// Path: duke-encounters/src/main/java/de/dominikschadow/dukeencounters/Constants.java
// public final class Constants {
//     /**
//      * XSS error code, value is {@value}.
//      */
//     public static final String XSS_ERROR_CODE = "xss.attempt";
//     /**
//      * SQL injection error code, value is {@value}.
//      */
//     public static final String SQLI_ERROR_CODE = "sqli.attempt";
//     /**
//      * Invalid value error code, value is {@value}.
//      */
//     public static final String ATTACK_ERROR_CODE = "invalid.value";
//     /**
//      * Invalid year error code, value is {@value}.
//      */
//     public static final String INVALID_YEAR_ERROR_CODE = "invalid.year";
//     /**
//      * Passwords don't match error code, value is {@value}.
//      */
//     public static final String NOT_MATCHING_PASSWORDS_ERROR_CODE = "password.nomatch";
//     /**
//      * The new password is not safe, value is {@value}.
//      */
//     public static final String UNSAFE_PASSWORD_ERROR_CODE = "password.unsafe";
//     /**
//      * The current password is not correct, value is {@value}.
//      */
//     public static final String CURRENT_PASSWORD_NOT_CORRECT_ERROR_CODE = "password.incorrect";
//     /**
//      * The entered username already exists, value is {@value}.
//      */
//     public static final String USERNAME_ALREADY_EXISTS = "username.exists";
//     /**
//      * Like for SQL queries, value is {@value}.
//      */
//     public static final String LIKE = "%";
//     /**
//      * Year of Java creation, any Duke encounter before this year is impossible, value is {@value}.
//      */
//     public static final int YEAR_OF_JAVA_CREATION = 1995;
// 
//     private Constants() {
//     }
// }
// 
// Path: duke-encounters/src/main/java/de/dominikschadow/dukeencounters/encounter/DukeEncountersUser.java
// @Entity
// @Table(name = "users", uniqueConstraints = @UniqueConstraint(columnNames = {"username"}))
// @Data
// public class DukeEncountersUser {
//     @Id
//     @GeneratedValue
//     private long id;
//     @NotBlank(message = "Your firstname is required")
//     private String firstname;
//     @NotBlank(message = "Your lastname is required")
//     private String lastname;
//     @NotBlank(message = "Your username is required")
//     @Column(nullable = false)
//     private String username;
//     @NotBlank(message = "Your email address is required")
//     @Email
//     @Column(nullable = false)
//     private String email;
//     @Length(min = 10, max = 1024, message = "A password is required and must contain between 10 and 60 characters")
//     @Column(nullable = false, length = 60)
//     private String password;
//     @Transient
//     private String confirmPassword;
//     private Date registrationDate;
//     @Enumerated(EnumType.STRING)
//     private Level level;
//     private boolean enabled;
//     @OneToOne
//     private Authority authority;
// 
//     @Override
//     public String toString() {
//         String name = Strings.nullToEmpty(getFirstname()) + " " + Strings.nullToEmpty(getLastname());
//         name = CharMatcher.WHITESPACE.trimTrailingFrom(name);
// 
//         return name;
//     }
// }
// 
// Path: duke-encounters/src/main/java/de/dominikschadow/dukeencounters/security/SecurityValidationService.java
// @Service
// public class SecurityValidationService {
//     public final boolean hasXssPayload(@NotNull final String payload) {
//         return containsAnyIgnoreCase(payload, "<", "script", "onload", "eval", "document.cookie");
//     }
// 
//     public final boolean hasSqlIPayload(@NotNull final String payload) {
//         return containsAnyIgnoreCase(payload, "drop", "insert", "update", "delete", "union", "select", "exec", "fetch",
//                 "' or '1'='1", "' or 1=1");
//     }
// 
//     private boolean containsAnyIgnoreCase(final String payload, final String... searchStrings) {
//         for (String searchString : searchStrings) {
//             if (StringUtils.containsIgnoreCase(payload, searchString)) {
//                 return true;
//             }
//         }
// 
//         return false;
//     }
// }


import static org.owasp.appsensor.core.DetectionPoint.Category.COMMAND_INJECTION;
import static org.owasp.appsensor.core.DetectionPoint.Category.INPUT_VALIDATION;
import de.dominikschadow.dukeencounters.Constants;
import de.dominikschadow.dukeencounters.encounter.DukeEncountersUser;
import de.dominikschadow.dukeencounters.security.SecurityValidationService;
import lombok.AllArgsConstructor;
import org.owasp.appsensor.core.DetectionPoint;
import org.owasp.appsensor.core.DetectionSystem;
import org.owasp.appsensor.core.Event;
import org.owasp.appsensor.core.event.EventManager;
import org.springframework.stereotype.Component;
import org.springframework.validation.Errors;
import org.springframework.validation.Validator;
import org.springframework.validation.beanvalidation.SpringValidatorAdapter;
/*
 * Copyright (C) 2016 Dominik Schadow, dominikschadow@gmail.com
 *
 * This file is part of the Application Intrusion Detection project.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package de.dominikschadow.dukeencounters.user;



/**
 * Validates an user: checks required fields and scans for basic Cross-Site Scripting and SQL Injection payload.
 *
 * @author Dominik Schadow
 */
@Component
@AllArgsConstructor
public class DukeEncountersUserValidator implements Validator {
    private final SpringValidatorAdapter validator;
    private final EventManager ids;
    private final UserService userService;
    private final SecurityValidationService securityValidationService;
    private final DetectionSystem detectionSystem;

