<commit_before><?xml version="1.0" encoding="UTF-8"?>
<!--
*** Stinger SVDL v. 2 ***

The following is the default svdl file for Stinger.
When creating your own SVDL file, please remember the
following rules/guidelines:

Defaults:
1. Stinger assumes there will always exist a default rule set
2. Requested URI's without a rule set will use the default rule set
3. Parameters without an associated rule will use the default rule

Cookies:
1. You must specify a created page for a cookie rule
2. If a cookie is missing on the created page, then no vioaltion
3. If a cookie is malformed on the created page, then violation
4. You must specify at least one enforced uri per cookie rule
5. You can specify more than one enforced uri per cookie rule

Rule Sets:
1. There must exist at least one path per rule set.
2. There can exist multiple paths for a single rule set.

Actions:
1. Order actions carefully and appropriately. Ex. You cannot drop
   a packet and then display a message.
2. Several actions accept parameters. Refer to {FIXME: URL HERE}
   for more information on the actions.

References:

Please check the FAQ and the Stinger manual for resolving any issues.
If the provided documentation is insufficient, you can contact
the Stinger project lead at <EMAIL>

-->
<stinger>

	<!-- The exclude-set parameters tell Stinger to ignore pages matching these patterns
		 This is useful if you have a broad ruleset pattern (ex. /Stinger/.*) and you dont
		 want to validate specific resources (ex. /Stinger/index.html)
	 -->
	<exclude-set>
		<exclude>.*.html</exclude>
		<exclude>.*.gif</exclude>
		<exclude>/catissuecore/LoadDynamicExtentionsDataEntryPage.do</exclude>
		<exclude>/catissuecore/LoadAnnotationDataEntryPage.do</exclude>
		<exclude>/catissuecore/BulkOperation.do</exclude>
		<exclude>/catissuecore/BulkHandler.do</exclude>
		<exclude>/catissuecore/FileUpload.do</exclude>
		<exclude>/catissuecore/SpecimenArray.do*</exclude>
		<exclude>/catissuecore/SpecimenArrayAppletAction.do*</exclude>
		<exclude>/catissuecore/SpecimenArrayAdd.do*</exclude>
		<exclude>/catissuecore/SpecimenArrayEdit.do*</exclude>
		<exclude>/catissuecore/BaseAppletAction*</exclude>
		<exclude>/catissuecore/SpecimenArray.do/..//SpecimenArrayAppletAction.do</exclude>
		<exclude>/catissuecore/SpecimenArray.do/..//SpecimenArrayAppletAction.do*</exclude>
		<exclude>/catissuecore/SpecimenArrayAdd.do/..//SpecimenArrayAppletAction.do</exclude>
		<exclude>/catissuecore/SpecimenArrayEdit.do/..//SpecimenArrayAppletAction.do</exclude>
		<exclude>/catissuecore/CreateCategoryAction.do*</exclude>
		<exclude>/catissuecore/ImportPVAction.do*</exclude>
		<exclude>/catissuecore/ConsentVerification.do</exclude>
		<exclude>.*.jss</exclude>
		<exclude>.*.css</exclude>
	</exclude-set>
	<regexset>
		<regex>
			<name>JSESSIONID</name>
			<pattern>^[A-F0-9]{32}$</pattern>
			<description>
				JSESSIONID character and length enforcement
			</description>
		</regex>
		<regex>
			<name>url</name>
			<pattern>
				^((((https?|ftps?|gopher|telnet|nntp)://)|(mailto:|news:))(%[0-9A-Fa-f]{2}|[-()_.!~*';/?:@&amp;=+$,A-Za-z0-9])+)([).!';/?:,][[:blank:]])?$
			</pattern>
			<description/>
		</regex>
		<regex>
			<name>email</name>
			<pattern>
				^[\w-]+(?:\.[\w-]+)*@(?:[\w-]+\.)+[a-zA-Z]{2,7}$
			</pattern>
			<description/>
		</regex>
		<regex>
			<name>safetext</name>
			<pattern>^[a-zA-Z0-9\s,.~+\-\[\]!@#\$%\^&amp;\*\(\)_./?'\";:{}=]*$</pattern>
			<description>
				Copied from Common Package REGEX_XSS_VULNERABLE_KEYWORDS
			</description>
		</regex>

		<!--  Added for saving param query-->
		<regex>
			<name>querysafetext</name>
			<pattern>^[a-zA-Z0-9\s.\-\^&amp;\*\(\)_./?'\";]*$</pattern>
			<description>
				Copied from Common Package REGEX_XSS_VULNERABLE_KEYWORDS
			</description>
		</regex>


