org.parosproxy.paros.core.scanner

Class VariantGWTQuery

java.lang.Object

org.parosproxy.paros.core.scanner.VariantAbstractRPCQuery

org.parosproxy.paros.core.scanner.VariantGWTQuery

All Implemented Interfaces:

Variant

public class VariantGWTQuery
extends VariantAbstractRPCQuery

Simplified GWT RPC Variant only set to not-empty strings parameter... It takes the RPC call as it has been retrieved, check only for java.util.String objects, and give back only the one that has a set value. If a string has been set to null (so it comes in the request with the value 0 inside the index) it's discarded. To manage null string we need to rebuild the overall payload and currently there are some lack of information regarding the real serialization model used by the GWT environment (e.g. how Long are encoded, how can be serialized vectors, how validation classes work, how are managed proxy objects and, finally, the use of encoded types.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
protected class	VariantGWTQuery.GWTStringTokenizer This is a replacement for the standard StringTokenizer which handles multiple delimiters differently.

Nested classes/interfaces inherited from class org.parosproxy.paros.core.scanner.VariantAbstractRPCQuery

VariantAbstractRPCQuery.RPCParameter

Field Summary

Fields

Modifier and Type	Field and Description
static int	FLAG_RPC_TOKEN_INCLUDED
static String	GWT_RPC_CONTENT_TYPE
static int	RPC_SEPARATOR_CHAR

Constructor Summary

Constructors

Constructor and Description
VariantGWTQuery()

Method Summary

Modifier and Type	Method and Description
String	getEscapedValue(String value, boolean toQuote) Escape a GWT string according to the client implementation found on com.google.gwt.user.client.rpc.impl.ClientSerializationStreamWriter http://www.gwtproject.org/
String	getUnescapedValue(String value) Unescape a GWT serialized string according to the server implementation found on com.google.gwt.user.server.rpc.impl.ServerSerializationStreamReader http://www.gwtproject.org/
boolean	isValidContentType(String contentType)
void	parseContent(String content)

Methods inherited from class org.parosproxy.paros.core.scanner.VariantAbstractRPCQuery

addParameter, addParameter, getParamList, getReadableParameterizedQuery, getReadableParametrizedQuery, getToken, setEscapedParameter, setMessage, setParameter, setRequestContent

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.parosproxy.paros.core.scanner.Variant

getLeafName, getTreePath, setParameters

Field Detail

GWT_RPC_CONTENT_TYPE

public static final String GWT_RPC_CONTENT_TYPE

See Also:

Constant Field Values

RPC_SEPARATOR_CHAR

public static final int RPC_SEPARATOR_CHAR

See Also:

Constant Field Values

FLAG_RPC_TOKEN_INCLUDED

public static final int FLAG_RPC_TOKEN_INCLUDED

See Also:

Constant Field Values

Constructor Detail

VariantGWTQuery

public VariantGWTQuery()

Method Detail

isValidContentType

public boolean isValidContentType(String contentType)

Specified by:

isValidContentType in class VariantAbstractRPCQuery

Parameters:

contentType -

Returns:

parseContent

public void parseContent(String content)

Specified by:

parseContent in class VariantAbstractRPCQuery

Parameters:

content -

getEscapedValue

public String getEscapedValue(String value,
                              boolean toQuote)

Escape a GWT string according to the client implementation found on com.google.gwt.user.client.rpc.impl.ClientSerializationStreamWriter http://www.gwtproject.org/

Specified by:

getEscapedValue in class VariantAbstractRPCQuery

Parameters:

value - the value that need to be escaped

toQuote -

Returns:

getUnescapedValue

public String getUnescapedValue(String value)

Unescape a GWT serialized string according to the server implementation found on com.google.gwt.user.server.rpc.impl.ServerSerializationStreamReader http://www.gwtproject.org/

Specified by:

getUnescapedValue in class VariantAbstractRPCQuery

Parameters:

value - the value that need to be deserialized

Returns:

the deserialized value