// Path: duke-encounters/src/main/java/de/dominikschadow/dukeencounters/Constants.java
// public final class Constants {
//     /**
//      * XSS error code, value is {@value}.
//      */
//     public static final String XSS_ERROR_CODE = "xss.attempt";
//     /**
//      * SQL injection error code, value is {@value}.
//      */
//     public static final String SQLI_ERROR_CODE = "sqli.attempt";
//     /**
//      * Invalid value error code, value is {@value}.
//      */
//     public static final String ATTACK_ERROR_CODE = "invalid.value";
//     /**
//      * Invalid year error code, value is {@value}.
//      */
//     public static final String INVALID_YEAR_ERROR_CODE = "invalid.year";
//     /**
//      * Passwords don't match error code, value is {@value}.
//      */
//     public static final String NOT_MATCHING_PASSWORDS_ERROR_CODE = "password.nomatch";
//     /**
//      * The new password is not safe, value is {@value}.
//      */
//     public static final String UNSAFE_PASSWORD_ERROR_CODE = "password.unsafe";
//     /**
//      * The current password is not correct, value is {@value}.
//      */
//     public static final String CURRENT_PASSWORD_NOT_CORRECT_ERROR_CODE = "password.incorrect";
//     /**
//      * The entered username already exists, value is {@value}.
//      */
//     public static final String USERNAME_ALREADY_EXISTS = "username.exists";
//     /**
//      * Like for SQL queries, value is {@value}.
//      */
//     public static final String LIKE = "%";
//     /**
//      * Year of Java creation, any Duke encounter before this year is impossible, value is {@value}.
//      */
//     public static final int YEAR_OF_JAVA_CREATION = 1995;
// 
//     private Constants() {
//     }
// }
// 
// Path: duke-encounters/src/main/java/de/dominikschadow/dukeencounters/encounter/DukeEncountersUser.java
// @Entity
// @Table(name = "users", uniqueConstraints = @UniqueConstraint(columnNames = {"username"}))
// @Data
// public class DukeEncountersUser {
//     @Id
//     @GeneratedValue
//     private long id;
//     @NotBlank(message = "Your firstname is required")
//     private String firstname;
//     @NotBlank(message = "Your lastname is required")
//     private String lastname;
//     @NotBlank(message = "Your username is required")
//     @Column(nullable = false)
//     private String username;
//     @NotBlank(message = "Your email address is required")
//     @Email
//     @Column(nullable = false)
//     private String email;
//     @Length(min = 10, max = 1024, message = "A password is required and must contain between 10 and 60 characters")
//     @Column(nullable = false, length = 60)
//     private String password;
//     @Transient
//     private String confirmPassword;
//     private Date registrationDate;
//     @Enumerated(EnumType.STRING)
//     private Level level;
//     private boolean enabled;
//     @OneToOne
//     private Authority authority;
// 
//     @Override
//     public String toString() {
//         String name = Strings.nullToEmpty(getFirstname()) + " " + Strings.nullToEmpty(getLastname());
//         name = CharMatcher.WHITESPACE.trimTrailingFrom(name);
// 
//         return name;
//     }
// }
// 
// Path: duke-encounters/src/main/java/de/dominikschadow/dukeencounters/security/SecurityValidationService.java
// @Service
// public class SecurityValidationService {
//     public final boolean hasXssPayload(@NotNull final String payload) {
//         return containsAnyIgnoreCase(payload, "<", "script", "onload", "eval", "document.cookie");
//     }
// 
//     public final boolean hasSqlIPayload(@NotNull final String payload) {
//         return containsAnyIgnoreCase(payload, "drop", "insert", "update", "delete", "union", "select", "exec", "fetch",
//                 "' or '1'='1", "' or 1=1");
//     }
// 
//     private boolean containsAnyIgnoreCase(final String payload, final String... searchStrings) {
//         for (String searchString : searchStrings) {
//             if (StringUtils.containsIgnoreCase(payload, searchString)) {
//                 return true;
//             }
//         }
// 
//         return false;
//     }
// }


// Path: duke-encounters/src/main/java/de/dominikschadow/dukeencounters/user/DukeEncountersUserValidator.java
import static org.owasp.appsensor.core.DetectionPoint.Category.COMMAND_INJECTION;
import static org.owasp.appsensor.core.DetectionPoint.Category.INPUT_VALIDATION;
import de.dominikschadow.dukeencounters.Constants;
import de.dominikschadow.dukeencounters.encounter.DukeEncountersUser;
import de.dominikschadow.dukeencounters.security.SecurityValidationService;
import lombok.AllArgsConstructor;
import org.owasp.appsensor.core.DetectionPoint;
import org.owasp.appsensor.core.DetectionSystem;
import org.owasp.appsensor.core.Event;
import org.owasp.appsensor.core.event.EventManager;
import org.springframework.stereotype.Component;
import org.springframework.validation.Errors;
import org.springframework.validation.Validator;
import org.springframework.validation.beanvalidation.SpringValidatorAdapter;

/*
 * Copyright (C) 2016 Dominik Schadow, dominikschadow@gmail.com
 *
 * This file is part of the Application Intrusion Detection project.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package de.dominikschadow.dukeencounters.user;



/**
 * Validates an user: checks required fields and scans for basic Cross-Site Scripting and SQL Injection payload.
 *
 * @author Dominik Schadow
 */
@Component
@AllArgsConstructor
public class DukeEncountersUserValidator implements Validator {
    private final SpringValidatorAdapter validator;
    private final EventManager ids;
    private final UserService userService;
    private final SecurityValidationService securityValidationService;
    private final DetectionSystem detectionSystem;

    @Override