org.apache.sling.scripting.jsp.taglib.internal

Class XSSSupport

java.lang.Object

org.apache.sling.scripting.jsp.taglib.internal.XSSSupport

public class XSSSupport
extends Object

Support for basic XSS protection as provided by the OWASP ESAPI's escape methods.

Note that this class is an OSGi component only to make sure it can get a reference to the XSSAPI correctly. Its usage is intended to be only within this bundle. For all other usages, directly accessing the XSSAPI service is strongly recommended.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	XSSSupport.EncodingMode The encoding modes supported by this tag.

Constructor Summary

Constructors

Constructor and Description
XSSSupport()

Method Summary

Modifier and Type	Method and Description
protected void	activate()
protected void	deactivate()
static String	encode(String unencoded, XSSSupport.EncodingMode mode) Encodes the unencoded string using the specified mode.
static XSSSupport.EncodingMode	getEncodingMode(String modeStr) Retrieves the encoding mode associated with the specified string.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

XSSSupport

public XSSSupport()

Method Detail

activate

protected void activate()

deactivate

protected void deactivate()

encode

public static String encode(String unencoded,
                            XSSSupport.EncodingMode mode)

Encodes the unencoded string using the specified mode. This will be deferred to the corresponding OWASP ESAPI encoding method.

Parameters:

unencoded - the unencoded string

mode - the mode with which to encode the string

Returns:

the encoded string

getEncodingMode

public static XSSSupport.EncodingMode getEncodingMode(String modeStr)

Retrieves the encoding mode associated with the specified string. Will throw an IllegalArgumentException if the mode string is not a valid mode and will throw a NullPointerException if the mode string is null.

Parameters:

modeStr - the mode string

Returns:

the encoding mode