Fix ValidationErrorMessageBodyWriter

Signed-off-by: Maxim Nesen <[email protected]>
eclipse-ee4j · May 28, 2019 · 0ace9e3 · 0ace9e3
1 parent a41590e
commit 0ace9e3
Showing 1 changed file with 24 additions and 18 deletions.
diff --git a/...ava/org/glassfish/jersey/server/validation/internal/ValidationErrorMessageBodyWriter.java b/...ava/org/glassfish/jersey/server/validation/internal/ValidationErrorMessageBodyWriter.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2018 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2019 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -23,6 +23,8 @@
 import java.lang.reflect.Type;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.function.Function;
+import java.util.function.Predicate;
 
 import javax.ws.rs.WebApplicationException;
 import javax.ws.rs.core.MediaType;
@@ -40,28 +42,29 @@
  */
 final class ValidationErrorMessageBodyWriter implements MessageBodyWriter<Object> {
 
+
+    private static final Function<String, String> ESCAPE_HTML =
+            origin -> origin == null ? ""
+                    : origin.replaceAll("&", "&amp;")
+                    .replaceAll("\"", "&quot;")
+                    .replaceAll("<", "&lt;")
+                    .replaceAll(">", "&gt;");
+
+    private static final Predicate<MediaType> SUPPORTED_MEDIA_TYPE =
+            mediaType -> MediaType.TEXT_HTML_TYPE.equals(mediaType) || MediaType.TEXT_PLAIN_TYPE.equals(mediaType);
+
     @Override
     public boolean isWriteable(final Class<?> type,
                                final Type genericType,
                                final Annotation[] annotations,
                                final MediaType mediaType) {
-        return isSupportedMediaType(mediaType) && isSupportedType(type, genericType);
-    }
-
-    private boolean isSupportedType(final Class<?> type, final Type genericType) {
-        if (ValidationError.class.isAssignableFrom(type)) {
-            return true;
-        } else if (Collection.class.isAssignableFrom(type)) {
-            if (genericType instanceof ParameterizedType) {
-                return ValidationError.class
-                        .isAssignableFrom((Class) ((ParameterizedType) genericType).getActualTypeArguments()[0]);
-            }
-        }
-        return false;
+        return SUPPORTED_MEDIA_TYPE.test(mediaType) && isSupportedType(type, genericType);
     }
 
-    private boolean isSupportedMediaType(final MediaType mediaType) {
-        return MediaType.TEXT_HTML_TYPE.equals(mediaType) || MediaType.TEXT_PLAIN_TYPE.equals(mediaType);
+    private static boolean isSupportedType(final Class<?> type, final Type genericType) {
+        return ((ValidationError.class.isAssignableFrom(type))
+                || (Collection.class.isAssignableFrom(type) && genericType instanceof ParameterizedType)
+                || false);
     }
 
     @Override
@@ -118,7 +121,9 @@ public void writeTo(final Object entity,
 
             // Invalid value.
             builder.append(isPlain ? "invalidValue = " : ("<span class=\"invalid-value\"><strong>invalidValue</strong> = "));
-            builder.append(isPlain ? error.getInvalidValue() : (error.getInvalidValue() + "</span>"));
+            builder.append(isPlain ? error.getInvalidValue()
+                            : ESCAPE_HTML.apply(error.getInvalidValue()).concat("</span>")
+            );
 
             builder.append(')');
 
@@ -137,4 +142,5 @@ public void writeTo(final Object entity,
         entityStream.write(builder.toString().getBytes(MessageUtils.getCharset(mediaType)));
         entityStream.flush();
     }
-}
+
+}