trying to detect for basic XSS and SQLi tags with Pattern and Matcher in Java

Viewed 28

I'm writing a small web-app for my exam at university.

The goal, is to detect for basic XSS and SQLi tags in a txt file.

I notice that something is wrong with my code, sometimes it works.

public static final String REGEX_FILE_CONTENT_PATTERN = "(<script>|<\\/script>|\\.jsp|\\?[a-zA-Z]+=)";

private final boolean regexChecker(File file) throws IOException {
        boolean isInjected = false;

        BufferedReader buff = new BufferedReader(new FileReader(file, StandardCharsets.UTF_8));

        String strCurrentLine = null;

        // check if file reaches function
        if (buff != null) {
            // Pattern pattern = Pattern.compile(REGEX_FILE_CONTENT_PATTERN);
            Pattern pattern = Pattern.compile(REGEX_FILE_CONTENT_PATTERN, Pattern.CASE_INSENSITIVE);

            // here i can read lines
            while ((strCurrentLine = buff.readLine()) != null) { // start while
                System.out.println(strCurrentLine); // PRINT CURRENT LINE
                Matcher matcher = pattern.matcher(strCurrentLine);
                // System.out.println("MATCH: " + matcher.find());
                isInjected = matcher.find();
            } // end while
        }
        return isInjected;
    }

The code always returns false, even if script tag is placed inside the file.

Thank you!

1 Answers

you can try this:

isInjected &= matcher.find();

enter image description here

Related