Patched src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java

Author: patched.codes[bot]

src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java

@@ -19,18 +19,22 @@
 package com.ibm.security.appscan.altoromutual.servlet;
 
 import java.io.IOException;
+import java.util.Set;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.apache.commons.text.StringEscapeUtils;
+
 /**
  * Servlet implementation class SurveyServlet
  * @author Alexei
  */
 public class SurveyServlet extends HttpServlet {
 	private static final long serialVersionUID = 1L;
+	private static final Set<String> VALID_STEPS = Set.of("a", "b", "c");
 
     /**
      * @see HttpServlet#HttpServlet()
@@ -43,13 +47,19 @@ public SurveyServlet() {
 	 * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
 	 */
 	protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
-		String step = (request.getParameter("step"));
+		// Add security headers
+		response.setHeader("Content-Security-Policy", "default-src 'self'");
+		response.setHeader("X-XSS-Protection", "1; mode=block");
+		response.setHeader("X-Content-Type-Options", "nosniff");
+		
+		// Input validation
+		String step = request.getParameter("step");
+		if (step == null || !VALID_STEPS.contains(step)) {
+			step = "";
+		}
 
 		String content = null;
 		String previousStep = null;
-
-		if (step == null)
-			step = "";
 
 		if (step.equals("a")){
 			content = "<h1>Question 1</h1>"+
@@ -63,7 +73,20 @@ else if (step.equals("b")){
 		}
 		else if (step.equals("c")){
 			content = "<h1>Question 3</h1>"+
-			"<div width=\"99%\"><p>Are you ... <ul><li><a href=\"survey_questions.jsp?step=d\">Male</a></li><li><a href=\"survey_questions.jsp?step=d\">Female</a></li></ul></p>";
+			"<div width=\"99%\"><p>Are you ... <ul><li><a href=\"survey_questions.jsp?step=d\">A current customer</a></li>  <li><a href=\"survey_questions.jsp?step=d\">A former customer</a></li>  <li><a href=\"survey_questions.jsp?step=d\">Never been a customer</a></li></ul></p></div>";
+			previousStep="b";
+		}
+
+		// Set content type and encoding
+		response.setContentType("text/html");
+		response.setCharacterEncoding("UTF-8");
+		
+		// HTML encode all dynamic content before writing to response
+		if (content != null) {
+			content = StringEscapeUtils.escapeHtml4(content);
+		}
+		
+		response.getWriter().write(content != null ? content : "Invalid step");ions.jsp?step=d\">Male</a></li><li><a href=\"survey_questions.jsp?step=d\">Female</a></li></ul></p>";
 			previousStep="b";
 		}
 		else if (step.equals("d")){