#
# Copyright © 2005 - 2018 TIBCO Software Inc.
# http://www.jaspersoft.com.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.
#

# OWASP ESAPI RegEx Whitelist Patterns
Validator.SafeString=^[.\\p{Alnum}\\p{Space}]{0,1024}$
Validator.Email=^[\\p{L}\\p{M}\\p{N}._%'-]+@[\\p{L}\\p{M}\\p{N}.-]+$
Validator.IPAddress=^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
Validator.URL=^(ht|f)tp(s?)\\:\\/\\/[0-9a-zA-Z]([-.\\w]*[0-9a-zA-Z])*(:(0-9)*)*(\\/?)([a-zA-Z0-9\\-\\.\\?\\,\\:\\'\\/\\\\\\+=&amp;%\\$#_]*)?$
Validator.CreditCard=^(\\d{4}[- ]?){3}\\d{4}$
Validator.SSN=^(?!000)([0-6]\\d{2}|7([0-6]\\d|7[012]))([ -]?)(?!00)\\d\\d\\3(?!0000)\\d{4}$

# Jaspersoft RegEx Whitelist Patterns
Validator.Alpha=^[\\p{L}\\p{M}]*$
Validator.AlphaDot=^[\\p{L}\\p{M}\\.]*$
Validator.AlphaNumDot=^[\\p{L}\\p{M}\\p{N}\\.]*$
Validator.AlphaDotUnderscore=^[\\p{L}\\p{M}_\\.]*$
Validator.AlphaNumDotUnderscore=^[\\p{L}\\p{M}\\p{N}_\\.]*$
Validator.AlphaNum=^[\\-]{0,1}[\\p{L}\\p{M}\\p{N}]*$
Validator.AlphaNumSpace=^[\\p{L}\\p{M}\\p{N}(\\s|%20)]*$
Validator.AlphaNumUnderscore=^[\\p{L}\\p{M}\\p{N}\\p{Pc}]*$
Validator.AlphaNumUnderscoreEtc=^[\\p{L}\\p{M}\\p{N}%_\\|\\.\\/\\-\\?\\=\\&\\s\\*\\@\\(\\)\\,\\;:\\~\\'\\"\\[\\]]*$

# p{L} = allow letters any language
# p{M} = allow marks (accents, umlauts, etc)
# p{L}p{M} = allow code point letter+mark
# p{N} = any numeric
# p{P} = all punctuation symbols (not recommended)
# p{Pd} = punctuation hyphen or dash
# p{Pi} and p{Pf} = quote marks
# p{Pc} = punctuation connectors such as underscore
# p{Po} = punctuation other, not dash, bracket, quote, connector
# p{Sc} = currency symbols

# This rule allows most chars, and should prevent < and >
Validator.AlphaNumPunctuation=^[\\u0080\\u0099\\u2019\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pi}\\p{Pf}\\p{Pc}\\p{Po}\\p{Sc}\\p{So}\\p{Sm}\\p{Cf}\\p{Z}\\s\\=\\(\\)\\[\\]\\~\\|\\{\\}\\`\\^\\+&&[^<>]]*$

# This rule allows almost every char.  Not recommended.
Validator.AlphaNumPunctuationBrackets=^[\\p{L}\\p{M}\\p{N}\\p{P}\\p{S}\\p{Cf}\\p{Cc}\\p{Z}\\s]*$

# This rule allows almost every char, including angle brackets, but not parentheses.  Use for xml input.  Not recommended.
Validator.AlphaNumPunctuationBracketsNoParen=^[\\p{L}\\p{M}\\p{N}\\p{P}\\p{S}\\p{Cf}\\p{Cc}\\p{Z}\\s&&[^\\(\\)]]*$

Validator.AlphaUnderscore=^[\\p{L}\\p{M}\\p{Pc}]*$
Validator.AlphaUnderscoreForward=^[\\p{L}\\p{M}\\p{Pc}\\/]*$
Validator.AlphaUnderscoreDash=^[\\p{L}\\p{M}\\p{Pd}\\p{Pc}]*$

# Not recommended to use Numeric. Use AlphaNum instead since it is possible to receive undefined, Null, or NaN from client
Validator.Numeric=^[\\-]{0,1}[\\p{N}\\.]*$
Validator.NumUnderscore=^[\\-]{0,1}[\\p{N}_]*$

# Valid username value allows alphanumeric, dash, underscore, at sign, backslash, dot, etc
# Validator.UsernameValue =^[\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pi}\\p{Pf}\\p{Pc}\\p{Po}\\~\\|]+$
# Use blacklist from applicationContext.xml configurationBean.userNameNotSupportedSymbols
Validator.UsernameValue=^[^\\s`"'~!#$%^&,*+=;:?<>}{)(\\]\\[/]*$
Validator.Timezone=^[\\p{L}\\p{N}_\\-\\/\\:\\+\\p{Z}]*$

