null) {
 591 |                 return c;
 592 |             }
 593 | 
 594 |             var cc = c.charCodeAt(0);
 595 |             if (( cc <= 0x1f && c != '\t' && c != '\n' && c != '\r' ) || ( cc >= 0x7f && cc <= 0x9f ) || c == ' ') {
 596 |                 return " ";
 597 |             }
 598 | 
 599 |             var entityName = characterToEntityMap[cc];
 600 |             if (entityName != null) {
 601 |                 return entityName + ";";
 602 |             }
 603 | 
 604 |             return "&#x" + hex + ";";
 605 |         },
 606 | 
 607 |         decodeCharacter: function(oPushbackString) {
 608 |             //noinspection UnnecessaryLocalVariableJS
 609 |             var input = oPushbackString;
 610 |             input.mark();
 611 |             var first = input.next();
 612 |             if (first == null || first != '&') {
 613 |                 input.reset();
 614 |                 return null;
 615 |             }
 616 | 
 617 |             var second = input.next();
 618 |             if (second == null) {
 619 |                 input.reset();
 620 |                 return null;
 621 |             }
 622 | 
 623 |             if (second == '#') {
 624 |                 var c = getNumericEntity(input);
 625 |                 if (c != null) {
 626 |                     return c;
 627 |                 }
 628 |             } else if (second.match(/[A-Za-z]/)) {
 629 |                 input.pushback(second);
 630 |                 c = getNamedEntity(input);
 631 |                 if (c != null) {
 632 |                     return c;
 633 |                 }
 634 |             }
 635 |             input.reset();
 636 |             return null;
 637 |         }
 638 |     };
 639 | };
 640 | 
 641 | 
 642 | esapi.codecs.JavascriptCodec = function() {
 643 |     var _super = new esapi.codecs.Codec();
 644 | 
 645 |     return {
 646 |         encode: function(aImmune, sInput) {
 647 |             var out = '';
 648 |             for (var idx = 0; idx < sInput.length; idx ++) {
 649 |                 var ch = sInput.charAt(idx);
 650 |                 if (utils.contains(aImmune, ch)) {
 651 |                     out += ch;
 652 |                 }
 653 |                 else {
 654 |                     var hex = esapi.codecs.Codec.getHexForNonAlphanumeric(ch);
 655 |                     if (hex == null) {
 656 |                         out += ch;
 657 |                     }
 658 |                     else {
 659 |                         var tmp = ch.charCodeAt(0).toString(16);
 660 |                         if (ch.charCodeAt(0) < 256) {
 661 |                             var pad = "00".substr(tmp.length);
 662 |                             out += "\\x" + pad + tmp.toUpperCase();
 663 |                         }
 664 |                         else {
 665 |                             pad = "0000".substr(tmp.length);
 666 |                             out += "\\u" + pad + tmp.toUpperCase();
 667 |                         }
 668 |                     }
 669 |                 }
 670 |             }
 671 |             return out;
 672 |         },
 673 | 
 674 |         decode: _super.decode,
 675 | 
 676 |         decodeCharacter: function(oPushbackString) {
 677 |             oPushbackString.mark();
 678 |             var first = oPushbackString.next();
 679 |             if (first == null) {
 680 |                 oPushbackString.reset();
 681 |                 return null;
 682 |             }
 683 | 
 684 |             if (first != '\\') {
 685 |                 oPushbackString.reset();
 686 |                 return null;
 687 |             }
 688 | 
 689 |             var second = oPushbackString.next();
 690 |             if (second == null) {
 691 |                 oPushbackString.reset();
 692 |                 return null;
 693 |             }
 694 | 
 695 |             // \0 collides with the octal decoder and is non-standard
 696 |             // if ( second.charValue() == '0' ) {
 697 |             //      return Character.valueOf( (char)0x00 );
 698 |             if (second == 'b') {
 699 |                 return 0x08;
 700 |             } else if (second == 't') {
 701 |                 return 0x09;
 702 |             } else if (second == 'n') {
 703 |                 return 0x0a;
 704 |             } else if (second == 'v') {
 705 |                 return 0x0b;
 706 |             } else if (second == 'f') {
 707 |                 return 0x0c;
 708 |             } else if (second == 'r') {
 709 |                 return 0x0d;
 710 |             } else if (second == '\"') {
 711 |                 return 0x22;
 712 |             } else if (second == '\'') {
 713 |                 return 0x27;
 714 |             } else if (second == '\\') {
 715 |                 return 0x5c;
 716 |             } else if (second.toLowerCase() == 'x') {
 717 |                 out = '';
 718 |                 for (var i = 0; i < 2; i++) {
 719 |                     var c = oPushbackString.nextHex();
 720 |                     if (c != null) {
 721 |                         out += c;
 722 |                     } else {
 723 |                         input.reset();
 724 |                         return null;
 725 |                     }
 726 |                 }
 727 |                 try {
 728 |                     n = parseInt(out, 16);
 729 |                     return String.fromCharCode(n);
 730 |                 } catch (e) {
 731 |                     oPushbackString.reset();
 732 |                     return null;
 733 |                 }
 734 |             } else if (second.toLowerCase() == 'u') {
 735 |                 out = '';
 736 |                 for (i = 0; i < 4; i++) {
 737 |                     c = oPushbackString.nextHex();
 738 |                     if (c != null) {
 739 |                         out += c;
 740 |                     } else {
 741 |                         input.reset();
 742 |                         return null;
 743 |                     }
 744 |                 }
 745 |                 try {
 746 |                     var n = parseInt(out, 16);
 747 |                     return String.fromCharCode(n);
 748 |                 } catch (e) {
 749 |                     oPushbackString.reset();
 750 |                     return null;
 751 |                 }
 752 |             } else if (oPushbackString.isOctalDigit(second)) {
 753 |                 var out = second;
 754 |                 var c2 = oPushbackString.next();
 755 |                 if (!oPushbackString.isOctalDigit(c2)) {
 756 |                     oPushbackString.pushback(c2);
 757 |                 } else {
 758 |                     out += c2;
 759 |                     var c3 = oPushbackString.next();
 760 |                     if (!oPushbackString.isOctalDigit(c3)) {
 761 |                         oPushbackString.pushback(c3);
 762 |                     } else {
 763 |                         out += c3;
 764 |                     }
 765 |                 }
 766 | 
 767 |                 try {
 768 |                     n = parseInt(out, 8);
 769 |                     return String.fromCharCode(n);
 770 |                 } catch (e) {
 771 |                     oPushbackString.reset();
 772 |                     return null;
 773 |                 }
 774 |             }
 775 |             return second;
 776 |         }
 777 |     };
 778 | };
 779 | 
 780 | 
 781 | esapi.codecs.PercentCodec = function() {
 782 |     var _super = new esapi.codecs.Codec();
 783 | 
 784 |     var ALPHA_NUMERIC_STR = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
 785 |     var RFC_NON_ALPHANUMERIC_UNRESERVED_STR = "-._~";
 786 |     var ENCODED_NON_ALPHA_NUMERIC_UNRESERVED = true;
 787 |     var UNENCODED_STR = ALPHA_NUMERIC_STR + (ENCODED_NON_ALPHA_NUMERIC_UNRESERVED ? "" : RFC_NON_ALPHANUMERIC_UNRESERVED_STR);
 788 | 
 789 |     var getTwoUpperBytes = function(b) {
 790 |         var out = '';
 791 |         if (b < -128 || b > 127) {
 792 |             throw new IllegalArgumentException("b is not a byte (was " + b + ")");
 793 |         }
 794 |         b &= 0xFF;
 795 |         if (b < 0x10) {
 796 |             out += '0';
 797 |         }
 798 |         return out + b.toString(16).toUpperCase();
 799 |     };
 800 | 
 801 |     return {
 802 |         encode: _super.encode,
 803 | 
 804 |         decode: _super.decode,
 805 | 
 806 |         encodeCharacter: function(aImmune, c) {
 807 |             if (UNENCODED_STR.indexOf(c) > -1) {
 808 |                 return c;
 809 |             }
 810 | 
 811 |             var bytes = esapi.codecs.UTF8.encode(c);
 812 |             var out = '';
 813 |             for (var b = 0; b < bytes.length; b++) {
 814 |                 out += '%' + getTwoUpperBytes(bytes.charCodeAt(b));
 815 |             }
 816 |             return out;
 817 |         },
 818 | 
 819 |         decodeCharacter: function(oPushbackString) {
 820 |             oPushbackString.mark();
 821 |             var first = oPushbackString.next();
 822 |             if (first == null || first != '%') {
 823 |                 oPushbackString.reset();
 824 |                 return null;
 825 |             }
 826 | 
 827 |             var out = '';
 828 |             for (var i = 0; i < 2; i++) {
 829 |                 var c = oPushbackString.nextHex();
 830 |                 if (c != null) {
 831 |                     out += c;
 832 |                 }
 833 |             }
 834 |             if (out.length == 2) {
 835 |                 try {
 836 |                     var n = parseInt(out, 16);
 837 |                     return String.fromCharCode(n);
 838 |                 } catch (e) {
 839 |                 }
 840 |             }
 841 |             oPushbackString.reset();
 842 |             return null;
 843 |         }
 844 |     };
 845 | };
 846 | 
 847 | esapi.codecs.PushbackString = function(sInput) {
 848 |     var _input = sInput,
 849 |         _pushback = '',
