Package org.apache.sling.xss

Interface XSSFilter

@ProviderType
public interface XSSFilter

This service should be used to protect output against potential XSS attacks. The protection is context based.

Field Summary

Fields

Modifier and Type	Field	Description
static final ProtectionContext	DEFAULT_CONTEXT	Default context.

Method Summary

Modifier and Type	Method	Description
boolean	check(ProtectionContext context, String src)	Indicates whether or not a given source string contains XSS policy violations.
String	filter(String src)	Prevents the given source string from containing XSS stuff.
String	filter(ProtectionContext context, String src)	Protects the given source string from containing XSS stuff.
boolean	isValidHref(String url)	Checks if the given URL is valid to be used for the href attribute in a a tag.

Field Details

DEFAULT_CONTEXT

static final ProtectionContext DEFAULT_CONTEXT

Default context.

Method Details

check

boolean check(ProtectionContext context,
 String src)

Indicates whether or not a given source string contains XSS policy violations.

Parameters:

context - context to use for checking

src - source string

Returns:

true if the source is violation-free

Throws:

NullPointerException - if context is null

filter

String filter(String src)

Prevents the given source string from containing XSS stuff.

The default protection context is used for checking.

Parameters:

src - source string

Returns:

string that does not contain XSS stuff

filter

String filter(ProtectionContext context,
 String src)

Protects the given source string from containing XSS stuff.

Parameters:

context - context to use for checking

src - source string

Returns:

string that does not contain XSS stuff

Throws:

NullPointerException - if context is null

isValidHref

boolean isValidHref(String url)

Checks if the given URL is valid to be used for the href attribute in a a tag.

The default protection context is used for checking.

Parameters:

url - the URL that should be validated

Returns:

true if the URL is violation-free