de.hybris.platform.hmc

Class HMCHelper.XSSFilter

java.lang.Object

de.hybris.platform.hmc.HMCHelper.XSSFilter

Enclosing class:

HMCHelper

public static class HMCHelper.XSSFilter
extends Object

Filtering utility for protecting against XSS (Cross Site Scripting).

Field Summary

Fields

Modifier and Type	Field and Description
protected Map<String,List<String>>	allowed
protected String[]	allowedEntities
protected String[]	allowedProtocols
protected static boolean	ALWAYS_MAKE_TAGS
protected String[]	needClosingTags
protected String[]	protocolAtts
protected static int	REGEX_FLAGS_SI
protected String[]	removeBlanks
protected String[]	selfClosingTags
protected static boolean	STRIP_COMMENTS
protected Map<String,Integer>	tagCounts

Constructor Summary

Constructors

Constructor and Description
XSSFilter()
XSSFilter(String tag) Creates an XSSFilter instance for which the submitted tag was removed from the internal the predefined "allowed entities" list

Method Summary

Modifier and Type	Method and Description
protected String	balanceHTML(String userInput)
protected String	checkEntity(String preamble, String term)
protected String	checkTags(String userInput)
static String	chr(int decimal)
protected String	decodeEntities(String userInput)
protected String	escapeComments(String userInput)
String	filter(String input) given a user submitted input String, filter out any invalid or restricted html.
static String	htmlSpecialChars(String specialHTMLChars)
protected boolean	isValidEntity(String entity)
protected String	processParamProtocol(String userInput)
protected String	processRemoveBlanks(String userInput)
protected String	processTag(String userInput)
protected String	regexReplace(String regex_pattern, String replacement, String userInput)
void	removeTagFromAllowedEntities(String tag) In some cases (see PLA-8216) we want to exclude some html tags from the predefined (default) list
protected void	reset()
protected String	validateEntities(String userInput)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

ALWAYS_MAKE_TAGS

protected static final boolean ALWAYS_MAKE_TAGS

See Also:

Constant Field Values

STRIP_COMMENTS

protected static final boolean STRIP_COMMENTS

See Also:

Constant Field Values

REGEX_FLAGS_SI

protected static final int REGEX_FLAGS_SI

See Also:

Constant Field Values

allowed

protected Map<String,List<String>> allowed

tagCounts

protected Map<String,Integer> tagCounts

selfClosingTags

protected String[] selfClosingTags

needClosingTags

protected String[] needClosingTags

protocolAtts

protected String[] protocolAtts

allowedProtocols

protected String[] allowedProtocols

removeBlanks

protected String[] removeBlanks

allowedEntities

protected String[] allowedEntities

Constructor Detail

XSSFilter

public XSSFilter()

XSSFilter

public XSSFilter(String tag)

Creates an XSSFilter instance for which the submitted tag was removed from the internal the predefined "allowed entities" list

Note: In some cases (see PLA-8216) we want to exclude some html tags from the mentioned list

Parameters:

tag - html tag which will be excluded

Method Detail

removeTagFromAllowedEntities

public void removeTagFromAllowedEntities(String tag)

In some cases (see PLA-8216) we want to exclude some html tags from the predefined (default) list

Parameters:

tag -

reset

protected void reset()

chr

public static String chr(int decimal)

htmlSpecialChars

public static String htmlSpecialChars(String specialHTMLChars)

filter

public String filter(String input)

given a user submitted input String, filter out any invalid or restricted html.

Parameters:

input - text (i.e. submitted by a user) than may contain html

Returns:

"clean" version of input, with only valid, whitelisted html elements allowed

escapeComments

protected String escapeComments(String userInput)

balanceHTML

protected String balanceHTML(String userInput)

checkTags

protected String checkTags(String userInput)

processRemoveBlanks

protected String processRemoveBlanks(String userInput)

regexReplace

protected String regexReplace(String regex_pattern,
                              String replacement,
                              String userInput)

processTag

protected String processTag(String userInput)

processParamProtocol

protected String processParamProtocol(String userInput)

decodeEntities

protected String decodeEntities(String userInput)

validateEntities

protected String validateEntities(String userInput)

checkEntity

protected String checkEntity(String preamble,
                             String term)

isValidEntity

protected boolean isValidEntity(String entity)