 850 |         _temp = '',
 851 |         _index = 0,
 852 |         _mark = 0;
 853 | 
 854 |     return {
 855 |         pushback: function(c) {
 856 |             _pushback = c;
 857 |         },
 858 | 
 859 |         index: function() {
 860 |             return _index;
 861 |         },
 862 | 
 863 |         hasNext: function() {
 864 |             if (_pushback != null) return true;
 865 |             return !(_input == null || _input.length == 0 || _index >= _input.length);
 866 | 
 867 |         },
 868 | 
 869 |         next: function() {
 870 |             if (_pushback != null) {
 871 |                 var save = _pushback;
 872 |                 _pushback = null;
 873 |                 return save;
 874 |             }
 875 |             if (_input == null || _input.length == 0 || _index >= _input.length) {
 876 |                 return null;
 877 |             }
 878 |             return _input.charAt(_index++);
 879 |         },
 880 | 
 881 |         nextHex: function() {
 882 |             var c = this.next();
 883 |             if (this.isHexDigit(c)) return c;
 884 |             return null;
 885 |         },
 886 | 
 887 |         nextOctal: function() {
 888 |             var c = this.next();
 889 |             if (this.isOctalDigit(c)) return c;
 890 |             return null;
 891 |         },
 892 | 
 893 |         isHexDigit: function(c) {
 894 |             return c != null && ( ( c >= '0' && c <= '9' ) || ( c >= 'a' && c <= 'f' ) || ( c >= 'A' && c <= 'F' ) );
 895 |         },
 896 | 
 897 |         isOctalDigit: function(c) {
 898 |             return c != null && ( c >= '0' && c <= '7' );
 899 |         },
 900 | 
 901 |         peek: function(c) {
 902 |             if (!c) {
 903 |                 if (_pushback != null) return _pushback;
 904 |                 if (_input == null || _input.length == 0 || _index >= _input.length) return null;
 905 |                 return _input.charAt(_index);
 906 |             } else {
 907 |                 if (_pushback != null && _pushback == c) return true;
 908 |                 if (_input == null || _input.length == 0 || _index >= _input.length) return false;
 909 |                 return _input.charAt(_index) == c;
 910 |             }
 911 |         },
 912 | 
 913 |         mark: function() {
 914 |             _temp = _pushback;
 915 |             _mark = _index;
 916 |         },
 917 | 
 918 |         reset: function() {
 919 |             _pushback = _temp;
 920 |             _index = _mark;
 921 |         },
 922 | 
 923 |         remainder: function() {
 924 |             var out = _input.substr(_index);
 925 |             if (_pushback != null) {
 926 |                 out = _pushback + out;
 927 |             }
 928 |             return out;
 929 |         }
 930 |     };
 931 | };
 932 | 
 933 | esapi.codecs.UTF8 = {
 934 |     encode: function(sInput) {
 935 |         var input = sInput.replace(/\r\n/g, "\n");
 936 |         var utftext = '';
 937 | 
 938 |         for (var n = 0; n < input.length; n ++) {
 939 |             var c = input.charCodeAt(n);
 940 | 
 941 |             if (c < 128) {
 942 |                 utftext += String.fromCharCode(c);
 943 |             }
 944 |             else if (( c > 127) && (c < 2048)) {
 945 |                 utftext += String.fromCharCode((c >> 6) | 192);
 946 |                 utftext += String.fromCharCode((c & 63) | 128);
 947 |             }
 948 |             else {
 949 |                 utftext += String.fromCharCode((c >> 12) | 224);
 950 |                 utftext += String.fromCharCode(((c >> 6) & 63) | 128);
 951 |                 utftext += String.fromCharCode((c & 63) | 128);
 952 |             }
 953 |         }
 954 | 
 955 |         return utftext;
 956 |     }
 957 |     ,
 958 | 
 959 |     decode: function(sInput) {
 960 |         var out = '';
 961 |         var i, c, c1, c2, c3, string;
 962 |         i = c = c1 = c2 = 0;
 963 | 
 964 |         while (i < sInput.length) {
 965 |             c = sInput.charCodeAt(i);
 966 | 
 967 |             if (c < 128) {
 968 |                 out += String.fromCharCode(c);
 969 |                 i ++;
 970 |             }
 971 |             else if ((c > 191) && (c < 224)) {
 972 |                 c2 = sInput.charCodeAt(i + 1);
 973 |                 out += String.fromCharCode(((c & 31) << 6) | (c2 & 63));
 974 |                 i += 2;
 975 |             }
 976 |             else {
 977 |                 c2 = utftext.charCodeAt(i + 1);
 978 |                 c3 = utftext.charCodeAt(i + 2);
 979 |                 string += String.fromCharCode(((c & 15) << 12) | ((c2 & 63) << 6) | (c3 & 63));
 980 |                 i += 3;
 981 |             }
 982 |         }
 983 | 
 984 |         return out;
 985 |     }
 986 | };
 987 | 
 988 | 
 989 | 
 990 | esapi.DefaultEncoder = function(aCodecs) {
 991 |     var _codecs = [],
 992 |         _htmlCodec = new esapi.codecs.HTMLEntityCodec(),
 993 |         _javascriptCodec = new esapi.codecs.JavascriptCodec(),
 994 |         _cssCodec = new esapi.codecs.CSSCodec(),
 995 |         _percentCodec = new esapi.codecs.PercentCodec();
 996 | 
 997 |     if (!aCodecs) {
 998 |         _codecs.push(_htmlCodec);
 999 |         _codecs.push(_javascriptCodec);
1000 |         _codecs.push(_cssCodec);
1001 |         _codecs.push(_percentCodec);
1002 |     } else {
1003 |         _codecs = aCodecs;
1004 |     }
1005 | 
1006 |     var IMMUNE_HTML = new Array(',', '.', '-', '_', ' ');
1007 |     var IMMUNE_HTMLATTR = new Array(',', '.', '-', '_');
1008 |     var IMMUNE_CSS = new Array();
1009 |     var IMMUNE_JAVASCRIPT = new Array(',', '.', '_');
1010 | 
1011 |     return {
1012 |         cananicalize: function(sInput, bStrict) {
1013 |             if (!sInput) {
1014 |                 return null;
1015 |             }
1016 |             var working = sInput, codecFound = null, mixedCount = 1, foundCount = 0, clean = false;
1017 |             while (!clean) {
1018 |                 clean = true;
1019 | 
1020 |                 _codecs.each(function(codec) {
1021 |                     var old = working;
1022 |                     working = codec.decode(working);
1023 | 
1024 |                     if (old != working) {
1025 |                         if (codecFound != null && codecFound != codec) {
1026 |                             mixedCount ++;
1027 |                         }
1028 |                         codecFound = codec;
1029 |                         if (clean) {
1030 |                             foundCount ++;
1031 |                         }
1032 |                         clean = false;
1033 |                     }
1034 |                 });
1035 |             }
1036 | 
1037 |             if (foundCount >= 2 && mixedCount > 1) {
1038 |                 if (bStrict) {
1039 |                     throw new esapi.IntrusionException("Input validation failure", "Multiple (" + foundCount + "x) and mixed encoding (" + mixedCount + "x) detected in " + sInput);
1040 |                 }
1041 |             }
1042 |             else if (foundCount >= 2) {
1043 |                 if (bStrict) {
1044 |                     throw new esapi.IntrusionException("Input validation failure", "Multiple (" + foundCount + "x) encoding detected in " + sInput);
1045 |                 }
1046 |             }
1047 |             else if (mixedCount > 1) {
1048 |                 if (bStrict) {
1049 |                     throw new esapi.IntrusionException("Input validation failure", "Mixed (" + mixedCount + "x) encoding detected in " + sInput);
1050 |                 }
1051 |             }
1052 |             return working;
1053 |         },
1054 | 
1055 |         normalize: function(sInput) {
1056 |             return sInput.replace(/[^\x00-\x7F]/g, '');
1057 |         },
1058 | 
1059 |         encodeForHTML: function(sInput) {
1060 |             return !sInput ? null : _htmlCodec.encode(IMMUNE_HTML, sInput);
1061 |         },
1062 | 
1063 |         decodeForHTML: function(sInput) {
1064 |             return !sInput ? null : _htmlCodec.decode(sInput);
1065 |         },
1066 | 
1067 |         encodeForHTMLAttribute: function(sInput) {
1068 |             return !sInput ? null : _htmlCodec.encode(IMMUNE_HTMLATTR, sInput);
1069 |         },
1070 | 
1071 |         encodeForCSS: function(sInput) {
1072 |             return !sInput ? null : _cssCodec.encode(IMMUNE_CSS, sInput);
1073 |         },
1074 | 
1075 |         encodeForJavaScript: function(sInput) {
1076 |             return !sInput ? null : _javascriptCodec.encode(IMMUNE_JAVASCRIPT, sInput);
1077 |         },
1078 | 
1079 |         encodeForJavascript: this.encodeForJavaScript,
1080 | 
1081 |         encodeForJS: this.encodeForJavascript,
1082 | 
1083 |         encodeForURL: function(sInput) {
1084 |             return !sInput ? null : escape(sInput);
1085 |         },
1086 | 
1087 |         decodeFromURL: function(sInput) {
1088 |             return !sInput ? null : unescape(sInput);
1089 |         },
1090 | 
1091 |         encodeForBase64: function(sInput) {
1092 |             return !sInput ? null : esapi.codecs.Base64.encode(sInput);
1093 |         },
1094 | 
1095 |         decodeFromBase64: function(sInput) {
1096 |             return !sInput ? null : esapi.codecs.Base64.decode(sInput);
1097 |         }
1098 |     };
1099 | };
1100 | 
1101 | module.exports = {
1102 |     encoder: function () {
1103 |         return esapi.DefaultEncoder();
1104 |     },
1105 |     middleware: function () {
1106 |         return utils.middleware;
1107 |     }
1108 | };


--------------------------------------------------------------------------------
/lib/public/esapi-compressed.js:
--------------------------------------------------------------------------------
