Complete the truncated example in validation.properties

configuration/esapi/validation.properties

@@ -1,24 +1,31 @@
 # The ESAPI validator does many security checks on input, such as canonicalization
 # and whitelist validation. Note that all of these validation rules are applied *after*
-# canonicalization. Double-encoded characters (even with different encodings involved,
+# canonicalization. Double-encoded characters (even with different encodings involved)
 # are never allowed.
 #
 # To use:
 #
 # First set up a pattern below. You can choose any name you want, prefixed by the word
-# "Validation." For example:
-#   Validation.Email=^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\\.[a-zA-Z]{2,4}$
+# "Validator." For example:
+#   Validator.Email=^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\\.[a-zA-Z]{2,4}$
 # 
 # Then you can validate in your code against the pattern like this:
 #     ESAPI.validator().isValidInput("User Email", input, "Email", maxLength, allowNull);
-# Where maxLength and allowNull are set for you needs, respectively.
+# Where maxLength and allowNull are set for your needs, respectively.
 #
 # But note, when you use boolean variants of validation functions, you lose critical 
 # canonicalization. It is preferable to use the "get" methods (which throw exceptions) 
 # and use the returned user input which is in canonical form. Consider the following:
 #  
 # try {
 #    someObject.setEmail(ESAPI.validator().getValidInput("User Email", input, "Email", maxLength, allowNull));
+# } catch (ValidationException e) {
+#    // The input did not match the "Email" pattern, so reject it.
+# }
+#
+# Here setEmail() receives the canonicalized input, not the raw input. Note that
+# getValidInput() can also throw IntrusionException, which is unchecked, when the
+# input looks like an attack (for example, multiple or mixed encoding).
 #
 Validator.SafeString=^[.\\p{Alnum}\\p{Space}]{0,1024}$
 Validator.Email=^[A-Za-z0-9._%'-]+@[A-Za-z0-9.-]+\\.[a-zA-Z]{2,4}$

src/test/resources/esapi/validation.properties

@@ -13,25 +13,32 @@
 #
 # The ESAPI validator does many security checks on input, such as canonicalization
 # and whitelist validation. Note that all of these validation rules are applied *after*
-# canonicalization. Double-encoded characters (even with different encodings involved,
+# canonicalization. Double-encoded characters (even with different encodings involved)
 # are never allowed.
 #
 # To use:
 #
 # First set up a pattern below. You can choose any name you want, prefixed by the word
-# "Validation." For example:
-#   Validation.Email=^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\\.[a-zA-Z]{2,4}$
+# "Validator." For example:
+#   Validator.Email=^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\\.[a-zA-Z]{2,4}$
 # 
 # Then you can validate in your code against the pattern like this:
 #     ESAPI.validator().isValidInput("User Email", input, "Email", maxLength, allowNull);
-# Where maxLength and allowNull are set for you needs, respectively.
+# Where maxLength and allowNull are set for your needs, respectively.
 #
 # But note, when you use boolean variants of validation functions, you lose critical 
 # canonicalization. It is preferable to use the "get" methods (which throw exceptions)
 # and use the returned user input which is in canonical form. Consider the following:
 #  
 # try {
 #    someObject.setEmail(ESAPI.validator().getValidInput("User Email", input, "Email", maxLength, allowNull));
+# } catch (ValidationException e) {
+#    // The input did not match the "Email" pattern, so reject it.
+# }
+#
+# Here setEmail() receives the canonicalized input, not the raw input. Note that
+# getValidInput() can also throw IntrusionException, which is unchecked, when the
+# input looks like an attack (for example, multiple or mixed encoding).
 #
 Validator.SafeString=^[.\\p{Alnum}\\p{Space}]{0,1024}$
 #Given the discussion: https://github.com/ESAPI/esapi-java-legacy/issues/374, a better upper-bound for domain name