Coding - Java Web Application

public class XSSFilter implements Filter {
	@Override
	public void init(FilterConfig filterConfig) throws ServletException {
	}

	@Override
	public void destroy() {
	}

	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
		chain.doFilter(new XSSRequestWrapper((HttpServletRequest) request), response);
	}
}

public class XSSRequestWrapper extends HttpServletRequestWrapper {
	private static Pattern[] patterns = new Pattern[] {
			// Script fragments
			Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE),
			// src='...'
			Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
			// lonely script tags
			Pattern.compile("</script>", Pattern.CASE_INSENSITIVE), Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
			// eval(...)
			Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
			// expression(...)
			Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
			// javascript:...
			Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE),
			// vbscript:...
			Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE),
			// onload(...)=...
			Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL) };

	public XSSRequestWrapper(HttpServletRequest servletRequest) {
		super(servletRequest);
	}

	@Override
	public String[] getParameterValues(String parameter) {
		String[] values = super.getParameterValues(parameter);

		if (values == null) {
			return null;
		}

		int count = values.length;
		String[] encodedValues = new String[count];
		for (int i = 0; i < count; i++) {
			encodedValues[i] = stripXSS(values[i]);
		}

		return encodedValues;
	}

	@Override
	public String getParameter(String parameter) {
		String value = super.getParameter(parameter);

		return stripXSS(value);
	}

	@Override
	public String getHeader(String name) {
		String value = super.getHeader(name);
		return stripXSS(value);
	}

	private String stripXSS(String value) {
		if (value != null) {
			// NOTE: It's highly recommended to use the ESAPI library and uncomment the following line to
			// avoid encoded attacks.
			// value = ESAPI.encoder().canonicalize(value);

			// Avoid null characters
			value = value.replaceAll("\0", "");

			// Remove all sections that match a pattern
			for (Pattern scriptPattern : patterns) {
				value = scriptPattern.matcher(value).replaceAll("");
			}
		}
		return value;
	}

	protected void uploadBulkFile(BatchJob job) throws Exception {
		final String CRLF = "\r\n";
		URL url = new URL(job.getUploadUrl());
		HttpURLConnection connection = null;

		FileInputStream reader = null;
		OutputStream output = null;
		PrintWriter writer = null;

		try {
			// Set up the connection and headers
			connection = (HttpURLConnection) url.openConnection(Proxy.NO_PROXY);
			connection.setUseCaches(false);
			connection.setDoOutput(true);
			connection.setDoInput(true);

			// Set up the authentication properties
			AuthorizationData authorizationData = serviceClient.getAuthorizationData();
			PasswordAuthentication passwordAuthentication = (PasswordAuthentication) authorizationData.getAuthentication();
			connection.setRequestProperty("UserName", passwordAuthentication.getUserName());
			connection.setRequestProperty("Password", passwordAuthentication.getPassword());

			// Content-Type must be multipart/form-data with custom boundary
			String boundary = "--------------------" + Long.toString(System.currentTimeMillis(), 16);
			String contentType = "multipart/form-data; boundary=" + boundary;
			connection.setRequestProperty("Content-Type", contentType);

			final int bufferSize = 100 * 1024;
			byte[] buffer = new byte[bufferSize];

			File file = new File(job.getBulkFile());
			reader = new FileInputStream(file);
			output = connection.getOutputStream();
			writer = new PrintWriter(new OutputStreamWriter(output, "UTF-8"), true);

			// Add the file within the specified boundary
			writer.append("--" + boundary).append(CRLF);
			writer.append("Content-Disposition: form-data; name=\"file\"; filename=\"" + file.getName() + "\"").append(CRLF);
			writer.append("Content-Type: application/zip").append(CRLF);
			writer.append("Content-Transfer-Encoding: binary").append(CRLF);
			writer.append(CRLF);
			writer.flush();

			int count = 0;
			while ((count = reader.read(buffer)) != -1) {
				output.write(buffer, 0, count);
			}

			output.flush();

			writer.append(CRLF).flush();
			writer.append("--" + boundary + "--").append(CRLF);
			writer.flush();

			logger.debug("Upload Connection Response: {}", connection.getResponseMessage());
		} finally {
			reader.close();
			writer.flush();
			writer.close();
			output.flush();
			output.close();
		}
	}

public class ApiHttpClient {
	private final CloseableHttpClient httpClient;

	public ApiHttpClient(String configSection) {
		HttpClientBuilder builder = HttpClients.custom();
		Registry<ConnectionSocketFactory> socketFactoryRegistry = null;

		// use client cert if configured so
		if (Config.getBool(configSection, "UseClientCert", false)) {
			ClassLoader classLoader = ApiHttpClient.class.getClassLoader();
			File clientCertFile = new File(classLoader.getResource(Config.getStr(configSection, "ClientCertFile")).getFile());
			try {
				KeyStore keystore = KeyStore.getInstance("PKCS12");
				keystore.load(new FileInputStream(clientCertFile), Config.getStr(configSection, "ClientCertPassword").toCharArray());
				SSLContext sslcontext = SSLContexts.custom().loadKeyMaterial(keystore, Config.getStr(configSection, "ClientCertPassword").toCharArray()).build();
				SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslcontext.getSocketFactory(), new NoopHostnameVerifier());
				socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create().register("https", sslsf).register("http", PlainConnectionSocketFactory.getSocketFactory()).build();

			} catch (KeyStoreException | CertificateException | NoSuchAlgorithmException | IOException | UnrecoverableKeyException | KeyManagementException e) {
				throw new RuntimeException(e);
			}
		}

		// use pooling http client manager
		PoolingHttpClientConnectionManager connectionManager = null;
		if (socketFactoryRegistry == null)
			connectionManager = new PoolingHttpClientConnectionManager();
		else
			connectionManager = new PoolingHttpClientConnectionManager(socketFactoryRegistry);
		connectionManager.setMaxTotal(Config.getInt(configSection, "MaxTotal", 200));
		connectionManager.setDefaultMaxPerRoute(Config.getInt(configSection, "DefaultMaxPerRoute", 20));
		builder.setConnectionManager(connectionManager);

		// set host proxy if needed
		if (Config.getBool(configSection, "UseProxy", false)) {
			HttpHost proxy = new HttpHost(Config.getStr(configSection, "ProxyHost"), Config.getInt(configSection, "ProxyPort"));
			builder.setProxy(proxy);
		}

		/*
		 * // add more request settings RequestConfig config =
		 * RequestConfig.custom()
		 * .setConnectTimeout(Config.getInt(configSection, "ConnectionTimeout",
		 * 20000)) .setSocketTimeout(Config.getInt(configSection,
		 * "SocketTimeout", 30000)).build();
		 *
		 * builder.setDefaultRequestConfig(config);
		 */

		this.httpClient = builder.build();
	}

	public <T> T execute(HttpUriRequest request, ResponseHandler<? extends T> responseHandler) throws ClientProtocolException, IOException {
		return httpClient.execute(request, responseHandler);
	}

	public CloseableHttpResponse execute(HttpUriRequest request, HttpContext context) throws IOException, ClientProtocolException {
		return httpClient.execute(request, context);
	}

	public <T> T execute(HttpUriRequest request, ResponseHandler<? extends T> responseHandler, HttpContext context) throws IOException, ClientProtocolException {
		return httpClient.execute(request, responseHandler, context);
	}

	public CloseableHttpResponse execute(HttpUriRequest request) throws IOException, ClientProtocolException {
		return httpClient.execute(request);
	}
}