  1 | var $namespace=function(b,d,a){b=b.split(d||".");a=a||window;var e;d=0;for(e=b.length;d<e;d++)a=a[b[d]]=a[b[d]]||{};return a},$type=function(b,d){if(!b instanceof d)throw new SyntaxError;};if(!$)var $=function(b){return document.getElementById(b)};Array.prototype.each||(Array.prototype.each=function(b){if("function"!=typeof b)throw"Illegal Argument for Array.each";for(var d=0;d<this.length;d++)b(this[d])});
  2 | Array.prototype.contains||(Array.prototype.contains=function(b){var d=!1;this.each(function(a){if(b.equals&&b.equals(a)||a==b)d=!0});return d});Array.prototype.containsKey||(Array.prototype.containsKey=function(b){for(var d in this)if(d.toLowerCase()==b.toLowerCase())return!0;return!1});Array.prototype.getCaseInsensitive||(Array.prototype.getCaseInsensitive=function(b){for(var d in this)if(d.toLowerCase()==b.toLowerCase())return this[d];return null});
  3 | String.prototype.charCodeAt||(String.prototype.charCodeAt=function(b){b=this.charAt(b);for(var d=0;65536>d;d++)if(String.fromCharCode(d)==b)return d;return 0});String.prototype.endsWith||(String.prototype.endsWith=function(b){return this.substr(this.length-b.length,b.length)==b});
  4 | if(!Exception){var Exception=function(b,d){this.cause=d;this.errorMessage=b};Exception.prototype=Error.prototype;Exception.prototype.getCause=function(){return this.cause};Exception.prototype.getMessage=function(){return this.message};Exception.prototype.getStackTrace=function(){if(this.callstack)return this.callstack;if(this.stack){for(var b=stack.split("\n"),d=0,a=b.length;d<a;d++)b[d].match(/^\s*[A-Za-z0-9\=+\$]+\(/)&&this.callstack.push(b[d]);this.callstack.shift()}else if(window.opera&&this.message){b=
  5 |     this.message.split("\n");d=0;for(a=b.length;d<a;d++)if(b[d].match(/^\s*[A-Za-z0-9\=+\$]+\(/)){var e=b[d];b[d+1]&&(e+=" at "+b[d+1],d++);this.callstack.push(e)}this.callstack.shift()}else for(b=arguments.callee.caller;b;)d=b.toString(),d=d.substring(d.indexOf("function")+8,d.indexOf("("))||"anonymous",this.callstack.push(d),b=b.caller;return this.callstack};Exception.prototype.printStackTrace=function(b){var d=this.getMessage()+"|||"+this.getStackTrace().join("|||");this.cause&&this.cause.printStackTrace&&
  6 | (d+="||||||Caused by "+this.cause.printStackTrace().replace("\n","|||"));if(b)b.value?b.value=d.replace("|||","\n"):b.writeln?b.writeln(d.replace("|||","\n")):b.innerHTML?b.innerHTML=d.replace("|||","<br/>"):b.innerText?b.innerText=d.replace("|||","<br/>"):b.append?b.append(d.replace("|||","\n")):b instanceof Function&&b(d.replace("|||","\n"));else return b.replace("|||","\n")}}if(!RuntimeException)var RuntimeException=Exception;if(!IllegalArgumentException)var IllegalArgumentException=Exception;
  7 | if(!DateFormat){var DateFormat=function(b){var d={longMonths:"January February March April May June July August September October November December".split(" "),shortMonths:"Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec".split(" "),longDays:"Sunday Monday Tuesday Wednesday Thursday Friday Saturday".split(" "),shortDays:"Sun Mon Tue Wed Thu Fri Sat".split(" "),d:function(a){return(10>a.getDate()?"0":"")+a.getDate()},D:function(a){return d.shortDays[a.getDay()]},j:function(a){return a.getDate()},l:function(a){return d.longDays[a.getDay()]},
  8 |     N:function(a){return a.getDay()+1},S:function(a){return 1==a.getDate()%10&&11!=a.getDate()?"st":2==a.getDate()%10&&12!=a.getDate()?"nd":3==a.getDate()%10&&13!=a.getDate()?"rd":"th"},w:function(a){return a.getDay()},z:function(a){return"Not Yet Supported"},W:function(a){return"Not Yet Supported"},F:function(a){return d.longMonths[a.getMonth()]},m:function(a){return(9>a.getMonth()?"0":"")+(a.getMonth()+1)},M:function(a){return d.shortMonths[a.getMonth()]},n:function(a){return a.getMonth()+1},t:function(a){return"Not Yet Supported"},
  9 |     L:function(a){return 0==a.getFullYear()%4&&0!=a.getFullYear()%100||0==a.getFullYear()%400?"1":"0"},o:function(a){return"Not Supported"},Y:function(a){return a.getFullYear()},y:function(a){return(""+a.getFullYear()).substr(2)},a:function(a){return 12>a.getHours()?"am":"pm"},A:function(a){return 12>a.getHours()?"AM":"PM"},B:function(a){return"Not Yet Supported"},g:function(a){return a.getHours()%12||12},G:function(a){return a.getHours()},h:function(a){return(10>(a.getHours()%12||12)?"0":"")+(a.getHours()%
 10 |         12||12)},H:function(a){return(10>a.getHours()?"0":"")+a.getHours()},i:function(a){return(10>a.getMinutes()?"0":"")+a.getMinutes()},s:function(a){return(10>a.getSeconds()?"0":"")+a.getSeconds()},e:function(a){return"Not Yet Supported"},I:function(a){return"Not Supported"},O:function(a){return(0>-a.getTimezoneOffset()?"-":"+")+(10>Math.abs(a.getTimezoneOffset()/60)?"0":"")+Math.abs(a.getTimezoneOffset()/60)+"00"},P:function(a){return(0>-a.getTimezoneOffset()?"-":"+")+(10>Math.abs(a.getTimezoneOffset()/
 11 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                60)?"0":"")+Math.abs(a.getTimezoneOffset()/60)+":"+(10>Math.abs(a.getTimezoneOffset()%60)?"0":"")+Math.abs(a.getTimezoneOffset()%60)},T:function(a){var d=a.getMonth();a.setMonth(0);var b=a.toTimeString().replace(/^.+ \(?([^\)]+)\)?$/,"$1");a.setMonth(d);return b},Z:function(a){return 60*-a.getTimezoneOffset()},c:function(a){return a.format("Y-m-d")+"T"+a.format("H:i:sP")},r:function(a){return a.toString()},U:function(a){return a.getTime()/1E3}};return{format:function(a){for(var e="",f=0;f<b.length;f++)var g=
 12 |     b.charAt(f),e=d[g]?e+d[g].call(a):e+g;return e}}};DateFormat.getDateInstance=function(){return new DateFormat("M/d/y h:i a")}}$namespace("org.owasp.esapi");
 13 | org.owasp.esapi.ESAPI=function(b){if(!b)throw new RuntimeException("Configuration Error - Unable to load $ESAPI_Properties Object");var d=null,a=null,e=null,f=null,g=null;return{properties:b,encoder:function(){if(!d){if(!b.encoder.Implementation)throw new RuntimeException("Configuration Error - $ESAPI.properties.encoder.Implementation object not found.");d=new b.encoder.Implementation}return d},logFactory:function(){if(!e){if(!b.logging.Implementation)throw new RuntimeException("Configuration Error - $ESAPI.properties.logging.Implementation object not found.");
 14 |     e=new b.logging.Implementation}return e},logger:function(a){return this.logFactory().getLogger(a)},locale:function(){return org.owasp.esapi.i18n.Locale.getLocale(b.localization.DefaultLocale)},resourceBundle:function(){if(!f){if(!b.localization.StandardResourceBundle)throw new RuntimeException("Configuration Error - $ESAPI.properties.localization.StandardResourceBundle not found.");f=new org.owasp.esapi.i18n.ObjectResourceBundle(b.localization.StandardResourceBundle)}return f},validator:function(){if(!a){if(!b.validation.Implementation)throw new RuntimeException("Configuration Error - $ESAPI.properties.validation.Implementation object not found.");
 15 |     a=new b.validation.Implementation}return a},httpUtilities:function(){g||(g=new org.owasp.esapi.HTTPUtilities);return g}}};var $ESAPI=null;org.owasp.esapi.ESAPI.initialize=function(){$ESAPI=new org.owasp.esapi.ESAPI(Base.esapi.properties)};$namespace("org.owasp.esapi");org.owasp.esapi.Encoder=function(){};$namespace("org.owasp.esapi");
 16 | org.owasp.esapi.EncoderConstants={CHAR_LOWERS:"abcdefghijklmnopqrstuvwxyz".split(""),CHAR_UPPERS:"ABCDEFGHIJKLMNOPQRSTUVWXYZ".split(""),CHAR_DIGITS:"0123456789".split(""),CHAR_SPECIALS:"!$*+-.=?@^_|~".split(""),CHAR_LETTERS:"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ".split(""),CHAR_ALNUM:"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789".split("")};$namespace("org.owasp.esapi");
 17 | org.owasp.esapi.EnterpriseSecurityException=function(b,d,a){b=new Exception(b,a);return{getMessage:b.getMessage,getUserMessage:b.getMessage,getLogMessage:function(){return d},getStackTrace:b.getStackTrace,printStackTrace:b.printStackTrace}};$namespace("org.owasp.esapi");
 18 | org.owasp.esapi.HTTPUtilities=function(){var b=$ESAPI.logger("HTTPUtilities"),d=$ESAPI.resourceBundle(),a=org.owasp.esapi.Logger.EventType;return{addCookie:function(e){$type(e,org.owasp.esapi.net.Cookie);if("http:"!=window.top.location.protocol||"https:"!=window.top.location.protocol)throw new RuntimeException(d.getString("HTTPUtilities.Cookie.Protocol",{protocol:window.top.location.protocol}));var f=e.getName(),g=e.getValue(),h=e.getMaxAge(),k=e.getDomain(),l=e.getPath();e=e.getSecure();var m=new org.owasp.esapi.ValidationErrorList;
 19 |     $ESAPI.validator().getValidInput("cookie name",f,"HttpCookieName",50,!1,m);$ESAPI.validator().getValidInput("cookie value",g,"HttpCookieValue",5E3,!1,m);0==m.size()?(f=f+"="+escape(g),f+=h?";expires="+(new Date((new Date).getTime()+1E3*h)).toGMTString():"",f=f+(l?";path="+l:"")+(k?";domain="+k:""),f+=e||$ESAPI.properties.httputilities.cookies.ForceSecure?";secure":"",document.cookie=f):b.warning(a.SECURITY_FAILURE,d.getString("HTTPUtilities.Cookie.UnsafeData",{name:f,value:g}))},getCookie:function(a){for(var d=
 20 |     document.cookie.split("; "),b=0,h=d.length;b<h;b++){var k=d[b].split("=");if(k[0]==escape(a))return new org.owasp.esapi.net.Cookie(a,k[1]?unescape(k[1]):"")}return null},killAllCookies:function(){for(var a=document.cookie.split("; "),b=0,g=a.length;b<g;b++){var h=a[b].split("="),h=unescape(h[0]);if(!this.killCookie(h))throw new RuntimeException(d.getString("HTTPUtilities.Cookie.CantKill",{name:h}));}},killCookie:function(a){var b=this.getCookie(a);if(b){b.setMaxAge(-10);this.addCookie(b);if(this.getCookie(a))throw new RuntimeException(d.getString("HTTPUtilities.Cookie.CantKill",
 21 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              {name:a}));return!0}return!1},getRequestParameter:function(a){var b=window.top.location.search.substring(1),d=b.indexOf(a);if(0>d)return null;d+=a.length;a=b.indexOf("&",d);0>a&&(a=b.length);return unescape(b.substring(d,a))}}};$namespace("org.owasp.esapi");org.owasp.esapi.IntrusionException=function(b,d,a){b=new org.owasp.esapi.EnterpriseSecurityException(b,d,a);return{getMessage:b.getMessage,getUserMessage:b.getMessage,getLogMessage:b.getLogMessage,getStackTrace:b.getStackTrace,printStackTrace:b.printStackTrace}};
