/** * Jooby https://jooby.io * Apache License Version 2.0 https://jooby.io/LICENSE.txt * Copyright 2014 Edgar Espina */ package io.jooby; import org.unbescape.html.HtmlEscape; import org.unbescape.javascript.JavaScriptEscape; import org.unbescape.json.JsonEscape; import org.unbescape.uri.UriEscape; import org.unbescape.xml.XmlEscape; import javax.annotation.Nullable; /** * Set of escaping routines for fixing cross-site scripting (XSS). */ public final class XSS { private XSS() { } /** *

* Perform am URI path escape operation * on a String input using UTF-8 as encoding. *

*

* The following are the only allowed chars in an URI path (will not be escaped): *

* *

* All other chars will be escaped by converting them to the sequence of bytes that * represents them in the UTF-8 and then representing each byte * in %HH syntax, being HH the hexadecimal representation of the byte. *

*

* This method is thread-safe. *

* * @param value the String to be escaped. * @return The escaped result String. As a memory-performance improvement, will return the exact * same object as the text input argument if no escaping modifications were required (and * no additional String objects will be created during processing). Will * return null if input is null. */ public static @Nullable String uri(@Nullable String value) { return UriEscape.escapeUriPath(value); } /** *

* Perform an HTML5 level 2 (result is ASCII) escape operation on a String input. *

*

* Level 2 means this method will escape: *

* *

* This escape will be performed by replacing those chars by the corresponding HTML5 Named Character References * (e.g. '´') when such NCR exists for the replaced character, and replacing by a decimal * character reference (e.g. 'ₙ') when there there is no NCR for the replaced character. *

*

* This method is thread-safe. *

* * @param value the String to be escaped. * @return The escaped result String. As a memory-performance improvement, will return the exact * same object as the text input argument if no escaping modifications were required (and * no additional String objects will be created during processing). Will * return null if input is null. */ public static @Nullable String html(@Nullable String value) { return HtmlEscape.escapeHtml5(value); } /** *

* Perform a JavaScript level 2 (basic set and all non-ASCII chars) escape operation * on a String input. *

*

* Level 2 means this method will escape: *

* *

* This escape will be performed by using the Single Escape Chars whenever possible. For escaped * characters that do not have an associated SEC, default to using \xFF Hexadecimal Escapes * if possible (characters <= U+00FF), then default to \uFFFF * Hexadecimal Escapes. This type of escape produces the smallest escaped string possible. *

*

* This method is thread-safe. *

* * @param value the String to be escaped. * @return The escaped result String. As a memory-performance improvement, will return the exact * same object as the text input argument if no escaping modifications were required (and * no additional String objects will be created during processing). Will * return null if input is null. */ public static @Nullable String javaScript(@Nullable String value) { return JavaScriptEscape.escapeJavaScript(value); } /** *

* Perform a JSON level 2 (basic set and all non-ASCII chars) escape operation * on a String input. *

*

* Level 2 means this method will escape: *

* *

* This escape will be performed by using the Single Escape Chars whenever possible. For escaped * characters that do not have an associated SEC, default to \uFFFF * Hexadecimal Escapes. *

*

* This method is thread-safe. *

* * @param value the String to be escaped. * @return The escaped result String. As a memory-performance improvement, will return the exact * same object as the text input argument if no escaping modifications were required (and * no additional String objects will be created during processing). Will * return null if input is null. */ public static @Nullable String json(@Nullable String value) { return JsonEscape.escapeJson(value); } /** *

* Perform an XML 1.1 level 2 (markup-significant and all non-ASCII chars) escape operation * on a String input. *

*

* Level 2 means this method will escape: *

* *

* This escape will be performed by replacing those chars by the corresponding XML Character Entity References * (e.g. '&lt;') when such CER exists for the replaced character, and replacing by a hexadecimal * character reference (e.g. '&#x2430;') when there there is no CER for the replaced character. *

*

* This method is thread-safe. *

* * @param value the String to be escaped. * @return The escaped result String. As a memory-performance improvement, will return the exact * same object as the text input argument if no escaping modifications were required (and * no additional String objects will be created during processing). Will * return null if input is null. */ public static @Nullable String xml(@Nullable String value) { return XmlEscape.escapeXml11(value); } }