		<regex>
			<name>digitwords</name>
			<pattern>
				^(zero|one|two|three|four|five|six|seven|eight|nine)$
			</pattern>
			<description>
				The English words representing the digits 0 to 9
			</description>
		</regex>
		<regex>
			<name>zip</name>
			<pattern>^\\d{5}(-\\d{4})?$</pattern>
			<description>
				US zip code with optional dash-four
			</description>
		</regex>
		<regex>
			<name>phone</name>
			<pattern>^\D?(\d{3})\D?\D?(\d{3})\D?(\d{4})$</pattern>
			<description>
				US phone number with or without dashes
			</description>
		</regex>
		<regex>
			<name>state</name>
			<pattern>
				^(AL|AK|AS|AZ|AR|CA|CO|CT|DE|DC|FM|FL|GA|GU|HI|ID|IL|IN|IA|KS|KY|LA|ME|MH|MD|MA|MI|MN|MS|MO|MT|NE|NV|NH|NJ|NM|NY|NC|ND|MP|OH|OK|OR|PW|PA|PR|RI|SC|SD|TN|TX|UT|VT|VI|VA|WA|WV|WI|WY)$
			</pattern>
			<description>Two letter state abbreviations</description>
		</regex>
		<regex>
			<name>date</name>
			<pattern>
				^(?:(?:(?:0?[13578]|1[02])(\/|-|\.)31)\1|(?:(?:0?[1,3-9]|1[0-2])(\/|-|\.)(?:29|30)\2))(?:(?:1[6-9]|[2-9]\d)?\d{2})$|^(?:0?2(\/|-|\.)29\3(?:(?:(?:1[6-9]|[2-9]\d)?(?:0[48]|[2468][048]|[13579][26])|(?:(?:16|[2468][048]|[3579][26])00))))$|^(?:(?:0?[1-9])|(?:1[0-2]))(\/|-|\.)(?:0?[1-9]|1\d|2[0-8])\4(?:(?:1[6-9]|[2-9]\d)?\d{2})$
			</pattern>
			<description>
				Date in US format with support for leap years
			</description>
		</regex>
		<regex>
			<name>creditcard</name>
			<pattern>
				^((4\d{3})|(5[1-5]\d{2})|(6011))-?\d{4}-?\d{4}-?\d{4}|3[4,7]\d{13}$
			</pattern>
			<description/>
		</regex>
		<regex>
			<name>password</name>
			<pattern>^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{4,8}$</pattern>
			<description>
				4 to 8 character password requiring numbers, lowercase
				letters, and uppercase letters
			</description>
		</regex>
		<regex>
			<name>ssn</name>
			<pattern>^\d{3}-\d{2}-\d{4}$</pattern>
			<description>
				9 digit social security number with dashes
			</description>
		</regex>
		<regex>
			<name>monthwords</name>
			<pattern>
				^(Jan|Feb|Mar|Apr|May|Jun|Jul|Apr|Sep|Oct|Nov|Dec)$
			</pattern>
			<description>
				3 character abbreviations for the months
			</description>
		</regex>
	</regexset>

	<!-- **** COOKIES **** -->
	<cookie>
		<name>JSESSIONID</name>
		<regex>JSESSIONID</regex>
		<!-- FIXME: Must change the created and enforce values accordingly -->
		<created>/MyURI.*</created>
		<enforce>/MYURI.*</enforce>
		<missing>
			<severity>FATAL</severity>
			<action class="org.owasp.stinger.actions.Log">
				<parameter>
					<name>log</name>
					<value>stinger.log</value>
				</parameter>
				<parameter>
					<name>level</name>
					<value>SEVERE</value>
				</parameter>
				<parameter>
					<name>message</name>
					<value>
						The required JSESSIONID cookie is missing
					</value>
				</parameter>
			</action>
			<action class="org.owasp.stinger.actions.Invalidate"/>
			<action class="org.owasp.stinger.actions.Redirect">
				<parameter>
					<name>page</name>
					<value>error.html</value>
				</parameter>
			</action>
		</missing>
		<malformed>
			<severity>FATAL</severity>
			<action class="org.owasp.stinger.actions.Log">
				<parameter>
					<name>log</name>
					<value>stinger.log</value>
				</parameter>
				<parameter>
					<name>level</name>
					<value>SEVERE</value>
				</parameter>
				<parameter>
					<name>message</name>
					<value>The JSESSIONID cookie is malformed</value>
				</parameter>
			</action>
			<action class="org.owasp.stinger.actions.Invalidate"/>
			<action class="org.owasp.stinger.actions.Redirect">
				<parameter>
					<name>page</name>
					<value>error.html</value>
				</parameter>
			</action>
		</malformed>
	</cookie>


