@ProviderType public interface XSSAPI
Note: in general, validators are safer than encoders. Encoding only ensures that content within the encoded context cannot break out of said context. It requires that there be a context (for instance, a string context in Javascript), and that damage cannot be done from within the context (for instance, a javascript: URL within a href attribute.
When in doubt, use a validator.
Modifier and Type | Method and Description |
---|---|
@Nullable String |
encodeForCSSString(@Nullable String source)
Encodes a source string for writing to CSS string content.
|
@Nullable String |
encodeForHTML(@Nullable String source)
Encodes a source string for HTML element content.
|
@Nullable String |
encodeForHTMLAttr(@Nullable String source)
Encodes a source string for writing to an HTML attribute value.
|
@Nullable String |
encodeForJSString(@Nullable String source)
Encodes a source string for writing to JavaScript string content.
|
@Nullable String |
encodeForXML(@Nullable String source)
Encodes a source string for XML element content.
|
@Nullable String |
encodeForXMLAttr(@Nullable String source)
Encodes a source string for writing to an XML attribute value.
|
@NotNull String |
filterHTML(@Nullable String source)
Filters potentially user-contributed HTML to meet the AntiSamy policy rules currently in
effect for HTML output (see the XSSFilter service for details).
|
@Nullable String |
getValidCSSColor(@Nullable String color,
@Nullable String defaultColor)
Validate a CSS color value.
|
@Nullable String |
getValidDimension(@Nullable String dimension,
@Nullable String defaultValue)
Validate a string which should contain a dimension, returning a default value if the source is
empty, can't be parsed, or contains XSS risks.
|
@Nullable Double |
getValidDouble(@Nullable String source,
double defaultValue)
Validate a string which should contain an double, returning a default value if the source is
null , empty, can't be parsed, or contains XSS risks. |
@NotNull String |
getValidHref(@Nullable String url)
Sanitizes a URL for writing as an HTML href or src attribute value.
|
@Nullable Integer |
getValidInteger(@Nullable String integer,
int defaultValue)
Validate a string which should contain an integer, returning a default value if the source is
null , empty, can't be parsed, or contains XSS risks. |
String |
getValidJSON(@Nullable String json,
@Nullable String defaultJson)
Validate a JSON string
|
@Nullable String |
getValidJSToken(@Nullable String token,
@Nullable String defaultValue)
Validate a Javascript token.
|
@Nullable Long |
getValidLong(@Nullable String source,
long defaultValue)
Validate a string which should contain a long, returning a default value if the source is
null , empty, can't be parsed, or contains XSS risks. |
String |
getValidMultiLineComment(@Nullable String comment,
@Nullable String defaultComment)
Validate multi-line comment to be used inside a <script>...</script> or <style>...</style> block.
|
@Nullable String |
getValidStyleToken(@Nullable String token,
@Nullable String defaultValue)
Validate a style/CSS token.
|
String |
getValidXML(@Nullable String xml,
@Nullable String defaultXml)
Validate an XML string
|
@Nullable @Nullable Integer getValidInteger(@Nullable @Nullable String integer, int defaultValue)
null
, empty, can't be parsed, or contains XSS risks.integer
- the source integerdefaultValue
- a default value if the source can't be used, is null
or an empty string@Nullable @Nullable Long getValidLong(@Nullable @Nullable String source, long defaultValue)
null
, empty, can't be parsed, or contains XSS risks.source
- the source longdefaultValue
- a default value if the source can't be used, is null
or an empty string@Nullable @Nullable Double getValidDouble(@Nullable @Nullable String source, double defaultValue)
null
, empty, can't be parsed, or contains XSS risks.source
- the source doubledefaultValue
- a default value if the source can't be used, is null
or an empty string@Nullable @Nullable String getValidDimension(@Nullable @Nullable String dimension, @Nullable @Nullable String defaultValue)
dimension
- the source dimensiondefaultValue
- a default value if the source can't be used, is null
or an empty string@NotNull @NotNull String getValidHref(@Nullable @Nullable String url)
url
- the source URL@Nullable @Nullable String getValidJSToken(@Nullable @Nullable String token, @Nullable @Nullable String defaultValue)
token
- the source tokendefaultValue
- a default value to use if the source is null
, an empty string, or doesn't meet validity constraints.@Nullable @Nullable String getValidStyleToken(@Nullable @Nullable String token, @Nullable @Nullable String defaultValue)
token
- the source tokendefaultValue
- a default value to use if the source is null
, an empty string, or doesn't meet validity constraints.@Nullable @Nullable String getValidCSSColor(@Nullable @Nullable String color, @Nullable @Nullable String defaultColor)
color
- the color value to be used.defaultColor
- a default value to use if the input color value is null
, an empty string, doesn't meet validity constraints.String getValidMultiLineComment(@Nullable @Nullable String comment, @Nullable @Nullable String defaultComment)
comment
- the comment to be useddefaultComment
- a default value to use if the comment is null
or not valid.String getValidJSON(@Nullable @Nullable String json, @Nullable @Nullable String defaultJson)
json
- the JSON string to validatedefaultJson
- the default value to use if json
is null
or not validString getValidXML(@Nullable @Nullable String xml, @Nullable @Nullable String defaultXml)
xml
- the XML string to validatedefaultXml
- the default value to use if xml
is null
or not valid@Nullable @Nullable String encodeForHTML(@Nullable @Nullable String source)
source
- the input to encode@Nullable @Nullable String encodeForHTMLAttr(@Nullable @Nullable String source)
source
- the input to encode@Nullable @Nullable String encodeForXML(@Nullable @Nullable String source)
source
- the input to encode@Nullable @Nullable String encodeForXMLAttr(@Nullable @Nullable String source)
source
- the input to encode@Nullable @Nullable String encodeForJSString(@Nullable @Nullable String source)
source
- the input to encode@Nullable @Nullable String encodeForCSSString(@Nullable @Nullable String source)
source
- the input to encode@NotNull @NotNull String filterHTML(@Nullable @Nullable String source)
source
- a string containing the source HTMLsource
is null
or emptyCopyright © 2010 - 2020 Adobe. All Rights Reserved