替换子字符串时防止令牌注入

Question

I have a list of key/value strings and a template to replace them in. However, I don't want to replace them twice if one of the values is another token. For example:

tokens: [
    Token(Key: "{A}", Value: "{B}"),
    Token(Key: "{B}", Value: "b" )
]

template = "Hello, {A}"

>>> replace(template, tokens)
Actual: "b"
Expected: "{B}"

Here's the code:

import java.util.regex.*;

class Main {

  public static String replace(String template, Token... tokens) {
    for ( final Token token : tokens ) {
        template = Pattern.compile( token.getKey(), Pattern.LITERAL + Pattern.CASE_INSENSITIVE )
               .matcher( template )
               .replaceAll( Matcher.quoteReplacement( token.getValue() ) );
    }
    return template;
  }


  public static void main(String[] args) {
    String result = replace( "Hello, {A}",
                            new Token("{A}", "{B}"),
                            new Token("{B}", "b" ) );
    System.out.println(result);
  }


  private static class Token {
    String key;
    String value;

    public Token(String key, String value) {
      this.key = key;
      this.value = value;
    }

    public String getKey() {
      return key;
    }

    public String getValue() {
      return value;
    }
  }
}

This must also work for special characters:

replace("{A}", new Token("{A}", "$0.00")) -> "$0.00"

Answer 1

The point here is to parse the string with the regex only once , make only one pass and when you match your key pattern, it is just {[^{}]*} , any substring between { and } with no curly braces in between, check if there is a token with this key in your Token list, and if there is, replace with this token value, else, put the matched text back.

You may use

public static final Pattern keypattern = Pattern.compile("\\{[^{}]*}");
  
public static Token getTokenByKey(String key, Token... tokens) {
  for ( final Token token : tokens ) {
    if (token.getKey().toUpperCase().equals(key.toUpperCase()))
      return token;
  }
  return null;
}

public static String replace(String template, Token... tokens) {
  Matcher m = keypattern.matcher( template );
  StringBuffer sb = new StringBuffer();
  while (m.find()) {
    Token t = getTokenByKey(m.group(), tokens);
    if (t != null) {
      m.appendReplacement(sb, Matcher.quoteReplacement(t.getValue()));
    } else {
      m.appendReplacement(sb, Matcher.quoteReplacement(m.group()));
    }
  }
  m.appendTail(sb);
  return sb.toString();
}

The main method code executed like

public static void main(String[] args) {
    String result = replace( "Hello, {A} {c}",
                            new Token("{A}", "{B}"),
                            new Token("{B}", "b" ) );
    System.out.println(result);
}

will output Hello, {B} {c} .

See the Java demo online .

The if (token.getKey().toUpperCase().equals(key.toUpperCase())) line ensures the case insensitive matching.