|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectnet.sf.xsshtmlfilter.HTMLFilter
public final class HTMLFilter
HTML filtering utility for protecting against XSS (Cross Site Scripting). This code is licensed LGPLv3 This code is a Java port of the original work in PHP by Cal Hendersen. http://code.iamcal.com/php/lib_filter/ The trickiest part of the translation was handling the differences in regex handling between PHP and Java. These resources were helpful in the process: http://java.sun.com/j2se/1.4.2/docs/api/java/util/regex/Pattern.html http://us2.php.net/manual/en/reference.pcre.pattern.modifiers.php http://www.regular-expressions.info/modifiers.html A note on naming conventions: instance variables are prefixed with a "v"; global constants are in all caps. Sample use: String input = ... String clean = new HTMLFilter().filter( input ); The class is not thread safe. Create a new instance if in doubt. If you find bugs or have suggestions on improvement (especially regarding performance), please contact us. The latest version of this source, and our contact details, can be found at http://xss-html-filter.sf.net
Constructor Summary | |
---|---|
HTMLFilter()
Default constructor. |
|
HTMLFilter(boolean debug)
Set debug flag to true. |
|
HTMLFilter(java.util.Map<java.lang.String,java.lang.Object> configuration)
Map-parameter configurable constructor. |
Method Summary | |
---|---|
static java.lang.String |
chr(int decimal)
|
java.lang.String |
filter(java.lang.String input)
given a user submitted input String, filter out any invalid or restricted html. |
static java.lang.String |
htmlSpecialChars(java.lang.String s)
|
boolean |
isAlwaysMakeTags()
|
boolean |
isStripComments()
|
Methods inherited from class java.lang.Object |
---|
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Constructor Detail |
---|
public HTMLFilter()
public HTMLFilter(boolean debug)
debug
- turn debug on with a true argumentpublic HTMLFilter(java.util.Map<java.lang.String,java.lang.Object> configuration)
configuration
- map containing configuration. keys match field names.Method Detail |
---|
public static java.lang.String chr(int decimal)
public static java.lang.String htmlSpecialChars(java.lang.String s)
public java.lang.String filter(java.lang.String input)
input
- text (i.e. submitted by a user) than may contain html
public boolean isAlwaysMakeTags()
public boolean isStripComments()
|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |