package com.trendmicro.grid.acl.l0;
   
   import com.trendmicro.grid.acl.RestService;
   
   /**
    * Groups all Level0 REST services to automate their publishing under the spring bean "level0_JaxRsApplication".
    *
    * @author juergen_kellerer, 2010-05-31
    * @version 1.0
   */
  public interface Level0RestService extends RestService {
  	/**
  	 * Is a collection of utilities for rest related services.
  	 */
  	public final class RestUtil {
  		/**
  		 * Defines a list of HTML tags that may indicate cross site scripting attacks.
  		 */
  		public static final String[] CROSS_SITE_SCRIPTING_TAGS = System.getProperty(
  				"gacl.crosssite.scripting.taglist",
  				"<html|<object|<embed|<video|<source|<article|<svg|<script|<frame|<iframe").split("\\|");
  
  		private RestUtil() {
  		}
  
  		/**
  		 * Validates whether the given input may be vulnerable to cross site scripting when
  		 * it is interpreted by the browsers HTML engine.
  		 *
  		 * @param input The (un-encoded) input value to check.
  		 */
  		public static void assertIsNotCrossSiteScriptingVulnerable(String input) {
  			if (input != null) {
  				input = input.toLowerCase();
  				for (String tag : CROSS_SITE_SCRIPTING_TAGS) {
  					if (input.contains(tag)) {
  						throw new IllegalArgumentException("The value '" + tag.substring(1) +
  								"' is not allowed in the given request.");
  					}
  				}
  			}
  		}
  	}
  }