I'm writing a small web-app for my exam at university.
The goal, is to detect for basic XSS and SQLi tags in a txt file.
I notice that something is wrong with my code, sometimes it works.
public static final String REGEX_FILE_CONTENT_PATTERN = "(<script>|<\\/script>|\\.jsp|\\?[a-zA-Z]+=)";
private final boolean regexChecker(File file) throws IOException {
boolean isInjected = false;
BufferedReader buff = new BufferedReader(new FileReader(file, StandardCharsets.UTF_8));
String strCurrentLine = null;
// check if file reaches function
if (buff != null) {
// Pattern pattern = Pattern.compile(REGEX_FILE_CONTENT_PATTERN);
Pattern pattern = Pattern.compile(REGEX_FILE_CONTENT_PATTERN, Pattern.CASE_INSENSITIVE);
// here i can read lines
while ((strCurrentLine = buff.readLine()) != null) { // start while
System.out.println(strCurrentLine); // PRINT CURRENT LINE
Matcher matcher = pattern.matcher(strCurrentLine);
// System.out.println("MATCH: " + matcher.find());
isInjected = matcher.find();
} // end while
}
return isInjected;
}
The code always returns false, even if script tag is placed inside the file.
Thank you!
