Package org.apache.sling.xss
Interface XSSFilter
-
@ProviderType public interface XSSFilterThis service should be used to protect output against potential XSS attacks. The protection is context based.
-
-
Field Summary
Fields Modifier and Type Field Description static ProtectionContextDEFAULT_CONTEXTDefault context.
-
Method Summary
All Methods Instance Methods Abstract Methods Modifier and Type Method Description booleancheck(ProtectionContext context, String src)Indicates whether or not a given source string contains XSS policy violations.Stringfilter(String src)Prevents the given source string from containing XSS stuff.Stringfilter(ProtectionContext context, String src)Protects the given source string from containing XSS stuff.booleanisValidHref(String url)Checks if the given URL is valid to be used for thehrefattribute in aatag.
-
-
-
Field Detail
-
DEFAULT_CONTEXT
static final ProtectionContext DEFAULT_CONTEXT
Default context.
-
-
Method Detail
-
check
boolean check(ProtectionContext context, String src)
Indicates whether or not a given source string contains XSS policy violations.- Parameters:
context- context to use for checkingsrc- source string- Returns:
- true if the source is violation-free
- Throws:
NullPointerException- if context isnull
-
filter
String filter(String src)
Prevents the given source string from containing XSS stuff.The default protection context is used for checking.
- Parameters:
src- source string- Returns:
- string that does not contain XSS stuff
-
filter
String filter(ProtectionContext context, String src)
Protects the given source string from containing XSS stuff.- Parameters:
context- context to use for checkingsrc- source string- Returns:
- string that does not contain XSS stuff
- Throws:
NullPointerException- if context isnull
-
isValidHref
boolean isValidHref(String url)
Checks if the given URL is valid to be used for thehrefattribute in aatag.The default protection context is used for checking.
- Parameters:
url- the URL that should be validated- Returns:
- true if the URL is violation-free
-
-