# Allow 0 or more characters, except for the space character
Validator.AllOkNotSpace=^[^\\s]*$

# spring flow is english only so this is ok
Validator.FlowExecKey=^e[1-9][0-9]*s[1-9][0-9]*$

Validator.URLNoProtocol=^[\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}\\p{Po}\\p{Pi}\\p{Pf}\\:\\/\\%\\.\\s]*$

# similar to AlphaNumPunctuation, and add space explicitly
Validator.PathWithSpace=^[\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}\\p{Po}\\p{Pi}\\p{Pf}\\s\\=\\:\\/\\%\\.\\~\\|$]*$

# same as PathWithSpace add comma explicitly. can be used to check comma separated elements of type PathWithSpace
Validator.PathWithComma=^[\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}\\p{Po}\\p{Pi}\\p{Pf}\\s\\=\\:\\/\\%\\.\\~\\|\\,$]+$

# app specific regex for the src parameter
Validator.Source=^(\\/)[\\p{L}\\p{M}\\p{N}]+\\.html[(%3F)\\w(%3D)]+

# a filename can be alpha, numeric, dash, or underscore
# followed by dot
# followed by alpha only 2-4 chars, no more, no less
Validator.Filename=^[\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}]+\\.[\\p{L}]{2,4}$

# any file extension
Validator.FileExt=[\\p{L}]{2,4}$

# use to validate file path + file name
# allows forward slash, letters, letter+mark, numbers, dash, connectors such as underscore, and dot
Validator.Resource=^[\\/\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}\\.()\\s]+$
# Validator.Resource=^[\\/\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}\\.]+$

# specific to flowParams
# pattern cannot be generalized at this point
Validator.FlowParams=^[\\w]?\\w(?=).*$

Validator.Script=(?is)^.*<\\s*(\\S+)\\s*.*>.*<\\s*/\\s*\\1\\s*>.*$
Validator.ScriptLiteral=(?is)^.*<\\s*(script)\\s*.*>.*$
Validator.DoubleDash=(?s)^.*--.*$
Validator.SQLComment=(?s)(^.*--.*$)|(^.*/\\*.+\\*/.*$)

# true or false or yes or no, case insensitive
Validator.Boolean=^((?i)true|(?i)false|(?i)yes|(?i)no|(?i)~NOTHING~)$

# app specific date format used in View | Repository | Schedule
# example: 2011-09-14
Validator.Date=\\d{4}-\\d{2}-\\d{2}
Validator.DateNoFormat=^[\\p{N}\\p{Pd}\\p{Po}\\s\\p{L}\\p{M}]+$
# example: 2011-09-14 17:53
Validator.DateTime=\\d{4}-\\d{2}-\\d{2}\\s\\d{1,2}:\\d{2}

# app specific
# Example:  datasources=['/public/audit/datasources/AuditDataSource']
Validator.Datasources=^\\[\\'[\\/\\w]+\\'\\]$

# do not use
# Prevent the words 'update ', 'insert ', or 'delete ' (notice ending space) from being in a query string
# use string.toLowerCase() to make sure case matches
# hacker could use DeLeTe or upDAte, so toLowerCase forces the case on all characters in the string.
Validator.ValidSQLNotUpdateInsertDelete=^((?!update |insert |delete ).)*$

# starts with 'select', does not contain ';'
# Do not allow INTO anywhere in the query.
# "select ... into" is dangerous because one can do
# select * INTO Table in 'Another.mdb' FROM Customers;
Validator.ValidSQL=(?is)^\\s*(select|call)\\b((?!\\binto\\b)[^;])*;?\\s*$

# ========================================================
# WARNING!  Do NOT use these AnyChar rules unless you have to!
# allow any character except newline
Validator.AnyChar=^.*$
# allow any character including newline
Validator.AnyCharIncludingNewline=[\\s\\S]*
# ========================================================

Validator.EmailAddresses=^[\\p{L}\\p{M}\\p{N}._%'-\\@\\,\\;\\s]+$

# ie7 quirk posts span tags along with the actual button value
# use this when running into this quirk. this regex does not to allow a dot
# or parenthesis (eg, document.cookie or alert(1) will not pass)
Validator.ButtonValue=^[\\p{L}\\p{M}\\<\\>\\s\\&\\/\\=\\-\\;]*$

# input controls uses ~NOTHING~ as the value to post when the user
# de-selects the standard options from the list
Validator.DropdownValue=^[\\p{L}\\p{M}\\p{N}\\~\\s\\[\\]\\&\\'\\`\\,\\-\\/]*$

Validator.ReportUnitName=^[\\p{L}\\p{M}\\p{N}\\p{P}\\p{S}\\p{Cf}\\p{Cc}\\p{Z}\\s&&[^<>;/{]]*$
Validator.DashboardViewer=^[\\p{L}\\p{M}\\p{N}\\p{P}\\p{S}\\p{Cf}\\p{Cc}\\p{Z}\\s&&[^\\(\\)<>;/{]]*$