 22 | $namespace("org.owasp.esapi");org.owasp.esapi.LogFactory=function(){return{getLogger:!1}};$namespace("org.owasp.esapi");org.owasp.esapi.Logger=function(){return{setLevel:!1,fatal:!1,error:!1,isErrorEnabled:!1,warning:!1,isWarningEnabled:!1,info:!1,isInfoEnabled:!1,debug:!1,isDebugEnabled:!1,trace:!1,isTraceEnabled:!1}};org.owasp.esapi.Logger.EventType=function(b,d){return{isSuccess:function(){return d},toString:function(){return b}}};
 23 | with(org.owasp.esapi.Logger)EventType.SECURITY_SUCCESS=new EventType("SECURITY SUCCESS",!0),EventType.SECURITY_FAILURE=new EventType("SECURITY FAILURE",!1),EventType.EVENT_SUCCESS=new EventType("EVENT SUCCESS",!0),EventType.EVENT_FAILURE=new EventType("EVENT FAILURE",!1),OFF=Number.MAX_VALUE,FATAL=1E3,ERROR=800,WARNING=600,INFO=400,DEBUG=200,TRACE=100,ALL=Number.MIN_VALUE;$namespace("org.owasp.esapi");
 24 | org.owasp.esapi.PreparedString=function(b,d,a){var e=[],f=[];a||(a="?");(function(b){for(var d=0,k=0,l=0;l<b.length;l++)b.charAt(l)==a&&(k++,e.push(b.substr(d,l)),d=l+1);e.push(b.substr(d));f=Array(k)})(b);return{set:function(a,b,e){if(1>a||a>f.length)throw new IllegalArgumentException("Attempt to set parameter: "+a+" on a PreparedString with only "+f.length+" placeholders");e||(e=d);f[a-1]=e.encode([],b)},toString:function(){for(var a=0;a<f.length;a++)if(null==f[a])throw new RuntimeException("Attempt to render PreparedString without setting parameter "+
 25 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       (a+1));for(var a="",b=0,d=0;d<e.length;d++)a+=e[d],b<f.length&&(a+=f[b++]);return a}}};$namespace("org.owasp.esapi");
 26 | org.owasp.esapi.ValidationErrorList=function(){var b=[];return{addError:function(d,a){if(null==d)throw new RuntimeException("Context cannot be null: "+a.getLogMessage(),a);if(null==a)throw new RuntimeException("Context ("+d+") - Error cannot be null");if(b[d])throw new RuntimeException("Context ("+d+") already exists. must be unique.");b[d]=a},errors:function(){return b},isEmpty:function(){return 0==b.length},size:function(){return b.length}}};$namespace("org.owasp.esapi");
 27 | org.owasp.esapi.ValidationRule=function(){return{getValid:!1,setAllowNull:!1,getTypeName:!1,setTypeName:!1,setEncoder:!1,assertValid:!1,getSafe:!1,isValid:!1,whitelist:!1}};$namespace("org.owasp.esapi");org.owasp.esapi.Validator=function(){return{addRule:!1,getRule:!1,getValidInput:!1,isValidDate:!1,getValidDate:!1,isValidSafeHTML:!1,getValidSafeHTML:!1,isValidCreditCard:!1,getValidCreditCard:!1,isValidFilename:!1,getValidFilename:!1,isValidNumber:!1,getValidNumber:!1,isValidPrintable:!1,getValidPrintable:!1}};
 28 | $namespace("org.owasp.esapi.codecs.Base64");
 29 | org.owasp.esapi.codecs.Base64={_keyStr:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",encode:function(b){if(!b)return null;for(var d="",a,e,f,g,h,k=0,l=org.owasp.esapi.codecs.UTF8.encode(b);k<l.length;)a=l.charCodeAt(k++),b=l.charCodeAt(k++),e=l.charCodeAt(k++),f=a>>2,a=(a&3)<<4|b>>4,g=(b&15)<<2|e>>6,h=e&63,isNaN(b)?g=h=64:isNaN(e)&&(h=64),d+=this._keyStr.charAt(f)+this._keyStr.charAt(a)+this._keyStr.charAt(g)+this._keyStr.charAt(h);return d},decode:function(b){if(!b)return null;
 30 |     for(var d="",a,e,f,g,h=0,k=b.replace(/[^A-Za-z0-9\+\/\=]/g,"");h<k.length;)a=this._keyStr.indexOf(k.charAt(h++)),e=this._keyStr.indexOf(k.charAt(h++)),b=this._keyStr.indexOf(k.charAt(h++)),g=this._keyStr.indexOf(k.charAt(h++)),a=a<<2|e>>4,e=(e&15)<<4|b>>2,f=(b&3)<<6|g,d+=String.fromCharCode(a),64!=b&&(d+=String.fromCharCode(e)),64!=g&&(d+=String.fromCharCode(f));return d=org.owasp.esapi.codecs.UTF8.decode(d)}};$namespace("org.owasp.esapi.codecs");
 31 | org.owasp.esapi.codecs.CSSCodec=function(){var b=new org.owasp.esapi.codecs.Codec;return{encode:b.encode,decode:b.decode,encodeCharacter:function(b,a){if(b.contains(a))return a;var e=org.owasp.esapi.codecs.Codec.getHexForNonAlphanumeric(a);return null==e?a:"\\"+e+" "},decodeCharacter:function(b){b.mark();var a=b.next();if(null==a||"\\"!=a)return b.reset(),null;a=b.next();if(null==a)return b.reset(),null;if(b.isHexDigit(a)){for(var e=0;6>e;e++){var f=b.next();if(null==f||32==f.charCodeAt(0))break;
 32 |     if(b.isHexDigit(f))a+=f;else{input.pushback(f);break}}try{var g=parseInt(a,16);return String.fromCharCode(g)}catch(h){return b.reset(),null}}return a}}};$namespace("org.owasp.esapi.codecs");
 33 | org.owasp.esapi.codecs.Codec=function(){return{encode:function(b,d){for(var a="",e=0;e<d.length;e++)var f=d.charAt(e),a=a+this.encodeCharacter(b,f);return a},encodeCharacter:function(b,d){return d},decode:function(b){var d="";for(b=new org.owasp.esapi.codecs.PushbackString(b);b.hasNext();)var a=this.decodeCharacter(b),d=null!=a?d+a:d+b.next();return d},decodeCharacter:function(b){return b.next()}}};
 34 | org.owasp.esapi.codecs.Codec.getHexForNonAlphanumeric=function(b){return 256>b.charCodeAt(0)?org.owasp.esapi.codecs.Codec.hex[b.charCodeAt(0)]:b.charCodeAt(0).toString(16)};org.owasp.esapi.codecs.Codec.hex=[];for(var c=0;255>c;c++)org.owasp.esapi.codecs.Codec.hex[c]=48<=c&&57>=c||65<=c&&90>=c||97<=c&&122>=c?null:c.toString(16);var entityToCharacterMap=[];entityToCharacterMap["&quot"]="34";entityToCharacterMap["&amp"]="38";entityToCharacterMap["&lt"]="60";entityToCharacterMap["&gt"]="62";
 35 | entityToCharacterMap["&nbsp"]="160";entityToCharacterMap["&iexcl"]="161";entityToCharacterMap["&cent"]="162";entityToCharacterMap["&pound"]="163";entityToCharacterMap["&curren"]="164";entityToCharacterMap["&yen"]="165";entityToCharacterMap["&brvbar"]="166";entityToCharacterMap["&sect"]="167";entityToCharacterMap["&uml"]="168";entityToCharacterMap["&copy"]="169";entityToCharacterMap["&ordf"]="170";entityToCharacterMap["&laquo"]="171";entityToCharacterMap["&not"]="172";
 36 | entityToCharacterMap["&shy"]="173";entityToCharacterMap["&reg"]="174";entityToCharacterMap["&macr"]="175";entityToCharacterMap["&deg"]="176";entityToCharacterMap["&plusmn"]="177";entityToCharacterMap["&sup2"]="178";entityToCharacterMap["&sup3"]="179";entityToCharacterMap["&acute"]="180";entityToCharacterMap["&micro"]="181";entityToCharacterMap["&para"]="182";entityToCharacterMap["&middot"]="183";entityToCharacterMap["&cedil"]="184";entityToCharacterMap["&sup1"]="185";
 37 | entityToCharacterMap["&ordm"]="186";entityToCharacterMap["&raquo"]="187";entityToCharacterMap["&frac14"]="188";entityToCharacterMap["&frac12"]="189";entityToCharacterMap["&frac34"]="190";entityToCharacterMap["&iquest"]="191";entityToCharacterMap["&Agrave"]="192";entityToCharacterMap["&Aacute"]="193";entityToCharacterMap["&Acirc"]="194";entityToCharacterMap["&Atilde"]="195";entityToCharacterMap["&Auml"]="196";entityToCharacterMap["&Aring"]="197";entityToCharacterMap["&AElig"]="198";
 38 | entityToCharacterMap["&Ccedil"]="199";entityToCharacterMap["&Egrave"]="200";entityToCharacterMap["&Eacute"]="201";entityToCharacterMap["&Ecirc"]="202";entityToCharacterMap["&Euml"]="203";entityToCharacterMap["&Igrave"]="204";entityToCharacterMap["&Iacute"]="205";entityToCharacterMap["&Icirc"]="206";entityToCharacterMap["&Iuml"]="207";entityToCharacterMap["&ETH"]="208";entityToCharacterMap["&Ntilde"]="209";entityToCharacterMap["&Ograve"]="210";entityToCharacterMap["&Oacute"]="211";
 39 | entityToCharacterMap["&Ocirc"]="212";entityToCharacterMap["&Otilde"]="213";entityToCharacterMap["&Ouml"]="214";entityToCharacterMap["&times"]="215";entityToCharacterMap["&Oslash"]="216";entityToCharacterMap["&Ugrave"]="217";entityToCharacterMap["&Uacute"]="218";entityToCharacterMap["&Ucirc"]="219";entityToCharacterMap["&Uuml"]="220";entityToCharacterMap["&Yacute"]="221";entityToCharacterMap["&THORN"]="222";entityToCharacterMap["&szlig"]="223";entityToCharacterMap["&agrave"]="224";
 40 | entityToCharacterMap["&aacute"]="225";entityToCharacterMap["&acirc"]="226";entityToCharacterMap["&atilde"]="227";entityToCharacterMap["&auml"]="228";entityToCharacterMap["&aring"]="229";entityToCharacterMap["&aelig"]="230";entityToCharacterMap["&ccedil"]="231";entityToCharacterMap["&egrave"]="232";entityToCharacterMap["&eacute"]="233";entityToCharacterMap["&ecirc"]="234";entityToCharacterMap["&euml"]="235";entityToCharacterMap["&igrave"]="236";entityToCharacterMap["&iacute"]="237";
 41 | entityToCharacterMap["&icirc"]="238";entityToCharacterMap["&iuml"]="239";entityToCharacterMap["&eth"]="240";entityToCharacterMap["&ntilde"]="241";entityToCharacterMap["&ograve"]="242";entityToCharacterMap["&oacute"]="243";entityToCharacterMap["&ocirc"]="244";entityToCharacterMap["&otilde"]="245";entityToCharacterMap["&ouml"]="246";entityToCharacterMap["&divide"]="247";entityToCharacterMap["&oslash"]="248";entityToCharacterMap["&ugrave"]="249";entityToCharacterMap["&uacute"]="250";
 42 | entityToCharacterMap["&ucirc"]="251";entityToCharacterMap["&uuml"]="252";entityToCharacterMap["&yacute"]="253";entityToCharacterMap["&thorn"]="254";entityToCharacterMap["&yuml"]="255";entityToCharacterMap["&OElig"]="338";entityToCharacterMap["&oelig"]="339";entityToCharacterMap["&Scaron"]="352";entityToCharacterMap["&scaron"]="353";entityToCharacterMap["&Yuml"]="376";entityToCharacterMap["&fnof"]="402";entityToCharacterMap["&circ"]="710";entityToCharacterMap["&tilde"]="732";
 43 | entityToCharacterMap["&Alpha"]="913";entityToCharacterMap["&Beta"]="914";entityToCharacterMap["&Gamma"]="915";entityToCharacterMap["&Delta"]="916";entityToCharacterMap["&Epsilon"]="917";entityToCharacterMap["&Zeta"]="918";entityToCharacterMap["&Eta"]="919";entityToCharacterMap["&Theta"]="920";entityToCharacterMap["&Iota"]="921";entityToCharacterMap["&Kappa"]="922";entityToCharacterMap["&Lambda"]="923";entityToCharacterMap["&Mu"]="924";entityToCharacterMap["&Nu"]="925";
 44 | entityToCharacterMap["&Xi"]="926";entityToCharacterMap["&Omicron"]="927";entityToCharacterMap["&Pi"]="928";entityToCharacterMap["&Rho"]="929";entityToCharacterMap["&Sigma"]="931";entityToCharacterMap["&Tau"]="932";entityToCharacterMap["&Upsilon"]="933";entityToCharacterMap["&Phi"]="934";entityToCharacterMap["&Chi"]="935";entityToCharacterMap["&Psi"]="936";entityToCharacterMap["&Omega"]="937";entityToCharacterMap["&alpha"]="945";entityToCharacterMap["&beta"]="946";entityToCharacterMap["&gamma"]="947";
