gracefully handle null within 'stripControls', #906 (#907)

* gracefully handle null within 'stripControls', #906

* add unit tests for 'stripControls'

- Check valid string, control characters, empty string, whitespace, and null

* fix spelling

* add unit tests for 'isEmpty'

Author: ThrawnCA

README.md

@@ -150,7 +150,7 @@ add
 ```xml
     <classifier>jakarta</classifier>
 ```
-and include whatever jakara.servlet:jakarta.servlet-api version you are using with
+and include whatever jakarta.servlet:jakarta.servlet-api version you are using with
 ```xml
     <scope>provided</scope>
 ```

documentation/esapi4java-core-2.5.3.0-release-notes.txt

@@ -16,7 +16,7 @@ This is a patch release with the primary intent of providing a Jakarta compatibl
         Encryptor.DigitalSignatureAlgorithm=SHA256withDSA       # The old SHA1withDSA doesn't support 2048-bit RSA modulus length
         Encryptor.DigitalSignatureKeyLength=2048
     Note that if you have persisted previous digital signatures that you must continue to verify, you will have to regenerate them.
-* Thanks to a PR by @jcputney (PR #799), I have attempted to upload additional artifacts to Maven Central that will be a transformed jar suitable for use with the new 'jakarata.servlet' changes for Jakarata EE 9 and later. (Previously, 'javax.servlet' was the name space). Because we are still supporting JDK 8 at this point, we still need to support the 'javax.servlet' namespace as well. In addition to the standard jar artifacts, there should be a new esapi-<release>-jakarta.jar (which uses 'jakarta.servlet' instead of 'javax.servlet' namespace) as well as corresponding *-javadoc.jar and *-sources.jar files. I am not sure it will work as we have no tests for it, but looing at the binaries, it seems like it should.
+* Thanks to a PR by @jcputney (PR #799), I have attempted to upload additional artifacts to Maven Central that will be a transformed jar suitable for use with the new 'jakarta.servlet' changes for Jakarta EE 9 and later. (Previously, 'javax.servlet' was the name space). Because we are still supporting JDK 8 at this point, we still need to support the 'javax.servlet' namespace as well. In addition to the standard jar artifacts, there should be a new esapi-<release>-jakarta.jar (which uses 'jakarta.servlet' instead of 'javax.servlet' namespace) as well as corresponding *-javadoc.jar and *-sources.jar files. I am not sure it will work as we have no tests for it, but looing at the binaries, it seems like it should.
     For additional details, see:
         https://github.com/ESAPI/esapi-java-legacy/pull/799
         https://github.com/ESAPI/esapi-java-legacy/discussions/768

src/main/java/org/owasp/esapi/StringUtilities.java

@@ -39,6 +39,9 @@ public static String replaceLinearWhiteSpace( String input ) {
      * @return the stripped value
      */
     public static String stripControls( String input ) {
+        if ( input == null ) {
+            return null;
+        }
         StringBuilder sb = new StringBuilder();
         for ( int i=0; i<input.length(); i++ ) {
             char c = input.charAt( i );

src/test/java/org/owasp/esapi/StringUtilitiesTest.java

@@ -87,4 +87,22 @@ public void testReplaceNull() {
         assertEquals( "   Test   ", StringUtilities.replaceNull( "   Test   ", "Replaced" ) );
         assertEquals( "Replaced", StringUtilities.replaceNull( "     NULL ", "Replaced" ) );
     }
+
+    public void testStripControls() {
+        // valid characters are preserved
+        assertEquals( "\u0021abc\u007e", StringUtilities.stripControls( "\u0021abc\u007e" ) );
+        // control characters become spaces
+        assertEquals( " a b c ", StringUtilities.stripControls( "\u0000a\u0020b\u007fc\uffff" ) );
+        // blank strings are preserved
+        assertEquals( "", StringUtilities.stripControls( "" ) );
+        assertEquals( "     ", StringUtilities.stripControls( "     " ) );
+        assertEquals( null, StringUtilities.stripControls( null ) );
+    }
+
+    public void testIsEmpty() {
+        assertTrue(StringUtilities.isEmpty(null));
+        assertTrue(StringUtilities.isEmpty(""));
+        assertFalse(StringUtilities.isEmpty(" "));
+        assertFalse(StringUtilities.isEmpty("foo"));
+    }
 }