Regular expression to match and replace "${foo}" but not "" in Java

Question

While anyone will explore this question, the obvious question arises that, is there any regular expression possible that matches

${foo}

but not

<c:if test="${foo}" />

or

<c:when test="${foo}" />

to replace those stand alone ${foo} with <c:out value="${foo}" />, here foo can be any string as long as ${foo} is a valid el expression in jsp.

Edit:

${foo} can be anywhere as long as its not violating jsp syntax after the replacement! This is just a precaution to prevent XXS attack in jsp's.

How about when `${foo}` is inside a string of some other tag? — nhahtdh, Jun 12 '13 at 17:07
Uhm wait, this seems to be JSP; why do you need to parse your JSPs? — fge, Jun 12 '13 at 17:09
Because, stand alone el expresson like this, is vulnerable to XSS attack. — Sazzadur Rahaman, Jun 12 '13 at 17:12
Interesting... Do you have a link? (btw, you should ask that to the question, among with the link... That makes for an interesting question) — fge, Jun 12 '13 at 17:22
@fge `` basically escapes special characters like <,>,/,\,& etc. typically used in XSS attacks like injecting javascript with — Ravi K Thapliyal, Jun 12 '13 at 17:27
Yes but still: it'd be interesting to have a link, or at least that you add an example of such an exploit in the post — fge, Jun 12 '13 at 17:27

Ro Yo Mi · Accepted Answer · 2013-06-13T04:24:07.243

2

Description

This regex will find the naked ${foo} which is not inside a <c:.... test="${foo}" /> block

Regex: (?!("))\$\{[^}]*\}(?!")

Replace with <c:out value="$0" />

enter image description here

Input text: <c:if test="${foo man chu}" />${foo bar}more text here

Output Text: <c:if test="${foo man chu}" /><c:out value="${foo bar}" />more text here

To handle the additional edge cases where ${foo.bar} might be inside ` tags then you might want to use this regex

Regex: (?!("))(\$\{[^}]*\})(?!")|(<a\b[^>]*\bhref=")(\$\{[^}]*\})(")

Replace with: $3<c:out value="$1$2$4" />$5

enter image description here

Input text: <c:if test="${foo man chu}" />${foo bar}more <a href="${foo.name}" />text here

Output text: <c:if test="${foo man chu}" /><c:out value="${foo bar}" />more <a href="<c:out value="${foo.name}" />" />text here

edited Jun 13 '13 at 04:24

answered Jun 13 '13 at 01:08

Ro Yo Mi

14,790
5
35
43

Yes, you are right, Your regex will find naked `${foo}`, but `` this type of replacable `${foo}` will be ignored. – Sazzadur Rahaman Jun 13 '13 at 03:44
That edge case wasn't included in the original sample text. Please see the updated response which addresses additional edge case. – Ro Yo Mi Jun 13 '13 at 04:24

anubhava · Answer 2 · 2013-06-12T17:32:07.707

1

Following regex should work on your examples:

\${[^}]*}(?![^<>]*>)

Live Demo: http://www.rubular.com/r/ICdR4TGQXu

Though I think this might still give false positive for some rare cases.

edited Jun 12 '13 at 17:32

answered Jun 12 '13 at 17:25

anubhava

761,203
64
569
643

Yes, you are right, your expression fails to detect ``, But still so close! – Sazzadur Rahaman Jun 12 '13 at 17:55
Its been long time since I wrote some JSTL but wouldn't `` be wrapped in some `` also. – anubhava Jun 12 '13 at 18:54
You'd rather want to replace it by `` instead of `" />`. So a different regex (or simply a different replacement) would be needed for that. – BalusC Sep 15 '15 at 15:28

score 0 · Answer 3 · answered Jun 12 '13 at 17:23

I believe you're probably trying to edit your JSPs in a text editor that supports find by regex feature. Trying to parse your JSPs otherwise (like @fge pointed) wouldn't be wise though.

Here's a regex that would match ${foo} but not ="${foo}"

(?<!=")\${foo}(?!")

effectively eliminating a match on <c:if test="${foo}" /> or <c:when test="${foo}" />

score 0 · Answer 4 · answered Jun 12 '13 at 17:27

0

try this

str = str.replaceAll("(?<!<c:(if|when) test=[\"'])\\$\\{foo}", "<c:out value=\"\\${foo}\" />");

answered Jun 12 '13 at 17:27

Evgeniy Dorofeev

133,369
30
199
275

score 0 · Answer 5 · answered Jun 13 '13 at 01:33

In general, regular expressions are not powerful enough to correctly process any non-trivial language, especially one that allows matching parentheses, escaped quotes, and nested quoting.

You may find a regular expression here that seems to work for most cases, but that likely just means that you haven't met a clever enough attacker yet.

You need to be much more restrictive about what you let your users enter. You should not accept JSP code, try to "clean it up", and then execute it. You will get exploited. Even Sun could not accomplish this (see: the recent string of attacks against the Java Applet sandbox).

Regular expression to match and replace "${foo}" but not "" in Java

5 Answers5

Description

Live Demo: http://www.rubular.com/r/ICdR4TGQXu