 45 | entityToCharacterMap["&delta"]="948";entityToCharacterMap["&epsilon"]="949";entityToCharacterMap["&zeta"]="950";entityToCharacterMap["&eta"]="951";entityToCharacterMap["&theta"]="952";entityToCharacterMap["&iota"]="953";entityToCharacterMap["&kappa"]="954";entityToCharacterMap["&lambda"]="955";entityToCharacterMap["&mu"]="956";entityToCharacterMap["&nu"]="957";entityToCharacterMap["&xi"]="958";entityToCharacterMap["&omicron"]="959";entityToCharacterMap["&pi"]="960";entityToCharacterMap["&rho"]="961";
 46 | entityToCharacterMap["&sigmaf"]="962";entityToCharacterMap["&sigma"]="963";entityToCharacterMap["&tau"]="964";entityToCharacterMap["&upsilon"]="965";entityToCharacterMap["&phi"]="966";entityToCharacterMap["&chi"]="967";entityToCharacterMap["&psi"]="968";entityToCharacterMap["&omega"]="969";entityToCharacterMap["&thetasym"]="977";entityToCharacterMap["&upsih"]="978";entityToCharacterMap["&piv"]="982";entityToCharacterMap["&ensp"]="8194";entityToCharacterMap["&emsp"]="8195";
 47 | entityToCharacterMap["&thinsp"]="8201";entityToCharacterMap["&zwnj"]="8204";entityToCharacterMap["&zwj"]="8205";entityToCharacterMap["&lrm"]="8206";entityToCharacterMap["&rlm"]="8207";entityToCharacterMap["&ndash"]="8211";entityToCharacterMap["&mdash"]="8212";entityToCharacterMap["&lsquo"]="8216";entityToCharacterMap["&rsquo"]="8217";entityToCharacterMap["&sbquo"]="8218";entityToCharacterMap["&ldquo"]="8220";entityToCharacterMap["&rdquo"]="8221";entityToCharacterMap["&bdquo"]="8222";
 48 | entityToCharacterMap["&dagger"]="8224";entityToCharacterMap["&Dagger"]="8225";entityToCharacterMap["&bull"]="8226";entityToCharacterMap["&hellip"]="8230";entityToCharacterMap["&permil"]="8240";entityToCharacterMap["&prime"]="8242";entityToCharacterMap["&Prime"]="8243";entityToCharacterMap["&lsaquo"]="8249";entityToCharacterMap["&rsaquo"]="8250";entityToCharacterMap["&oline"]="8254";entityToCharacterMap["&frasl"]="8260";entityToCharacterMap["&euro"]="8364";entityToCharacterMap["&image"]="8365";
 49 | entityToCharacterMap["&weierp"]="8472";entityToCharacterMap["&real"]="8476";entityToCharacterMap["&trade"]="8482";entityToCharacterMap["&alefsym"]="8501";entityToCharacterMap["&larr"]="8592";entityToCharacterMap["&uarr"]="8593";entityToCharacterMap["&rarr"]="8594";entityToCharacterMap["&darr"]="8595";entityToCharacterMap["&harr"]="8596";entityToCharacterMap["&crarr"]="8629";entityToCharacterMap["&lArr"]="8656";entityToCharacterMap["&uArr"]="8657";entityToCharacterMap["&rArr"]="8658";
 50 | entityToCharacterMap["&dArr"]="8659";entityToCharacterMap["&hArr"]="8660";entityToCharacterMap["&forall"]="8704";entityToCharacterMap["&part"]="8706";entityToCharacterMap["&exist"]="8707";entityToCharacterMap["&empty"]="8709";entityToCharacterMap["&nabla"]="8711";entityToCharacterMap["&isin"]="8712";entityToCharacterMap["&notin"]="8713";entityToCharacterMap["&ni"]="8715";entityToCharacterMap["&prod"]="8719";entityToCharacterMap["&sum"]="8721";entityToCharacterMap["&minus"]="8722";
 51 | entityToCharacterMap["&lowast"]="8727";entityToCharacterMap["&radic"]="8730";entityToCharacterMap["&prop"]="8733";entityToCharacterMap["&infin"]="8734";entityToCharacterMap["&ang"]="8736";entityToCharacterMap["&and"]="8743";entityToCharacterMap["&or"]="8744";entityToCharacterMap["&cap"]="8745";entityToCharacterMap["&cup"]="8746";entityToCharacterMap["&int"]="8747";entityToCharacterMap["&there4"]="8756";entityToCharacterMap["&sim"]="8764";entityToCharacterMap["&cong"]="8773";
 52 | entityToCharacterMap["&asymp"]="8776";entityToCharacterMap["&ne"]="8800";entityToCharacterMap["&equiv"]="8801";entityToCharacterMap["&le"]="8804";entityToCharacterMap["&ge"]="8805";entityToCharacterMap["&sub"]="8834";entityToCharacterMap["&sup"]="8835";entityToCharacterMap["&nsub"]="8836";entityToCharacterMap["&sube"]="8838";entityToCharacterMap["&supe"]="8839";entityToCharacterMap["&oplus"]="8853";entityToCharacterMap["&otimes"]="8855";entityToCharacterMap["&perp"]="8869";
 53 | entityToCharacterMap["&sdot"]="8901";entityToCharacterMap["&lceil"]="8968";entityToCharacterMap["&rceil"]="8969";entityToCharacterMap["&lfloor"]="8970";entityToCharacterMap["&rfloor"]="8971";entityToCharacterMap["&lang"]="9001";entityToCharacterMap["&rang"]="9002";entityToCharacterMap["&loz"]="9674";entityToCharacterMap["&spades"]="9824";entityToCharacterMap["&clubs"]="9827";entityToCharacterMap["&hearts"]="9829";entityToCharacterMap["&diams"]="9830";var characterToEntityMap=[],entity;
 54 | for(entity in entityToCharacterMap)characterToEntityMap[entityToCharacterMap[entity]]=entity;$namespace("org.owasp.esapi.codecs");
 55 | org.owasp.esapi.codecs.HTMLEntityCodec=function(){var b=new org.owasp.esapi.codecs.Codec;return{encode:b.encode,decode:b.decode,encodeCharacter:function(b,a){if(b.contains(a))return a;var e=org.owasp.esapi.codecs.Codec.getHexForNonAlphanumeric(a);if(null==e)return a;var f=a.charCodeAt(0);if(31>=f&&"\t"!=a&&"\n"!=a&&"\r"!=a||127<=f&&159>=f||" "==a)return" ";f=characterToEntityMap[f];return null!=f?f+";":"&#x"+e+";"},decodeCharacter:function(b){b.mark();var a=b.next();if(null==a||"&"!=a)return b.reset(),
 56 |     null;a=b.next();if(null==a)return b.reset(),null;if("#"==a){var e;a=b.peek();if(null==a)e=null;else if("x"==a||"X"==a){b.next();for(a="";b.hasNext();){var f=b.peek();if(f.match(/[0-9A-Fa-f]/))a+=f,b.next();else{";"==f&&b.next();break}}try{e=parseInt(a,16)}catch(g){e=null}}else{for(a="";b.hasNext();)if(f=b.peek(),f.match(/[0-9]/))a+=f,b.next();else{";"==f&&b.next();break}try{e=parseInt(a)}catch(h){e=null}}if(null!=e)return e}else if(a.match(/[A-Za-z]/)){b.pushback(a);for(e="";b.hasNext();)if(a=b.peek(),
 57 |     a.match(/[A-Za-z]/)){if(e+=a,b.next(),entityToCharacterMap.containsKey("&"+e)){b.peek(";")&&b.next();break}}else if(";"==a)b.next();else break;e=String.fromCharCode(entityToCharacterMap.getCaseInsensitive("&"+e));if(null!=e)return e}b.reset();return null}}};$namespace("org.owasp.esapi.codecs");
 58 | org.owasp.esapi.codecs.JavascriptCodec=function(){return{encode:function(b,d){for(var a="",e=0;e<d.length;e++){var f=d.charAt(e);if(b.contains(f))a+=f;else if(null==org.owasp.esapi.codecs.Codec.getHexForNonAlphanumeric(f))a+=f;else{var g=f.charCodeAt(0).toString(16);256>f.charCodeAt(0)?(f="00".substr(g.length),a+="\\x"+f+g.toUpperCase()):(f="0000".substr(g.length),a+="\\u"+f+g.toUpperCase())}}return a},decode:(new org.owasp.esapi.codecs.Codec).decode,decodeCharacter:function(b){b.mark();var d=b.next();
 59 |     if(null==d||"\\"!=d)return b.reset(),null;d=b.next();if(null==d)return b.reset(),null;if("b"==d)return 8;if("t"==d)return 9;if("n"==d)return 10;if("v"==d)return 11;if("f"==d)return 12;if("r"==d)return 13;if('"'==d)return 34;if("'"==d)return 39;if("\\"==d)return 92;if("x"==d.toLowerCase()){for(var d="",a=0;2>a;a++){var e=b.nextHex();if(null!=e)d+=e;else return input.reset(),null}try{return g=parseInt(d,16),String.fromCharCode(g)}catch(f){return b.reset(),null}}else if("u"==d.toLowerCase()){d="";for(a=
 60 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                0;4>a;a++)if(e=b.nextHex(),null!=e)d+=e;else return input.reset(),null;try{var g=parseInt(d,16);return String.fromCharCode(g)}catch(h){return b.reset(),null}}else if(b.isOctalDigit(d)){a=b.next();b.isOctalDigit(a)?(d+=a,a=b.next(),b.isOctalDigit(a)?d+=a:b.pushback(a)):b.pushback(a);try{return g=parseInt(d,8),String.fromCharCode(g)}catch(k){return b.reset(),null}}return d}}};$namespace("org.owasp.esapi.codecs");
 61 | org.owasp.esapi.codecs.PercentCodec=function(){var b=new org.owasp.esapi.codecs.Codec;return{encode:b.encode,decode:b.decode,encodeCharacter:function(b,a){if(-1<"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789".indexOf(a))return a;for(var e=org.owasp.esapi.codecs.UTF8.encode(a),f="",g=0;g<e.length;g++){var h;h=e.charCodeAt(g);var k="";if(-128>h||127<h)throw new IllegalArgumentException("b is not a byte (was "+h+")");h&=255;16>h&&(k+="0");h=k+h.toString(16).toUpperCase();f+="%"+h}return f},
 62 |     decodeCharacter:function(b){b.mark();var a=b.next();if(null==a||"%"!=a)return b.reset(),null;for(var a="",e=0;2>e;e++){var f=b.nextHex();null!=f&&(a+=f)}if(2==a.length)try{var g=parseInt(a,16);return String.fromCharCode(g)}catch(h){}b.reset();return null}}};$namespace("org.owasp.esapi.codecs");
 63 | org.owasp.esapi.codecs.PushbackString=function(b){var d="",a="",e=0,f=0;return{pushback:function(a){d=a},index:function(){return e},hasNext:function(){return null!=d?!0:!(null==b||0==b.length||e>=b.length)},next:function(){if(null!=d){var a=d;d=null;return a}return null==b||0==b.length||e>=b.length?null:b.charAt(e++)},nextHex:function(){var a=this.next();return this.isHexDigit(a)?a:null},nextOctal:function(){var a=this.next();return this.isOctalDigit(a)?a:null},isHexDigit:function(a){return null!=
 64 |     a&&("0"<=a&&"9">=a||"a"<=a&&"f">=a||"A"<=a&&"F">=a)},isOctalDigit:function(a){return null!=a&&"0"<=a&&"7">=a},peek:function(a){return a?null!=d&&d==a?!0:null==b||0==b.length||e>=b.length?!1:b.charAt(e)==a:null!=d?d:null==b||0==b.length||e>=b.length?null:b.charAt(e)},mark:function(){a=d;f=e},reset:function(){d=a;e=f},remainder:function(){var a=b.substr(e);null!=d&&(a=d+a);return a}}};$namespace("org.owasp.esapi.codecs");
 65 | org.owasp.esapi.codecs.UTF8={encode:function(b){b=b.replace(/\r\n/g,"\n");for(var d="",a=0;a<b.length;a++){var e=b.charCodeAt(a);128>e?d+=String.fromCharCode(e):(127<e&&2048>e?d+=String.fromCharCode(e>>6|192):(d+=String.fromCharCode(e>>12|224),d+=String.fromCharCode(e>>6&63|128)),d+=String.fromCharCode(e&63|128))}return d},decode:function(b){for(var d="",a=c=c1=c2=0;a<b.length;)c=b.charCodeAt(a),128>c?(d+=String.fromCharCode(c),a++):191<c&&224>c?(c2=b.charCodeAt(a+1),d+=String.fromCharCode((c&31)<<
