src/main/java/org/apereo/cas/security/RequestParameterPolicyEnforcementFilter.java
static void enforceParameterContentCharacterRestrictions(
            final Set<String> parametersToCheck, final Set<Character> charactersToForbid, final Map parameterMap) {

        if (charactersToForbid.isEmpty()) {
            // short circuit
            return;
        }

        for (final String parameterToCheck : parametersToCheck) {

            final String[] parameterValues = (String[]) parameterMap.get(parameterToCheck);

            if (null != parameterValues) {

                for (final String parameterValue : parameterValues) {

                    for (final Character forbiddenCharacter : charactersToForbid) {

                        final StringBuilder characterAsStringBuilder = new StringBuilder();
                        characterAsStringBuilder.append(forbiddenCharacter);

                        if (parameterValue.contains(characterAsStringBuilder)) {
                            FilterUtils.logException(LOGGER, new IllegalArgumentException("Disallowed character [" + forbiddenCharacter
                                    + "] found in value [" + parameterValue + "] of parameter named ["
                                    + parameterToCheck + "]"));
                        }

                        // that forbiddenCharacter was not in this parameterValue
                    }

                    // none of the charactersToForbid were in this parameterValue
                }

                // none of the values of this parameterToCheck had a forbidden character
            } // or this parameterToCheck had null value

        }

        // none of the values of any of the parametersToCheck had a forbidden character
        // hurray! allow flow to continue without throwing an Exception.
    }
static void enforceParameterContentCharacterRestrictions(
            final Set<String> parametersToCheck, final Set<Character> charactersToForbid, final Map parameterMap) {

        if (charactersToForbid.isEmpty()) {
            // short circuit
            return;
        }

        for (final String parameterToCheck : parametersToCheck) {

            final String[] parameterValues = (String[]) parameterMap.get(parameterToCheck);

            if (null != parameterValues) {

                for (final String parameterValue : parameterValues) {

                    for (final Character forbiddenCharacter : charactersToForbid) {

                        final StringBuilder characterAsStringBuilder = new StringBuilder();
                        characterAsStringBuilder.append(forbiddenCharacter);

                        if (parameterValue.contains(characterAsStringBuilder)) {
                            FilterUtils.logException(LOGGER, new IllegalArgumentException("Disallowed character [" + forbiddenCharacter
                                    + "] found in value [" + parameterValue + "] of parameter named ["
                                    + parameterToCheck + "]"));
                        }

                        // that forbiddenCharacter was not in this parameterValue
                    }

                    // none of the charactersToForbid were in this parameterValue
                }

                // none of the values of this parameterToCheck had a forbidden character
            } // or this parameterToCheck had null value

        }

        // none of the values of any of the parametersToCheck had a forbidden character
        // hurray! allow flow to continue without throwing an Exception.
    }
static void enforceParameterContentCharacterRestrictions ( final Set < String > parametersToCheck , final Set < Character > charactersToForbid , final Map parameterMap ) { if ( charactersToForbid . isEmpty ( ) ) { // short circuit return ; } for ( final String parameterToCheck : parametersToCheck ) { final String [ ] parameterValues = ( String [ ] ) parameterMap . get ( parameterToCheck ) ; if ( null != parameterValues ) { for ( final String parameterValue : parameterValues ) { for ( final Character forbiddenCharacter : charactersToForbid ) { final StringBuilder characterAsStringBuilder = new StringBuilder ( ) ; characterAsStringBuilder . append ( forbiddenCharacter ) ; if ( parameterValue . contains ( characterAsStringBuilder ) ) { FilterUtils . logException ( LOGGER , new IllegalArgumentException ( "Disallowed character [" + forbiddenCharacter + "] found in value [" + parameterValue + "] of parameter named [" + parameterToCheck + "]" ) ) ; } // that forbiddenCharacter was not in this parameterValue } // none of the charactersToForbid were in this parameterValue } // none of the values of this parameterToCheck had a forbidden character } // or this parameterToCheck had null value } // none of the values of any of the parametersToCheck had a forbidden character // hurray! allow flow to continue without throwing an Exception. }
For each parameter to check, for each value of that parameter, check that the value does not contain
forbidden characters.
<p>
This is a stateless static method.
<p>
This method is an implementation detail and is not exposed API.
This method is only non-private to allow JUnit testing.

@param parametersToCheck  Set of String request parameter names to look for
@param charactersToForbid Set of Character characters to forbid
@param parameterMap       String --> String[] Map, in practice as read from ServletRequest
For each parameter to check for each value of that parameter check that the value does not contain forbidden characters . <p > This is a stateless static method . <p > This method is an implementation detail and is not exposed API . This method is only non - private to allow JUnit testing .