	<!-- **** PARAMETERS **** -->

	<!-- The default parameter rule set must exist -->
	<ruleset>
		<name>STINGER_DEFAULT</name>
		<!-- The path MUST be set to STINGER_DEFAULT -->
		<path>STINGER_DEFAULT</path>

		<rule>
			<name>STINGER_ALL</name>
			<regex>safetext</regex>

			<missing>
				<severity>ignore</severity>
			</missing>
			<malformed>
				<severity>continue</severity>
				<action class="org.owasp.stinger.actions.Log">
					<parameter>
						<name>log</name>
						<value>stinger.log</value>
					</parameter>
					<parameter>
						<name>level</name>
						<value>info</value>
					</parameter>
					<parameter>
						<name>message</name>
						<value>
							parameter %name with value %encoded_value from %ip has been encoded
						</value>
					</parameter>
				</action>
				<action class="org.owasp.stinger.actions.HandleXSSViolations"/>
			</malformed>
		</rule>
	</ruleset>
	<!-- Below are the custom rule sets for your application -->
	<!--  ruleset>
		<name>Main</name>
		<path>/cider/*.*</path>

		<rule>
			<name>sftpserver</name>
			<regex>password</regex>
			<exclude>../</exclude>

			<missing>
				<severity>continue</severity>
			</missing>
			<malformed>
				<severity>continue</severity>
				<action class="org.owasp.stinger.actions.Log">
					<parameter>
						<name>log</name>
						<value>stinger.log</value>
					</parameter>
					<parameter>
						<name>level</name>
						<value>info</value>
					</parameter>
					<parameter>
						<name>message</name>
						<value>
							The username parameter from %ip is malformed
						</value>
					</parameter>
				</action>
				<action class="org.owasp.stinger.actions.HandleXSSViolations"/>
			</malformed>
		</rule>
	</ruleset -->
</stinger>
<commit_msg> Bug 15945 -  Unable to craete Specimen Array from Order View page.<commit_after><?xml version="1.0" encoding="UTF-8"?>
<!--
*** Stinger SVDL v. 2 ***

The following is the default svdl file for Stinger.
When creating your own SVDL file, please remember the
following rules/guidelines:

Defaults:
1. Stinger assumes there will always exist a default rule set
2. Requested URI's without a rule set will use the default rule set
3. Parameters without an associated rule will use the default rule

Cookies:
1. You must specify a created page for a cookie rule
2. If a cookie is missing on the created page, then no vioaltion
3. If a cookie is malformed on the created page, then violation
4. You must specify at least one enforced uri per cookie rule
5. You can specify more than one enforced uri per cookie rule

Rule Sets:
1. There must exist at least one path per rule set.
2. There can exist multiple paths for a single rule set.

Actions:
1. Order actions carefully and appropriately. Ex. You cannot drop
   a packet and then display a message.
2. Several actions accept parameters. Refer to {FIXME: URL HERE}
   for more information on the actions.

References:

Please check the FAQ and the Stinger manual for resolving any issues.
If the provided documentation is insufficient, you can contact
the Stinger project lead at <EMAIL>

