net.sf.xsshtmlfilter
Class HTMLFilter

java.lang.Object
  extended by net.sf.xsshtmlfilter.HTMLFilter

public final class HTMLFilter
extends java.lang.Object

HTML filtering utility for protecting against XSS (Cross Site Scripting). This code is licensed LGPLv3 This code is a Java port of the original work in PHP by Cal Hendersen. http://code.iamcal.com/php/lib_filter/ The trickiest part of the translation was handling the differences in regex handling between PHP and Java. These resources were helpful in the process: http://java.sun.com/j2se/1.4.2/docs/api/java/util/regex/Pattern.html http://us2.php.net/manual/en/reference.pcre.pattern.modifiers.php http://www.regular-expressions.info/modifiers.html A note on naming conventions: instance variables are prefixed with a "v"; global constants are in all caps. Sample use: String input = ... String clean = new HTMLFilter().filter( input ); The class is not thread safe. Create a new instance if in doubt. If you find bugs or have suggestions on improvement (especially regarding performance), please contact us. The latest version of this source, and our contact details, can be found at http://xss-html-filter.sf.net

Author:
Joseph O'Connell, Cal Hendersen, Michael Semb Wever

Constructor Summary
HTMLFilter()
          Default constructor.
HTMLFilter(boolean debug)
          Set debug flag to true.
HTMLFilter(java.util.Map<java.lang.String,java.lang.Object> configuration)
          Map-parameter configurable constructor.
 
Method Summary
static java.lang.String chr(int decimal)
           
 java.lang.String filter(java.lang.String input)
          given a user submitted input String, filter out any invalid or restricted html.
static java.lang.String htmlSpecialChars(java.lang.String s)
           
 boolean isAlwaysMakeTags()
           
 boolean isStripComments()
           
 
Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

HTMLFilter

public HTMLFilter()
Default constructor.


HTMLFilter

public HTMLFilter(boolean debug)
Set debug flag to true. Otherwise use default settings. See the default constructor.

Parameters:
debug - turn debug on with a true argument

HTMLFilter

public HTMLFilter(java.util.Map<java.lang.String,java.lang.Object> configuration)
Map-parameter configurable constructor.

Parameters:
configuration - map containing configuration. keys match field names.
Method Detail

chr

public static java.lang.String chr(int decimal)

htmlSpecialChars

public static java.lang.String htmlSpecialChars(java.lang.String s)

filter

public java.lang.String filter(java.lang.String input)
given a user submitted input String, filter out any invalid or restricted html.

Parameters:
input - text (i.e. submitted by a user) than may contain html
Returns:
"clean" version of input, with only valid, whitelisted html elements allowed

isAlwaysMakeTags

public boolean isAlwaysMakeTags()

isStripComments

public boolean isStripComments()