### Question:
SanitizingResponseRewriter implements ResponseRewriter { public void rewrite(HttpRequest request, HttpResponseBuilder resp) { if (request.isSanitizationRequested() && featureConfigFactory.get(request).shouldRewriteURL(request.getUri().toString())) { if (StringUtils.isEmpty(request.getRewriteMimeType())) { LOG.log(Level.WARNING, "Request to sanitize without content type for " + request.getUri()); resp.setContent(""); } else if (request.getRewriteMimeType().equalsIgnoreCase("text/css")) { rewriteProxiedCss(request, resp); } else if (request.getRewriteMimeType().toLowerCase().startsWith("image/")) { rewriteProxiedImage(request, resp); } else { LOG.log(Level.WARNING, "Request to sanitize unknown content type " + request.getRewriteMimeType() + " for " + request.getUri()); resp.setContent(""); } } } @Inject  SanitizingResponseRewriter(ContentRewriterFeature.Factory featureConfigFactory,
      CajaCssSanitizer cssSanitizer,
      ProxyUriManager proxyUriManager); void rewrite(HttpRequest request, HttpResponseBuilder resp);  }### Answer:
@Test public void enforceInvalidProxedCssRejected() throws Exception { HttpRequest req = new HttpRequest(CONTENT_URI); req.setRewriteMimeType("text/css"); HttpResponse response = new HttpResponseBuilder().setResponseString("doEvil()").create(); String sanitized = ""; assertEquals(sanitized, rewrite(req, response)); }
@Test public void enforceValidProxedCssAccepted() throws Exception { HttpRequest req = new HttpRequest(CONTENT_URI); req.setRewriteMimeType("text/css"); HttpResponse response = new HttpResponseBuilder().setResponseString( "@import url('http: String sanitized = "@import url('http: + "A {\n" + " font: BOLD\n" + '}'; String rewritten = rewrite(req, response); assertEquals(sanitized, rewritten); }
@Test public void enforceValidProxedCssAcceptedNoCache() throws Exception { HttpRequest req = new HttpRequest(CONTENT_URI); req.setRewriteMimeType("text/css"); req.setIgnoreCache(true); HttpResponse response = new HttpResponseBuilder().setResponseString( "@import url('http: String sanitized = "@import url('http: + "A {\n" + " font: BOLD\n" + '}'; String rewritten = rewrite(req, response); assertEquals(sanitized, rewritten); }
@Test public void enforceInvalidProxedImageRejected() throws Exception { HttpRequest req = new HttpRequest(CONTENT_URI); req.setRewriteMimeType("image/*"); HttpResponse response = new HttpResponseBuilder().setResponse("NOTIMAGE".getBytes()).create(); String sanitized = ""; assertEquals(sanitized, rewrite(req, response)); }
@Test public void validProxiedImageAccepted() throws Exception { HttpRequest req = new HttpRequest(CONTENT_URI); req.setRewriteMimeType("image/*"); HttpResponse response = new HttpResponseBuilder().setResponse( IOUtils.toByteArray(getClass().getClassLoader().getResourceAsStream( "org/apache/shindig/gadgets/rewrite/image/inefficient.png"))).create(); assertNull(rewrite(req, response)); }
@Test public void enforceUnknownMimeTypeRejected() throws Exception { HttpRequest req = new HttpRequest(CONTENT_URI); req.setRewriteMimeType("text/foo"); HttpResponse response = new HttpResponseBuilder().setResponseString("doEvil()").create(); String sanitized = ""; assertEquals(sanitized, rewrite(req, response)); }
@Test public void enforceMissingMimeTypeRejected() throws Exception { HttpRequest req = new HttpRequest(CONTENT_URI); req.setRewriteMimeType(null); HttpResponse response = new HttpResponseBuilder().setResponseString("doEvil()").create(); String sanitized = ""; assertEquals(sanitized, rewrite(req, response)); }