### Question:
SAML2Proxy { @VisibleForTesting protected static String getAutoSubmittingFormHtml(final String value) { StringBuilder html = new StringBuilder(); html.append("<html>\n").append("<body onLoad=\"").append("document.postform.submit()").append("\">\n"); html.append("<form name=\"postform\" action=\"").append(ESAPI.encoder().encodeForHTMLAttribute(value)) .append("\" method=\"post\"").append(">\n"); html.append("<noscript>\n<center>\n"); html.append("<p>Your browser does not have JavaScript enabled, "); html.append("you must click the button below to continue</p>\n"); html.append("<input type=\"submit\" value=\"submit\" />\n"); html.append("</center>\n</noscript>\n").append("</form>\n").append("</body>\n").append("</html>\n"); return html.toString(); } private  SAML2Proxy(); static void processSamlResponse(HttpServletRequest request, HttpServletResponse response, PrintWriter out); static final String RESPONSE_KEY; static final String DEFAULT_ERROR_MESSAGE; static final String BAD_REQUEST; static final String MISSING_COOKIE; static final String MISSING_META_MANAGER; static final String META_DATA_ERROR; static final String SAML_GET_RESPONSE_ERROR; static final String SAML_VERIFY_RESPONSE_ERROR; static final String SAML_FAILOVER_DISABLED_ERROR; static final String ERROR_PARAM_KEY; static final String ERROR_CODE_PARAM_KEY; static final String ERROR_MESSAGE_PARAM_KEY; }### Answer:
@Test public void shouldEscapeMaliciousHtmlInputOnForm() { String malicious = "\"><script>alert('Bad thing);</script><form "; final String formHtml = SAML2Proxy.getAutoSubmittingFormHtml(URLEncDec.encode(malicious)); assertThat(formHtml).doesNotContain(malicious); assertThat(URLEncDec.decode(getFormAction(formHtml))).contains(malicious); }