-->
<stinger>

	<!-- The exclude-set parameters tell Stinger to ignore pages matching these patterns
		 This is useful if you have a broad ruleset pattern (ex. /Stinger/.*) and you dont
		 want to validate specific resources (ex. /Stinger/index.html)
	 -->
	<exclude-set>
		<exclude>.*.html</exclude>
		<exclude>.*.gif</exclude>
		<exclude>/catissuecore/LoadDynamicExtentionsDataEntryPage.do</exclude>
		<exclude>/catissuecore/LoadAnnotationDataEntryPage.do</exclude>
		<exclude>/catissuecore/BulkOperation.do</exclude>
		<exclude>/catissuecore/BulkHandler.do</exclude>
		<exclude>/catissuecore/FileUpload.do</exclude>
		<exclude>/catissuecore/SpecimenArray.do*</exclude>
		<exclude>/catissuecore/SpecimenArrayAppletAction.do*</exclude>
		<exclude>/catissuecore/SpecimenArrayAdd.do*</exclude>
		<exclude>/catissuecore/SpecimenArrayEdit.do*</exclude>
		<exclude>/catissuecore/BaseAppletAction*</exclude>
		<exclude>/catissuecore/SpecimenArray.do/..//SpecimenArrayAppletAction.do</exclude>
		<exclude>/catissuecore/SpecimenArray.do/..//SpecimenArrayAppletAction.do*</exclude>
		<exclude>/catissuecore/SpecimenArrayAdd.do/..//SpecimenArrayAppletAction.do</exclude>
		<exclude>/catissuecore/SpecimenArrayEdit.do/..//SpecimenArrayAppletAction.do</exclude>
		<exclude>/catissuecore/InitCreateDefineArray.do/..//SpecimenArrayAppletAction.do</exclude>
		<exclude>/catissuecore/CreateCategoryAction.do*</exclude>
		<exclude>/catissuecore/ImportPVAction.do*</exclude>
		<exclude>/catissuecore/ConsentVerification.do</exclude>
		<exclude>.*.jss</exclude>
		<exclude>.*.css</exclude>
	</exclude-set>
	<regexset>
		<regex>
			<name>JSESSIONID</name>
			<pattern>^[A-F0-9]{32}$</pattern>
			<description>
				JSESSIONID character and length enforcement
			</description>
		</regex>
		<regex>
			<name>url</name>
			<pattern>
				^((((https?|ftps?|gopher|telnet|nntp)://)|(mailto:|news:))(%[0-9A-Fa-f]{2}|[-()_.!~*';/?:@&amp;=+$,A-Za-z0-9])+)([).!';/?:,][[:blank:]])?$
			</pattern>
			<description/>
		</regex>
		<regex>
			<name>email</name>
			<pattern>
				^[\w-]+(?:\.[\w-]+)*@(?:[\w-]+\.)+[a-zA-Z]{2,7}$
			</pattern>
			<description/>
		</regex>
		<regex>
			<name>safetext</name>
			<pattern>^[a-zA-Z0-9\s,.~+\-\[\]!@#\$%\^&amp;\*\(\)_./?'\";:{}=]*$</pattern>
			<description>
				Copied from Common Package REGEX_XSS_VULNERABLE_KEYWORDS
			</description>
		</regex>

		<!--  Added for saving param query-->
		<regex>
			<name>querysafetext</name>
			<pattern>^[a-zA-Z0-9\s.\-\^&amp;\*\(\)_./?'\";]*$</pattern>
			<description>
				Copied from Common Package REGEX_XSS_VULNERABLE_KEYWORDS
			</description>
		</regex>


		<regex>
			<name>digitwords</name>
			<pattern>
				^(zero|one|two|three|four|five|six|seven|eight|nine)$
			</pattern>
			<description>
				The English words representing the digits 0 to 9
			</description>
		</regex>
		<regex>
			<name>zip</name>
			<pattern>^\\d{5}(-\\d{4})?$</pattern>
			<description>
				US zip code with optional dash-four
			</description>
		</regex>
		<regex>
			<name>phone</name>
			<pattern>^\D?(\d{3})\D?\D?(\d{3})\D?(\d{4})$</pattern>
			<description>
				US phone number with or without dashes
			</description>
		</regex>
		<regex>
			<name>state</name>
			<pattern>
				^(AL|AK|AS|AZ|AR|CA|CO|CT|DE|DC|FM|FL|GA|GU|HI|ID|IL|IN|IA|KS|KY|LA|ME|MH|MD|MA|MI|MN|MS|MO|MT|NE|NV|NH|NJ|NM|NY|NC|ND|MP|OH|OK|OR|PW|PA|PR|RI|SC|SD|TN|TX|UT|VT|VI|VA|WA|WV|WI|WY)$
			</pattern>
			<description>Two letter state abbreviations</description>
		</regex>
		<regex>
			<name>date</name>
			<pattern>
				^(?:(?:(?:0?[13578]|1[02])(\/|-|\.)31)\1|(?:(?:0?[1,3-9]|1[0-2])(\/|-|\.)(?:29|30)\2))(?:(?:1[6-9]|[2-9]\d)?\d{2})$|^(?:0?2(\/|-|\.)29\3(?:(?:(?:1[6-9]|[2-9]\d)?(?:0[48]|[2468][048]|[13579][26])|(?:(?:16|[2468][048]|[3579][26])00))))$|^(?:(?:0?[1-9])|(?:1[0-2]))(\/|-|\.)(?:0?[1-9]|1\d|2[0-8])\4(?:(?:1[6-9]|[2-9]\d)?\d{2})$
			</pattern>
			<description>
				Date in US format with support for leap years
			</description>
		</regex>
		<regex>
			<name>creditcard</name>
			<pattern>
				^((4\d{3})|(5[1-5]\d{2})|(6011))-?\d{4}-?\d{4}-?\d{4}|3[4,7]\d{13}$
			</pattern>
			<description/>
		</regex>
		<regex>
			<name>password</name>
			<pattern>^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{4,8}$</pattern>
			<description>
				4 to 8 character password requiring numbers, lowercase
				letters, and uppercase letters
			</description>
		</regex>
		<regex>
			<name>ssn</name>
			<pattern>^\d{3}-\d{2}-\d{4}$</pattern>
			<description>
				9 digit social security number with dashes
			</description>
		</regex>
		<regex>
			<name>monthwords</name>
			<pattern>
				^(Jan|Feb|Mar|Apr|May|Jun|Jul|Apr|Sep|Oct|Nov|Dec)$
			</pattern>
			<description>
				3 character abbreviations for the months
			</description>
		</regex>
	</regexset>

