Encryption Decryption in java

In some use cases we require encryption and decryption of parameters. There are so many algorithm present for this implementation. Java Encryption Algorithms

When we are implementing the algorithm we need to consider our requirement and select the appropriate algorithm.

In one of my use case i had one requirement to send some parameters after encryption and decrypt it wherever i am using those parameters. I used AES algorithm.

You can use the same code in your application by creating a java file.

import java.io.IOException;
import java.nio.charset.Charset;
import java.security.GeneralSecurityException;

import java.util.regex.Pattern;

import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;

public class Encryption {
   private static String key = "xyzBKabcccraSing";
 
  public static void main(String[] args) {
    try {
      String encryptData="http://freshers.xyz.com/alert(request.get())";
      String ciphertext = encrypt(encryptData);
      System.out.println("encrypted value:" +ciphertext);
      System.out.println("decrypted value:" + (decrypt(ciphertext)));
      System.out.println("After validation : "+validateInput(decrypt(ciphertext)));
     } catch (Exception e) {
      e.printStackTrace();
    }
  }

/* Method to encrypt given string
 * input  : String
 * output : decryptrd string
 */

  public static String encrypt(String value)throws GeneralSecurityException {

    byte[] raw = key.getBytes(Charset.forName("UTF-8"));
    if (raw.length != 16) {
      throw new IllegalArgumentException("Invalid key size.");
    }
    SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
    cipher.init(Cipher.ENCRYPT_MODE, skeySpec,new IvParameterSpec(new byte[16]));
    byte[] byteCipherText = cipher.doFinal(value.getBytes(Charset.forName("UTF-8")));
    String strCipherText = new BASE64Encoder().encode(byteCipherText);
    return strCipherText;
  }


/* Method to Decrypt the given encrypted string
* input  : decrypted String
* output : encrypted string
*/


  public static String decrypt(String encrypted)throws GeneralSecurityException,IOException {

    byte[] raw = key.getBytes(Charset.forName("UTF-8"));
    if (raw.length != 16) {
      throw new IllegalArgumentException("Invalid key size.");
    }
    SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
    cipher.init(Cipher.DECRYPT_MODE, skeySpec,new IvParameterSpec(new byte[16]));
    byte[] decodedBytes=new BASE64Decoder().decodeBuffer(encrypted);
    byte[] original = cipher.doFinal(decodedBytes);
 
    return new String(original, Charset.forName("UTF-8"));
  }


// below code is used to validate or avoid the XSS attack in application

private static Pattern[] patterns = new Pattern[] {
            // Script fragments
            Pattern.compile("<script>(.*?)</script>",Pattern.CASE_INSENSITIVE),
            // src='...'
            Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL),
            Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL),
            // lonely script tags
            Pattern.compile("</script>", Pattern.CASE_INSENSITIVE),
            Pattern.compile("<script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL),
            // eval(...)
            Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL),
            // expression(...)
            Pattern.compile("expression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL),
            // javascript:...
            Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE),
            // vbscript:...
            Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE),
            // onload(...)=...
            Pattern.compile("onload(.*)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL),
            //alert tag in js
            Pattern.compile("alert(.*)", Pattern.CASE_INSENSITIVE),
            Pattern.compile("<.*>", Pattern.CASE_INSENSITIVE)};

/* Method to validate input string for xss attack or
 * any malicious code
 */

public static String validateInput(String value) {
        if (value != null) {
           value = value.replaceAll("\0", "");
           for (Pattern scriptPattern : patterns) {
                value = scriptPattern.matcher(value).replaceAll("");
            }
        }
        return value;
    }
}

This code is tested and verified by checkmarx and fortify reports.