 66 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6|c2&63),a+=2):(c2=utftext.charCodeAt(a+1),c3=utftext.charCodeAt(a+2),string+=String.fromCharCode((c&15)<<12|(c2&63)<<6|c3&63),a+=3);return d}};$namespace("org.owasp.esapi.i18n");org.owasp.esapi.i18n.ArrayResourceBundle=function(b,d,a,e){with(org.owasp.esapi.i18n)b=new ResourceBundle(b,d,e);return{getParent:b.getParent,getLocale:b.getLocale,getName:b.getName,getString:b.getString,getMessage:function(b){return a[b]}}};$namespace("org.owasp.esapi.i18n");
 67 | org.owasp.esapi.i18n.Locale=function(b,d,a){return{getLanguage:function(){return b},getCountry:function(){return d},getVariant:function(){return a},toString:function(){return b+(d?"-"+d+(a?"-"+a:""):"")}}};org.owasp.esapi.i18n.Locale.US=new org.owasp.esapi.i18n.Locale("en","US");org.owasp.esapi.i18n.Locale.GB=new org.owasp.esapi.i18n.Locale("en","GB");
 68 | org.owasp.esapi.i18n.Locale.getLocale=function(b){b=b.split("-");return new org.owasp.esapi.i18n.Locale(b[0],1<b.length?b[1]:"",2<b.length?b.length[2]:"")};org.owasp.esapi.i18n.Locale.getDefault=function(){var b=(navigator.language?navigator.language:navigator.userLanguage?navigator.userLanguage:"en-US").split("-");return new org.owasp.esapi.i18n.Locale(b[0],1<b.length?b[1]:"",2<b.length?b.length[2]:"")};$namespace("org.owasp.esapi.i18n");
 69 | org.owasp.esapi.i18n.ObjectResourceBundle=function(b,d){var a=new org.owasp.esapi.i18n.ResourceBundle(b.name,org.owasp.esapi.i18n.Locale.getLocale(b.locale),d),e=b.messages;return{getParent:a.getParent,getLocale:a.getLocale,getName:a.getName,getString:a.getString,getMessage:function(a){return e[a]}}};$namespace("org.owasp.esapi.i18n");
 70 | org.owasp.esapi.i18n.ResourceBundle=function(b,d,a){if(!b)throw new SyntaxError("Name required for implementations of org.owasp.esapi.i18n.ResourceBundle");if(!d)throw new SyntaxError("Locale required for implementations of org.owasp.esapi.i18n.ResourceBundle");return{getParent:function(){return a},getLocale:function(){return d},getName:function(){return b},getMessage:function(a){return a},getString:function(b,d){if(1>arguments.length)throw new IllegalArgumentException("No key passed to getString");
 71 |     var g=this.getMessage(b);if(!g)return a?a.getString(b,d):b;if(!g.match(/\{([A-Za-z]+)\}/)||!d)return g;for(var h="",k=0;;){var l=g.indexOf("{",k),m=g.indexOf("}",l);if(0>l){h+=g.substr(k,g.length-k);break}if(0<=l&&-1>m)throw new SyntaxError("Invalid Message - Unclosed Context Reference: "+g);h+=g.substring(k,l);k=g.substring(l+1,m);h=d[k]?h+d[k]:h+g.substring(l,m+1);k=m+1}return h}}};
 72 | org.owasp.esapi.i18n.ResourceBundle.getResourceBundle=function(b,d){var a=b+"_"+d.toString().replace("-","_");with(org.owasp.esapi.i18n)return ResourceBundle[a]instanceof Object?ResourceBundle[a]:new ResourceBundle[a]};$namespace("org.owasp.esapi.net");
 73 | org.owasp.esapi.net.Cookie=function(b,d){var a,e,f,g,h,k,l,m=$ESAPI.resourceBundle();if(!function(a){for(var b=0,d=a.length;b<d;b++){var e=a.charCodeAt(b),f=a.charAt(b);if(32>e||127<=e||-1!=",; ".indexOf(f))return!1}return!0}(b)||"comment"==b.toLowerCase()||"discard"==b.toLowerCase()||"domain"==b.toLowerCase()||"expires"==b.toLowerCase()||"max-age"==b.toLowerCase()||"path"==b.toLowerCase()||"secure"==b.toLowerCase()||"version"==b.toLowerCase()||"$"==b.charAt(0)){var q=m.getString("Cookie.Name",{name:b});
 74 |     throw new IllegalArgumentException(q);}a=d;return{setComment:function(a){e=a},getComment:function(){return e},setDomain:function(a){f=a.toLowerCase()},getDomain:function(){return f},setMaxAge:function(a){g=a},getMaxAge:function(){return g},setPath:function(a){h=a},getPath:function(){return h},setSecure:function(a){k=a},getSecure:function(){return k},getName:function(){return b},setValue:function(b){a=b},getValue:function(){return a},setVersion:function(a){if(0>a||1<a)throw new IllegalArgumentException(m.getString("Cookie.Version",
 75 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            {version:a}));l=a},getVersion:function(){return l}}};$namespace("org.owasp.esapi.reference.encoding");
 76 | org.owasp.esapi.reference.encoding.DefaultEncoder=function(b){var d=[],a=new org.owasp.esapi.codecs.HTMLEntityCodec,e=new org.owasp.esapi.codecs.JavascriptCodec,f=new org.owasp.esapi.codecs.CSSCodec,g=new org.owasp.esapi.codecs.PercentCodec;b?d=b:(d.push(a),d.push(e),d.push(f),d.push(g));var h=[",",".","-","_"," "],k=[",",".","-","_"],l=[],m=[",",".","_"];return{cananicalize:function(a,b){if(!a)return null;for(var e=a,f=null,g=1,h=0,m=!1;!m;)m=!0,d.each(function(a){var b=e;e=a.decode(e);b!=e&&(null!=
 77 |     f&&f!=a&&g++,f=a,m&&h++,m=!1)});if(2<=h&&1<g){if(b)throw new org.owasp.esapi.IntrusionException("Input validation failure","Multiple ("+h+"x) and mixed encoding ("+g+"x) detected in "+a);}else if(2<=h){if(b)throw new org.owasp.esapi.IntrusionException("Input validation failure","Multiple ("+h+"x) encoding detected in "+a);}else if(1<g&&b)throw new org.owasp.esapi.IntrusionException("Input validation failure","Mixed ("+g+"x) encoding detected in "+a);return e},normalize:function(a){return a.replace(/[^\x00-\x7F]/g,
 78 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "")},encodeForHTML:function(b){return b?a.encode(h,b):null},decodeForHTML:function(b){return b?a.decode(b):null},encodeForHTMLAttribute:function(b){return b?a.encode(k,b):null},encodeForCSS:function(a){return a?f.encode(l,a):null},encodeForJavaScript:function(a){return a?e.encode(m,a):null},encodeForJavascript:this.encodeForJavaScript,encodeForURL:function(a){return a?escape(a):null},decodeFromURL:function(a){return a?unescape(a):null},encodeForBase64:function(a){return a?org.owasp.esapi.codecs.Base64.encode(a):
 79 |     null},decodeFromBase64:function(a){return a?org.owasp.esapi.codecs.Base64.decode(a):null}}};$namespace("org.owasp.esapi.reference.logging");
 80 | org.owasp.esapi.reference.logging.Log4JSLogFactory=function(){var b=function(b){return{setLevel:function(a){},trace:function(a,b,d){this.log(10,a,b,d)},debug:function(a,b,d){this.log(20,a,b,d)},info:function(a,b,d){this.log(30,a,b,d)},warning:function(a,b,d){this.log(40,a,b,d)},error:function(a,b,d){this.log(50,a,b,d)},fatal:function(a,b,d){this.log(60,a,b,d)},log:function(a,b,d,g){},addAppender:function(a){},isLogUrl:function(){},setLogUrl:function(a){},isLogApplicationName:function(){},setLogApplicationName:function(a){},
 81 |     isEncodingRequired:function(){},setEncodingRequired:function(a){},setEncodingFunction:function(a){},isDebugEnabled:function(){},isErrorEnabled:function(){},isFatalEnabled:function(){},isInfoEnabled:function(){},isTraceEnabled:function(){},isWarningEnabled:function(){}}};return{getLogger:function(d){return new b("string"==typeof d?d:d.constructor.toString())}}};$namespace("org.owasp.esapi.reference.validation");
 82 | org.owasp.esapi.reference.validation.BaseValidationRule=function(b,d,a){var e=$ESAPI.logger("Validation"),f=org.owasp.esapi.Logger.EventType,g=b,h=d?d:$ESAPI.encoder(),k=!1;b=org.owasp.esapi.i18n.ResourceBundle;a=a?a:$ESAPI.locale();var l;$ESAPI.properties.validation.ResourceBundle&&(l=b.getResourceBundle($ESAPI.properties.validation.ResourceBundle,a));l||(l=$ESAPI.resourceBundle(),e.info(f.EVENT_FAILURE,"No Validation ResourceBundle - Defaulting to "+l.getName()+"("+l.getLocale().toString()+")"));
 83 |     e.info(f.EVENT_SUCCESS,"Validation Rule Initialized with ResourceBundle: "+l.getName());return{setAllowNull:function(a){k=a},isAllowNull:function(){return k},getTypeName:function(){return g},setTypeName:function(a){g=a},setEncoder:function(a){h=a},getEncoder:function(){return h},assertValid:function(a,b){this.getValid(a,b)},getValid:function(a,b,d){d=null;try{d=this.getValidInput(a,b)}catch(e){return this.sanitize(a,b)}return d},getValidInput:function(a,b){return b},getSafe:function(a,b){var d=null;
 84 |         try{d=this.getValidInput(a,b)}catch(e){return this.sanitize(a,b)}return d},sanitize:function(a,b){return b},isValid:function(a,b){try{this.getValidInput(a,b)}catch(d){return!1}return!0},whitelist:function(a,b){for(var d="",e=0;e<a.length;e++){var g=a.charAt(e);b.contains(g)&&(d+=g)}return d},getUserMessage:function(a,b,d){return this.getMessage(a+".Usr",b+".Usr",d)},getLogMessage:function(a,b,d){return this.getMessage(a+".Log",b+".Log",d)},getMessage:function(a,b,d){return l.getString(a,d)?l.getString(a,
 85 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d):l.getString(b,d)},validationException:function(a,b,d,e){throw new org.owasp.esapi.reference.validation.ValidationException(this.getUserMessage(a+"."+d,b+"."+d,e),this.getLogMessage(a+"."+d,b+"."+d,e),a);}}};$namespace("org.owasp.esapi.reference.validation");
 86 | org.owasp.esapi.reference.validation.CreditCardValidationRule=function(b,d,a){var e=new org.owasp.esapi.reference.validation.BaseValidationRule(b,d,a),f=19;ccRule=function(){var b=RegExp($ESAPI.properties.validation.CreditCard),b=new org.owasp.esapi.reference.validation.StringValidationRule("ccrule",e.getEncoder(),a,b);b.setMaxLength(f);b.setAllowNull(!1);return b}();return{getMaxCardLength:function(){return f},setMaxCardLength:function(a){f=a},setAllowNull:e.setAllowNull,isAllowNull:e.isAllowNull,
 87 |     getTypeName:e.getTypeName,setTypeName:e.setTypeName,setEncoder:e.setEncoder,getEncoder:e.getEncoder,assertValid:e.assertValid,getValid:e.getValid,getValidInput:function(a,b){if(!b||""==b.trim()){if(this.isAllowNull())return null;e.validationException(a,"CreditCard","Required",{context:a,input:b})}for(var d=(void 0).getValid(a,b),f="",m,q=0;o<d.length;q++)m=d.charAt(q),m.match(/[0-9]/)&&(f+=m);for(var n=m=0,n=0,p=!1,r=f.length-1;0<=r;r--)n=parseInt(f.substring(r,q+1)),p&&(n*=2,9<n&&(n-=9)),m+=n,p=
 88 |         !p;0!=m%10&&e.validationException(a,"CreditCard","Invalid",{context:a,input:b});return d},getSafe:e.getSafe,sanitize:function(a,b){return this.whitelist(b,org.owasp.esapi.EncoderConstants.CHAR_DIGITS)},isValid:e.isValid,whitelist:e.whitelist}};$namespace("org.owasp.esapi.reference.validation");