	<!-- **** COOKIES **** -->
	<cookie>
		<name>JSESSIONID</name>
		<regex>JSESSIONID</regex>
		<!-- FIXME: Must change the created and enforce values accordingly -->
		<created>/MyURI.*</created>
		<enforce>/MYURI.*</enforce>
		<missing>
			<severity>FATAL</severity>
			<action class="org.owasp.stinger.actions.Log">
				<parameter>
					<name>log</name>
					<value>stinger.log</value>
				</parameter>
				<parameter>
					<name>level</name>
					<value>SEVERE</value>
				</parameter>
				<parameter>
					<name>message</name>
					<value>
						The required JSESSIONID cookie is missing
					</value>
				</parameter>
			</action>
			<action class="org.owasp.stinger.actions.Invalidate"/>
			<action class="org.owasp.stinger.actions.Redirect">
				<parameter>
					<name>page</name>
					<value>error.html</value>
				</parameter>
			</action>
		</missing>
		<malformed>
			<severity>FATAL</severity>
			<action class="org.owasp.stinger.actions.Log">
				<parameter>
					<name>log</name>
					<value>stinger.log</value>
				</parameter>
				<parameter>
					<name>level</name>
					<value>SEVERE</value>
				</parameter>
				<parameter>
					<name>message</name>
					<value>The JSESSIONID cookie is malformed</value>
				</parameter>
			</action>
			<action class="org.owasp.stinger.actions.Invalidate"/>
			<action class="org.owasp.stinger.actions.Redirect">
				<parameter>
					<name>page</name>
					<value>error.html</value>
				</parameter>
			</action>
		</malformed>
	</cookie>


	<!-- **** PARAMETERS **** -->

	<!-- The default parameter rule set must exist -->
	<ruleset>
		<name>STINGER_DEFAULT</name>
		<!-- The path MUST be set to STINGER_DEFAULT -->
		<path>STINGER_DEFAULT</path>

		<rule>
			<name>STINGER_ALL</name>
			<regex>safetext</regex>

			<missing>
				<severity>ignore</severity>
			</missing>
			<malformed>
				<severity>continue</severity>
				<action class="org.owasp.stinger.actions.Log">
					<parameter>
						<name>log</name>
						<value>stinger.log</value>
					</parameter>
					<parameter>
						<name>level</name>
						<value>info</value>
					</parameter>
					<parameter>
						<name>message</name>
						<value>
							parameter %name with value %encoded_value from %ip has been encoded
						</value>
					</parameter>
				</action>
				<action class="org.owasp.stinger.actions.HandleXSSViolations"/>
			</malformed>
		</rule>
	</ruleset>
	<!-- Below are the custom rule sets for your application -->
	<!--  ruleset>
		<name>Main</name>
		<path>/cider/*.*</path>

		<rule>
			<name>sftpserver</name>
			<regex>password</regex>
			<exclude>../</exclude>

			<missing>
				<severity>continue</severity>
			</missing>
			<malformed>
				<severity>continue</severity>
				<action class="org.owasp.stinger.actions.Log">
					<parameter>
						<name>log</name>
						<value>stinger.log</value>
					</parameter>
					<parameter>
						<name>level</name>
						<value>info</value>
					</parameter>
					<parameter>
						<name>message</name>
						<value>
							The username parameter from %ip is malformed
						</value>
					</parameter>
				</action>
				<action class="org.owasp.stinger.actions.HandleXSSViolations"/>
			</malformed>
		</rule>
	</ruleset -->
</stinger>

{'fraction_non_alphanumeric': 0.188990440172287, 'fraction_numerical': 0.016966067864271458, 'mean_word_length': 3.1014648858250755, 'pattern_counts': {'":': 0, '<': 661, '<?xml version=': 2, '>': 661, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5857657', 'n_tokens_mistral': 8253, 'n_tokens_neox': 6699, 'n_words': 1274}