.replace(TRY_STATEMENT, "<% try{ %>")
                .replace(CACHE_AND_SESSION_INVALIDATE_STATEMENT, "<% }catch(Exception e){session.invalidate();} %>");
    }

    /**
     * Encode the JSP content.
     * @param value The value.
     * @return The encoded value.
     */
    public static String encodeJsp(final String value) {
        return value.replace("<% try{ %>", TRY_STATEMENT)

And then they can try again knowing that it's probably something more similar to `stanleyjobsox` than to `johndoe`.

#### A "professional" attack { #a-professional-attack }

            // query matches on all documents.
            body.q = Constants.MATCHES_ALL_QUERY;
        }

        final SearchRenderData renderData = new SearchRenderData();
        body.initialize();
        try {
            searchHelper.search(body, renderData, getUserBean());
            return asJson(new ApiDocsResponse().renderData(renderData).status(Status.OK).result());
        } catch (final InvalidQueryException e) {

            }

            for (InterpolationPostProcessor postProcessor : postProcessors) {
                interpolator.addPostProcessor(postProcessor);
            }

            try {
                try {
                    result = interpolator.interpolate(result, recursionInterceptor);
                } catch (InterpolationException e) {
                    throw new ModelInterpolationException(e.getMessage(), e);

            try {
                ist.interrupt();
            } catch (final Exception e) {
                logger.warn("Could not interrupt a thread of an input stream.", e);
            }

            final CountDownLatch latch = new CountDownLatch(3);
            final Process process = jobProcess.getProcess();
            new Thread(() -> {
                try {

    @Override
    public void run() {
      try {
        workOnQueue();
      } catch (Error e) {
        synchronized (queue) {
          workerRunningState = IDLE;
        }
        throw e;
        // The execution of a task has ended abnormally.
        // We could have tasks left in the queue, so should perhaps try to restart a worker,

                        continue;
                    }
                    final String className = provider + "." + protocol + ".Handler";
                    try {
                        Class handlerClass = null;
                        try {
                            handlerClass = Class.forName(className);
                        } catch (final Exception ex) {}
                        if (handlerClass == null) {

        // purge crawling sessions
        try {
            crawlingInfoService.deleteBefore(systemHelper.getCurrentTimeAsLong());
        } catch (final Exception e) {
            logger.error("Failed to purge crawling sessions.", e);
            resultBuf.append(e.getMessage()).append("\n");
        }

        // purge search logs
        try {

        assertEquals((short) 0x0011, request.getCommand());

        // Verify that default file ID is set
        byte[] expectedFileId = Smb2Constants.UNSPECIFIED_FILEID;
        Field fileIdField;
        try {
            fileIdField = Smb2SetInfoRequest.class.getDeclaredField("fileId");
            fileIdField.setAccessible(true);
            byte[] actualFileId = (byte[]) fileIdField.get(request);

        request.setAttribute(Constants.SEARCH_LOG_ACCESS_TYPE, Constants.SEARCH_LOG_ACCESS_TYPE_JSON);
        final JsonRequestParams params = new JsonRequestParams(request, fessConfig);
        try {
            response.setContentType("application/x-ndjson; charset=UTF-8");
            final long count = searchHelper.scrollSearch(params, doc -> {
                buf.setLength(0);
                buf.append('{');