MAT-10127: add xss Validator (#358)

* MAT-10127: add xss Validator

* MAT-10127: update version

* MAT-10127: update version

Author: chubert-sb

pom.xml

@@ -6,7 +6,7 @@
 
   <groupId>gov.cms.madie</groupId>
   <artifactId>madie-java-models</artifactId>
-  <version>0.10.0-SNAPSHOT</version>
+  <version>0.10.1-SNAPSHOT</version>
   <name>madie-java-models</name>
   <description>Java based models for MADiE microservices</description>
   <properties>
@@ -91,6 +91,11 @@
       <artifactId>commons-lang3</artifactId>
       <version>3.18.0</version>
     </dependency>
+    <dependency>
+      <groupId>org.jsoup</groupId>
+      <artifactId>jsoup</artifactId>
+      <version>1.15.3</version>
+    </dependency>
   </dependencies>
 
   <build>

src/main/java/gov/cms/madie/models/measure/Measure.java

@@ -77,6 +77,7 @@ public class Measure implements Serializable, Cloneable {
   private String revisionNumber;
   private String state;
 
+  @XssFilter
   @Indexed
   @NotBlank(
       groups = {ValidationOrder1.class},
@@ -98,6 +99,7 @@ public class Measure implements Serializable, Cloneable {
       message = "eCQM Abbreviated Title cannot be more than 32 characters.")
   private String ecqmTitle;
 
+  @XssFilter
   @NotBlank(
       groups = {ValidationOrder1.class},
       message = "Measure Name is required.")

src/main/java/gov/cms/madie/models/validators/XssFilter.java

@@ -0,0 +1,18 @@
+package gov.cms.madie.models.validators;
+
+import jakarta.validation.Constraint;
+import jakarta.validation.Payload;
+
+import java.lang.annotation.*;
+
+@Target({ElementType.FIELD})
+@Retention(RetentionPolicy.RUNTIME)
+@Constraint(validatedBy = XssValidator.class)
+@Documented
+public @interface XssFilter {
+  String message() default "Content contains invalid characters.";
+
+  Class<?>[] groups() default {};
+
+  Class<? extends Payload>[] payload() default {};
+}

src/main/java/gov/cms/madie/models/validators/XssValidator.java

@@ -0,0 +1,30 @@
+package gov.cms.madie.models.validators;
+
+import jakarta.validation.ConstraintValidator;
+import jakarta.validation.ConstraintValidatorContext;
+import org.jsoup.Jsoup;
+import org.jsoup.safety.Safelist;
+
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.util.regex.Pattern;
+
+public class XssValidator implements ConstraintValidator<XssFilter, String> {
+
+  private static final Pattern EXPRESSION_PATTERN = Pattern.compile(".*[\\{\\}\\$\\#\\[\\]\\*].*");
+
+  @Override
+  public boolean isValid(String field, ConstraintValidatorContext context) {
+    if (field != null) {
+
+      String decoded = URLDecoder.decode(field, StandardCharsets.UTF_8);
+
+      if (EXPRESSION_PATTERN.matcher(decoded).matches()) {
+        return false;
+      }
+
+      return Jsoup.isValid(decoded, Safelist.none());
+    }
+    return true;
+  }
+}

src/test/java/gov/cms/madie/models/validators/XssValidatorTest.java

@@ -0,0 +1,78 @@
+package gov.cms.madie.models.validators;
+
+import jakarta.validation.ConstraintValidatorContext;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@ExtendWith(MockitoExtension.class)
+class XssValidatorTest {
+
+    private XssValidator xssValidator;
+
+    @Mock
+    private ConstraintValidatorContext context;
+
+    @BeforeEach
+    void setUp() {
+        xssValidator = new XssValidator();
+    }
+
+    @Test
+    void testIsValidReturnsTrueForNullInput() {
+        assertTrue(xssValidator.isValid(null, context));
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "",
+            "   ",
+            "Just a regular string with no tags",
+            "Medicare Advantage Plan 2026",
+            "This is safe alphanumeric input 123"
+    })
+    void testIsValidReturnsTrueForSafeStrings(String safeInput) {
+        assertTrue(xssValidator.isValid(safeInput, context));
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "{base}*1 ",
+            "${spring.expression}",
+            "#{systemProperties}",
+            "some[array]element",
+            "multiplication*sign"
+    })
+    void testIsValidReturnsFalseForBackendExpressions(String expressionInput) {
+        assertFalse(xssValidator.isValid(expressionInput, context));
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "<script>alert(1)</script>",
+            "<html><body>malicious</body></html>",
+            "<div>plain div tag</div>",
+            "<b>bold text</b>",
+            "<img src=x onerror=alert(1)>"
+    })
+    void testIsValidReturnsFalseForFrontendXssAndHtmlTags(String htmlInput) {
+        assertFalse(xssValidator.isValid(htmlInput, context));
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "%3cbody%20onresize%3d%22print()%22%3e", // URL encoded <body onresize="print()">
+            "%3cscript%3ealert(1)%3c/script%3e",    // URL encoded <script>alert(1)</script>
+            "hello%20world%2a"                      // URL encoded '*' character at the end
+    })
+    void testIsValidReturnsFalseForUrlEncodedPayloads(String encodedInput) {
+        assertFalse(xssValidator.isValid(encodedInput, context));
+    }
+}