 89 | org.owasp.esapi.reference.validation.DateValidationRule=function(b,d,a){var e=new org.owasp.esapi.reference.validation.BaseValidationRule(b,d,a),f=DateFormat.getDateInstance(),g=function(a,b){if(!a||""==a.trim()){if(e.isAllowNull())return null;e.validationException(a,"Date","Required",{context:a,input:b,format:f})}var d=e.getEncoder().cananicalize(b);try{return f.parse(d)}catch(g){e.validationException(a,"Date","Invalid",{context:a,input:b,format:f})}};return{setDateFormat:function(a){if(!a)throw new IllegalArgumentException("DateValidationRule.setDateFormat requires a non-null DateFormat");
 90 |     f=a},setAllowNull:e.setAllowNull,isAllowNull:e.isAllowNull,getTypeName:e.getTypeName,setTypeName:e.setTypeName,setEncoder:e.setEncoder,getEncoder:e.getEncoder,assertValid:e.assertValid,getValid:e.getValid,getValidInput:function(a,b){return g(a,b)},getSafe:e.getSafe,sanitize:function(a,b){var d=new Date(0);try{d=g(a,b)}catch(e){}return d},isValid:e.isValid,whitelist:e.whitelist}};$namespace("org.owasp.esapi.reference.validation");
 91 | org.owasp.esapi.reference.validation.DefaultValidator=function(b,d){var a=[],e=b?b:$ESAPI.encoder(),f=d?d:org.owasp.esapi.i18n.Locale.getDefault(),g=org.owasp.esapi.reference.validation;return{addRule:function(b){a[b.getName()]=b},getRule:function(b){return a[b]},isValidInput:function(a,b,d,e,f){try{return this.getValidInput(a,b,d,e,f),!0}catch(g){return!1}},getValidInput:function(a,b,d,g,q,n){var p=new org.owasp.esapi.reference.validation.StringValidationRule(d,e,f),r=RegExp($ESAPI.properties.validation[d]);
 92 |     if(r&&r instanceof RegExp)p.addWhitelistPattern(r);else throw new IllegalArgumentException("Invalid Type: "+d+" not found.");p.setMaxLength(g);p.setAllowNull(q);try{return p.getValid(a,b)}catch(s){throw s instanceof r.ValidationErrorList&&n&&n.addError(a,s),s;}},isValidDate:function(a,b,d,e){try{return this.getValidDate(a,b,d,e),!0}catch(f){return!1}},getValidDate:function(a,b,d,m,q){var n=new g.DateValidationRule(a,e,f);n.setAllowNull(m);n.setDateFormat(d);try{return n.getValid(a,b)}catch(p){throw p instanceof
 93 |     g.ValidationErrorList&&q&&q.addError(a,p),p;}},getValidCreditCard:function(a,b,d,m){var q=new g.CreditCardValidationRule(a,e,f);q.setAllowNull(d);try{return q.getValid(a,b)}catch(n){throw n instanceof g.ValidationErrorList&&m&&m.addError(a,n),n;}},isValidCreditCard:function(a,b,d){try{return this.getValidCreditCard(a,b,d),!0}catch(e){return!1}},getValidNumber:function(a,b,d,m,q,n){m=new g.NumberValidationRule(a,e,f,m,q);m.setAllowNull(d);try{return m.getValid(a,b)}catch(p){throw p instanceof g.ValidationErrorList&&
 94 |     n&&n.addError(a,p),p;}},isValidNumber:function(a,b,d,e,f){try{return this.getValidNumber(a,b,d,e,f),!0}catch(g){return!1}},getValidInteger:function(a,b,d,m,q,n){m=new g.IntegerValidationRule(a,e,f,m,q);m.setAllowNull(d);try{return m.getValid(a,b)}catch(p){throw p instanceof g.ValidationErrorList&&n&&n.addError(a,p),p;}},isValidInteger:function(a,b,d,e,f){try{return this.getValidInteger(a,b,d,e,f),!0}catch(g){return!1}}}};$namespace("org.owasp.esapi.reference.validation");
 95 | org.owasp.esapi.reference.validation.IntegerValidationRule=function(b,d,a,e,f){var g=new org.owasp.esapi.reference.validation.BaseValidationRule(b,d,a),h=e?e:Number.MIN_VALUE,k=f?f:Number.MAX_VALUE;if(h>=k)throw new IllegalArgumentException("minValue must be less than maxValue");var l=function(a,b){if(!b||""==b.trim()){if(g.allowNull())return null;g.validationException(a,"Integer","Required",{context:a,input:b,minValue:h,maxValue:k})}var d=g.getEncoder().cananicalize(b),d=parseInt(d);"NaN"==d&&g.validationException(a,
 96 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "Integer","NaN",{context:a,input:b,minValue:h,maxValue:k});d<h&&g.validationException(a,"Integer","MinValue",{context:a,input:b,minValue:h,maxValue:k});d>k&&g.validationException(a,"Integer","MaxValue",{context:a,input:b,minValue:h,maxValue:k});return d};return{setMinValue:function(a){h=a},getMinValue:function(){return h},setMaxValue:function(a){k=a},getMaxValue:function(){return k},setAllowNull:g.setAllowNull,isAllowNull:g.isAllowNull,getTypeName:g.getTypeName,setTypeName:g.setTypeName,setEncoder:g.setEncoder,
 97 |     getEncoder:g.getEncoder,assertValid:g.assertValid,getValid:g.getValid,getValidInput:function(a,b){return l(a,b)},getSafe:g.getSafe,sanitize:function(a,b){var d=0;try{d=l(a,b)}catch(e){}return d},isValid:g.isValid,whitelist:g.whitelist}};$namespace("org.owasp.esapi.reference.validation");
 98 | org.owasp.esapi.reference.validation.NumberValidationRule=function(b,d,a,e,f){var g=new org.owasp.esapi.reference.validation.BaseValidationRule(b,d,a),h=e?e:Number.MIN_VALUE,k=f?f:Number.MAX_VALUE;if(h>=k)throw new IllegalArgumentException("MinValue must be less that MaxValue");var l=function(a,b){if(!b||""==b.trim()){if(g.isAllowNull())return null;g.validationException(a,"Number","Required",{context:a,input:b,minValue:h,maxValue:k})}var d=g.getEncoder().cananicalize(b),e=0;try{e=parseFloat(d)}catch(f){g.validationException(a,
 99 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "Number","Invalid",{context:a,input:b,minValue:h,maxValue:k})}"NaN"==e&&g.validationException(a,"Number","NaN",{context:a,input:b,minValue:h,maxValue:k});e<h&&g.validationException(a,"Number","MinValue",{context:a,input:b,minValue:h,maxValue:k});e>k&&g.validationException(a,"Number","MaxValue",{context:a,input:b,minValue:h,maxValue:k});return e};return{setMinValue:function(a){h=a},getMinValue:function(){return h},setMaxValue:function(a){k=a},getMaxValue:function(){return k},setAllowNull:g.setAllowNull,
100 |     isAllowNull:g.isAllowNull,getTypeName:g.getTypeName,setTypeName:g.setTypeName,setEncoder:g.setEncoder,getEncoder:g.getEncoder,assertValid:g.assertValid,getValid:g.getValid,getValidInput:function(a,b){return l(a,b)},getSafe:g.getSafe,sanitize:function(a,b){var d=0;try{d=l(a,b)}catch(e){}return d},isValid:g.isValid,whitelist:g.whitelist}};$namespace("org.owasp.esapi.reference.validation");
101 | org.owasp.esapi.reference.validation.StringValidationRule=function(b,d,a,e){var f=new org.owasp.esapi.reference.validation.BaseValidationRule(b,d,a),g=[],h=[],k=0,l=Number.MAX_VALUE,m=!0;if(e)if(e instanceof String)g.push(RegExp(e));else if(e instanceof RegExp)g.push(e);else throw new IllegalArgumentException("sWhiteListPattern must be a string containing RegExp or a RegExp Object");var q=function(a,b,d){g.each(function(e){b.match(e)&&f.validationException(a,"String","Whitelist",{context:a,input:b,
102 |     orig:d,pattern:e.toString(),minLength:k,maxLength:l,validateInputAndCanonical:m})})},n=function(a,b,d){h.each(function(e){b.match(e)&&f.validationException(a,"String","Blacklist",{context:a,input:b,orig:d,pattern:e.toString(),minLength:k,maxLength:l,validateInputAndCanonical:m})})},p=function(a,b,d){b.length<k&&f.validationException(a,"String","MinLength",{context:a,input:b,orig:d,minLength:k,maxLength:l,validateInputAndCanonical:m});b.length>l&&f.validationException(a,"String","MaxLength",{context:a,
103 |     input:b,orig:d,minLength:k,maxLength:l,validateInputAndCanonical:m});return b},r=function(a,b,d){if(!b||""==b.trim()){if(f.isAllowNull())return null;f.validationException(a,"String","Required",{context:a,input:b,orig:d,minLength:k,maxLength:l,validateInputAndCanonical:m})}};return{addWhitelistPattern:function(a){if(a instanceof String)g.push(RegExp(a));else if(a instanceof RegExp)g.push(a);else throw new IllegalArgumentException("p must be a string containing RegExp or a RegExp Object");},addBlacklistPattern:function(a){if(a instanceof
104 |     String)h.push(RegExp(a));else if(a instanceof RegExp)h.push(a);else throw new IllegalArgumentException("p must be a string containing RegExp or a RegExp Object");},setMinLength:function(a){k=a},getMinLength:function(){return k},setMaxLength:function(a){l=a},getMaxLength:function(){return l},setValidateInputAndCanonical:function(a){m=a},isValidateInputAndCanonical:function(){return m},setAllowNull:f.setAllowNull,isAllowNull:f.isAllowNull,getTypeName:f.getTypeName,setTypeName:f.setTypeName,setEncoder:f.setEncoder,
105 |     getEncoder:f.getEncoder,assertValid:f.assertValid,getValid:f.getValid,getValidInput:function(a,b){var d=null;if(null==r(a,b))return null;m&&(p(a,b),q(a,b),n(a,b));d=this.getEncoder().cananicalize(b);if(null==r(a,d,b))return null;p(a,d,b);q(a,d,b);n(a,d,b);return d},getSafe:f.getSafe,sanitize:function(a,b){return this.whitelist(b,org.owasp.esapi.EncoderConstants.CHAR_ALNUM)},isValid:f.isValid,whitelist:f.whitelist}};$namespace("org.owasp.esapi.reference.validation");
106 | org.owasp.esapi.reference.validation.ValidationException=function(b,d,a,e){var f,g;a&&a instanceof Exception?(f=a,e&&e instanceof String&&(g=e)):a&&a instanceof String&&(g=a);b=new org.owasp.esapi.EnterpriseSecurityException(b,d,f);return{setContext:function(a){g=a},getContext:function(){return g},getMessage:b.getMessage,getUserMessage:b.getMessage,getLogMessage:b.getLogMessage,getStackTrace:b.getStackTrace,printStackTrace:b.printStackTrace}};


--------------------------------------------------------------------------------
/lib/public/resources/Base.esapi.properties.js:
--------------------------------------------------------------------------------
 1 | /*
 2 |  * OWASP Enterprise Security API (ESAPI)
 3 |  *
 4 |  * This file is part of the Open Web Application Security Project (OWASP)
 5 |  * Enterprise Security API (ESAPI) project. For details, please see
 6 |  * <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
 7 |  *
 8 |  * Copyright (c) 2008 - The OWASP Foundation
 9 |  *
10 |  * The ESAPI is published by OWASP under the BSD license. You should read and accept the
11 |  * LICENSE before you use, modify, and/or redistribute this software.
12 |  */
13 | 
14 | $namespace('Base.esapi.properties');
15 | 
16 | Base.esapi.properties = {
17 |     application: {
18 |         // Change this value to reflect your application, or override it in an application scoped configuration.
19 |         Name: 'ESAPI4JS Base Application'
20 |     },
21 | 
22 |     httputilities: {
23 |         cookies: {
24 |             ForceSecure: true
25 |         }
26 |     },
27 | 
28 |     logging: {
29 |         Implementation: org.owasp.esapi.reference.logging.Log4JSLogFactory,
30 |         Level: org.owasp.esapi.Logger.ERROR,
31 |         // For a console that pops up in a seperate window
32 |         // Appenders: [ new ConsoleAppender(true) ],
33 |         // To log to a logging service on the server
34 |         // Appenders: [ new AjaxAppender( '/log/' ) ],
35 |         // Default to log nowhere
36 |         Appenders: [  ],
37 |         LogUrl: false,
38 |         LogApplicationName: false,
39 |         EncodingRequired: true
40 |     },
41 | 
42 |     encoder: {
43 |         Implementation: org.owasp.esapi.reference.encoding.DefaultEncoder,
44 |         AllowMultipleEncoding: false
45 |     },
46 | 
47 |     localization: {
48 |         StandardResourceBundle: ESAPI_Standard_en_US,
49 |         DefaultLocale: 'en-US'
50 |     },
51 | 
52 |     validation: {
53 |         Implementation: org.owasp.esapi.reference.validation.DefaultValidator,
54 |         AccountName: '^[a-zA-Z0-9]{3,20}$',
55 |         SafeString: '[a-zA-Z0-9\\-_+]*',
56 |         Email: '^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\\.[a-zA-Z]{2,4}$',
57 |         IPAddress: '^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$',
58 |         URL: '^(ht|f)tp(s?)\\:\\/\\/[0-9a-zA-Z]([-.\\w]*[0-9a-zA-Z])*(:(0-9)*)*(\\/?)([a-zA-Z0-9\\-\\.\\?\\,\\:\\\'\\/\\\\\\+=&amp;%\\$#_]*)?$',
59 |         CreditCard: '^(\\d{4}[- ]?){3}\\d{4}$',
60 |         SSN: '^(?!000)([0-6]\\d{2}|7([0-6]\\d|7[012]))([ -]?)(?!00)\\d\\d\\3(?!0000)\\d{4}$',
61 |         HttpScheme: '^(http|https)$',
62 |         HttpServerName: '^[a-zA-Z0-9_.\\-]*$',
63 |         HttpParameterName: '^[a-zA-Z0-9_]{1,32}$',
64 |         HttpParameterValue: '^[a-zA-Z0-9.\\-\\/+=_ ]*$',
65 |         HttpCookieName: '^[a-zA-Z0-9\\-_]{1,32}$',
66 |         HttpCookieValue: '^[a-zA-Z0-9\\-\\/+=_ ]*$'
67 |     }
68 | };


--------------------------------------------------------------------------------
/lib/public/resources/i18n/ESAPI_Standard_en_US.properties.js:
--------------------------------------------------------------------------------
 1 | var ESAPI_Standard_en_US = {
 2 |     name: 'ESAPI Standard Messages - US English',
 3 |     locale: 'en-US',
 4 |     messages: {
 5 |         "Test"                              : "This is test #{testnumber}",
 6 | 
 7 |         // Messages for validation
 8 |         "CreditCard.Required.Usr"           : "{context}: Input credit card required",
 9 |         "CreditCard.Required.Log"           : "Input credit card required: context={context}, input={input}",
10 |         "CreditCard.Invalid.Usr"            : "{context}: Invalid credit card input",
11 |         "CreditCard.Invalid.Log"            : "Invalid credit card input: context={context}, input={input}",
12 |         "Date.Required.Usr"                 : "{context}: Input date required in {format} format",
13 |         "Date.Required.Log"                 : "Date required: context={context}, input={input}, format={format}",
14 |         "Date.Invalid.Usr"                  : "{context}: Invalid date, please use {format} format",
15 |         "Date.Invalid.Log"                  : "Invalid date: context={context}, input={input}, format={format}",
16 |         "Integer.Required.Usr"              : "{context}: Input number required",
17 |         "Integer.Required.Log"              : "Input number required: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
18 |         "Integer.NaN.Usr"                   : "{context}: Invalid number",
19 |         "Integer.NaN.Log"                   : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
20 |         "Integer.MinValue.Usr"              : "{context}: Invalid number - Must be greater than {minValue}",
21 |         "Integer.MinValue.Log"              : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
22 |         "Integer.MaxValue.Usr"              : "{context}: Invalid number - Must be less than {maxValue}",
23 |         "Integer.MaxValue.Log"              : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
24 |         "Number.Required.Usr"               : "{context}: Input number required",
25 |         "Number.Required.Log"               : "Input number required: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
26 |         "Number.NaN.Usr"                    : "{context}: Invalid number",
27 |         "Number.NaN.Log"                    : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
28 |         "Number.MinValue.Usr"               : "{context}: Invalid number - Must be greater than {minValue}",
29 |         "Number.MinValue.Log"               : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
30 |         "Number.MaxValue.Usr"               : "{context}: Invalid number - Must be less than {maxValue}",
31 |         "Number.MaxValue.Log"               : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
32 |         "String.Required.Usr"               : "{context}: Input required",
33 |         "String.Required.Log"               : "Input required: context={context}, input={input}, original={orig}",
34 |         "String.Whitelist.Usr"              : "{context}: Invalid input - Conform to regex {pattern}",
35 |         "String.Whitelist.Log"              : "Invalid input - Whitelist validation failed: context={context}, input={input}, original={orig}, pattern={pattern}",
36 |         "String.Blacklist.Usr"              : "{context}: Invalid input - Dangerous input matching {pattern} detected",
37 |         "String.Blacklist.Log"              : "Invalid input - Blacklist validation failed: context={context}, input={input}, original={orig}, pattern={pattern}",
38 |         "String.MinLength.Usr"              : "{context}: Invalid input - Minimum length is {minLength}",
39 |         "String.MinLength.Log"              : "Invalid input - Too short: context={context}, input={input}, original={orig}, minLength={minLength}",
40 |         "String.MaxLength.Usr"              : "{context}: Invalid input - Maximum length is {maxLength}",
41 |         "String.MaxLength.Log"              : "Invalid input - Too long: context={context}, input={input}, original={orig}, maxLength={maxLength}",
42 | 
43 |         // Error Messages for Exceptions
44 |         "HTTPUtilities.Cookie.Protocol"     : "Cookies disallowed on non http[s] requests. Current protocol: {protocol}",
45 |         "HTTPUtilities.Cookie.UnsafeData"   : "Attempt to add unsafe data to cookie (skip mode) - Cookie: {name}={value}",
46 |         "HTTPUtilities.Cookie.CantKill"     : "Unable to kill cookie named {name}",
47 |         "Cookie.Name"                       : "Cookie name \"{name}\" is a reserved token",
48 |         "Cookie.Version"                    : "Cookie version \"{version}\" is not a valid version. Version must be 0 or 1."
49 |     }
50 | };


--------------------------------------------------------------------------------
/lib/utils.js:
--------------------------------------------------------------------------------
 1 | 'use strict';
 2 | 
 3 | function contains(arr, val) {
 4 |     return arr.some(function (elem) {
 5 |         if(( val.equals && val.equals(e) ) || elem === val) {
 6 |             return true;
 7 |         }
 8 |     });
 9 | }
10 | 
11 | module.exports.contains = contains;
12 | 
13 | function containsKey(arr, key) {
14 |     if(typeof key === 'string') {
15 |         var comp = key.toLowerCase();
16 |         return arr.some(function (elem, index) {
17 |             if(comp === index || (typeof index === 'string' && comp === index.toLowerCase())) {
18 |                 return true;
19 |             }
20 |         });
21 |     }
22 |     return false;
23 | }
24 | 
25 | module.exports.containsKey = containsKey;
26 | 
27 | function middleware(req, res, next) {
28 |     switch(req.url) {
29 |         case '/esapi/esapi.js':
30 |             res.sendfile(__dirname + '/public/esapi.js');
31 |             break;
32 |         case '/esapi/esapi-compressed.js':
33 |             res.sendfile(__dirname + '/public/esapi-compressed.js');
34 |             break;
35 |         case '/esapi/resources/Base.esapi.properties.js':
36 |             res.sendfile(__dirname + '/public/resources/Base.esapi.properties.js');
37 |             break;
38 |         case '/esapi/resources/i18n/ESAPI_Standard_en_US.properties.js':
39 |             res.sendfile(__dirname + '/public/resources/i18n/ESAPI_Standard_en_US.properties.js');
40 |             break;
41 |         default:
42 |             next();
43 |             break;
44 |     }
45 | }
46 | 
47 | module.exports.middleware = middleware;


--------------------------------------------------------------------------------
/package.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "author": "Karl Düüna <karl.dyyna@gmail.com>",
 3 |     "name": "node-esapi",
 4 |     "description": "OWASP ESAPI4JS encoders port to node module",
 5 |     "keywords": [
 6 |         "html",
 7 |         "xss",
 8 |         "encoding"
 9 |     ],
10 |     "license": "MIT",
11 |     "version": "0.0.1",
12 |     "repository": {
13 |         "type": "git",
14 |         "url": "git@github.com:DeadAlready/node-esapi"
15 |     },
16 |     "main": "./lib/esapi.js",
17 |     "test": "mocha",
18 |     "devDependencies": {
19 |         "mocha": "1.13.0"
20 |     }
21 | }
22 | 


--------------------------------------------------------------------------------
/test/test.js:
--------------------------------------------------------------------------------
 1 | var assert = require('assert');
 2 | var ESAPI = require('../lib/esapi');
 3 | 
 4 | describe('ESAPI', function(){
 5 |     it('should encodeForHTML',function(){
 6 |         assert.equal(ESAPI.encoder().encodeForHTML('< > " \' / &'), '&lt; &gt; &quot; &#x27; &#x2f; &amp;');
 7 |     });
 8 |     it('should encodeForHTMLAttribute',function(){
 9 |         assert.equal(ESAPI.encoder().encodeForHTMLAttribute(' % * + , - / ; < = > ^ and |'), ' &#x25; &#x2a; &#x2b; , - &#x2f; &#x3b; &lt; &#x3d; &gt; &#x5e; and &#x7c;');
10 |     });
11 |     it('should encodeForJavaScript',function(){
12 |         assert.equal(ESAPI.encoder().encodeForJavaScript('[space] % * + , - / ; < = > ^ and |. Also, a </script>'), '\\x5Bspace\\x5D\\x20\\x25\\x20\\x2A\\x20\\x2B\\x20,\\x20\\x2D\\x20\\x2F\\x20\\x3B\\x20\\x3C\\x20\\x3D\\x20\\x3E\\x20\\x5E\\x20and\\x20\\x7C.\\x20Also,\\x20a\\x20\\x3C\\x2Fscript\\x3E');
13 |     });
14 |     it('should encodeForCSS',function(){
15 |         assert.equal(ESAPI.encoder().encodeForCSS('[space] % * + , - / ; < = > ^ and |. Also, the </style>'), '\\5b space\\5d \\20 \\25 \\20 \\2a \\20 \\2b \\20 \\2c \\20 \\2d \\20 \\2f \\20 \\3b \\20 \\3c \\20 \\3d \\20 \\3e \\20 \\5e \\20 and\\20 \\7c \\2e \\20 Also\\2c \\20 the\\20 \\3c \\2f style\\3e ');
16 |     });
17 |     it('should encodeForURL',function(){
18 |         assert.equal(ESAPI.encoder().encodeForURL('[space] % * + , - / ; < = > ^ and |. Also, the </style>'), '%5Bspace%5D%20%25%20*%20+%20%2C%20-%20/%20%3B%20%3C%20%3D%20%3E%20%5E%20and%20%7C.%20Also%2C%20the%20%3C/style%3E');
19 |     });
20 |     it('should encodeForBase64',function(){
21 |         assert.equal(ESAPI.encoder().encodeForBase64('[space] % * + , - / ; < = > ^ and |. Also, a </script>'), 'W3NwYWNlXSAlICogKyAsIC0gLyA7IDwgPSA+IF4gYW5kIHwuIEFsc28sIGEgPC9zY3JpcHQ+');
22 |     });
23 | });


--------------------------------------------------------------------------------