cn.luues.tool.http

类 HTMLFilter

java.lang.Object

cn.luues.tool.http.HTMLFilter

public final class HTMLFilter
extends Object

HTML过滤器，用于去除XSS(Cross Site Scripting) 漏洞隐患。

此类中的方法非线程安全

     String clean = new HTMLFilter().filter(input);
 

此类来自：http://xss-html-filter.sf.net

作者:

Joseph O'Connell, Cal Hendersen, Michael Semb Wever

字段概要

字段

限定符和类型	字段和说明
private boolean	alwaysMakeTags flag determining whether to try to make tags when presented with "unbalanced" angle brackets (e.g.
private boolean	encodeQuotes
private static Pattern	P_AMP
private static Pattern	P_BODY_TO_END
private static Pattern	P_BOTH_ARROWS
private static Pattern	P_COMMENT
private static Pattern	P_COMMENTS
private static Pattern	P_ENCODE
private static Pattern	P_END_ARROW
private static Pattern	P_END_TAG
private static Pattern	P_ENTITY
private static Pattern	P_ENTITY_UNICODE
private static Pattern	P_LEFT_ARROW
private static Pattern	P_PROTOCOL
private static Pattern	P_QUOTE
private static Pattern	P_QUOTED_ATTRIBUTES
private static ConcurrentMap<String,Pattern>	P_REMOVE_PAIR_BLANKS
private static ConcurrentMap<String,Pattern>	P_REMOVE_SELF_BLANKS
private static Pattern	P_RIGHT_ARROW
private static Pattern	P_START_TAG
private static Pattern	P_STRAY_LEFT_ARROW
private static Pattern	P_STRAY_RIGHT_ARROW
private static Pattern	P_TAGS
private static Pattern	P_UNQUOTED_ATTRIBUTES
private static Pattern	P_VALID_ENTITIES
private static Pattern	P_VALID_QUOTES
private static Pattern	P_XML_CONTENT
private static int	REGEX_FLAGS_SI regex flag union representing /si modifiers in php
private boolean	stripComment flag determining whether comments are allowed in input String.
private Map<String,List<String>>	vAllowed set of allowed html elements, along with allowed attributes for each element
private String[]	vAllowedEntities entities allowed within html markup
private String[]	vAllowedProtocols allowed protocols
private boolean	vDebug
private String[]	vDisallowed set of disallowed html elements
private String[]	vNeedClosingTags html elements which must always have separate opening and closing tags (e.g.
private String[]	vProtocolAtts attributes which should be checked for valid protocols
private String[]	vRemoveBlanks tags which should be removed if they contain no content (e.g.
private String[]	vSelfClosingTags html elements which must always be self-closing (e.g.
private Map<String,Integer>	vTagCounts counts of open tags for each (allowable) html element

构造器概要

构造器

构造器和说明
HTMLFilter() Default constructor.
HTMLFilter(boolean debug) Set debug flag to true.
HTMLFilter(Map<String,Object> conf) Map-parameter configurable constructor.

方法概要

限定符和类型	方法和说明
private boolean	allowed(String name)
private boolean	allowedAttribute(String name, String paramName)
private String	balanceHTML(String s)
private String	checkEntity(String preamble, String term)
private String	checkTags(String s)
static String	chr(int decimal)
private void	debug(String msg)
private String	decodeEntities(String s)
private String	encodeQuotes(String s)
private String	escapeComments(String s)
String	filter(String input) given a user submitted input String, filter out any invalid or restricted html.
static String	htmlSpecialChars(String s)
private static boolean	inArray(String s, String[] array)
boolean	isAlwaysMakeTags()
boolean	isStripComments()
private boolean	isValidEntity(String entity)
private String	processParamProtocol(String s)
private String	processRemoveBlanks(String s)
private String	processTag(String s)
private static String	regexReplace(Pattern regex_pattern, String replacement, String s)
private void	reset()
private String	validateEntities(String s)

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

字段详细资料

REGEX_FLAGS_SI

private static final int REGEX_FLAGS_SI

regex flag union representing /si modifiers in php

另请参阅:

常量字段值

P_COMMENTS

private static final Pattern P_COMMENTS

P_COMMENT

private static final Pattern P_COMMENT

P_TAGS

private static final Pattern P_TAGS

P_END_TAG

private static final Pattern P_END_TAG

P_START_TAG

private static final Pattern P_START_TAG

P_QUOTED_ATTRIBUTES

private static final Pattern P_QUOTED_ATTRIBUTES

P_UNQUOTED_ATTRIBUTES

private static final Pattern P_UNQUOTED_ATTRIBUTES

P_PROTOCOL

private static final Pattern P_PROTOCOL

P_ENTITY

private static final Pattern P_ENTITY

P_ENTITY_UNICODE

private static final Pattern P_ENTITY_UNICODE

P_ENCODE

private static final Pattern P_ENCODE

P_VALID_ENTITIES

private static final Pattern P_VALID_ENTITIES

P_VALID_QUOTES

private static final Pattern P_VALID_QUOTES

P_END_ARROW

private static final Pattern P_END_ARROW

P_BODY_TO_END

private static final Pattern P_BODY_TO_END

P_XML_CONTENT

private static final Pattern P_XML_CONTENT

P_STRAY_LEFT_ARROW

private static final Pattern P_STRAY_LEFT_ARROW

P_STRAY_RIGHT_ARROW

private static final Pattern P_STRAY_RIGHT_ARROW

P_AMP

private static final Pattern P_AMP

P_QUOTE

private static final Pattern P_QUOTE

P_LEFT_ARROW

private static final Pattern P_LEFT_ARROW

P_RIGHT_ARROW

private static final Pattern P_RIGHT_ARROW

P_BOTH_ARROWS

private static final Pattern P_BOTH_ARROWS

P_REMOVE_PAIR_BLANKS

private static final ConcurrentMap<String,Pattern> P_REMOVE_PAIR_BLANKS

P_REMOVE_SELF_BLANKS

private static final ConcurrentMap<String,Pattern> P_REMOVE_SELF_BLANKS

vAllowed

private final Map<String,List<String>> vAllowed

set of allowed html elements, along with allowed attributes for each element

vTagCounts

private final Map<String,Integer> vTagCounts

counts of open tags for each (allowable) html element

vSelfClosingTags

private final String[] vSelfClosingTags

html elements which must always be self-closing (e.g. "<img />")

vNeedClosingTags

private final String[] vNeedClosingTags

html elements which must always have separate opening and closing tags (e.g. "<b></b>")

vDisallowed

private final String[] vDisallowed

set of disallowed html elements

vProtocolAtts

private final String[] vProtocolAtts

attributes which should be checked for valid protocols

vAllowedProtocols

private final String[] vAllowedProtocols

allowed protocols

vRemoveBlanks

private final String[] vRemoveBlanks

tags which should be removed if they contain no content (e.g. "<b></b>" or "<b />")

vAllowedEntities

private final String[] vAllowedEntities

entities allowed within html markup

stripComment

private final boolean stripComment

flag determining whether comments are allowed in input String.

encodeQuotes

private final boolean encodeQuotes

vDebug

private boolean vDebug

alwaysMakeTags

private final boolean alwaysMakeTags

flag determining whether to try to make tags when presented with "unbalanced" angle brackets (e.g. "<b text </b>" becomes "<b> text </g>"). If set to false, unbalanced angle brackets will be html escaped.

构造器详细资料

HTMLFilter

public HTMLFilter()

Default constructor.

HTMLFilter

public HTMLFilter(boolean debug)

Set debug flag to true. Otherwise use default settings. See the default constructor.

参数:

debug - turn debug on with a true argument

HTMLFilter

public HTMLFilter(Map<String,Object> conf)

Map-parameter configurable constructor.

参数:

conf - map containing configuration. keys match field names.

方法详细资料

reset

private void reset()

debug

private void debug(String msg)

chr

public static String chr(int decimal)

htmlSpecialChars

public static String htmlSpecialChars(String s)

filter

public String filter(String input)

given a user submitted input String, filter out any invalid or restricted html.

参数:

input - text (i.e. submitted by a user) than may contain html

返回:

"clean" version of input, with only valid, whitelisted html elements allowed

isAlwaysMakeTags

public boolean isAlwaysMakeTags()

isStripComments

public boolean isStripComments()

escapeComments

private String escapeComments(String s)

balanceHTML

private String balanceHTML(String s)

checkTags

private String checkTags(String s)

processRemoveBlanks

private String processRemoveBlanks(String s)

regexReplace

private static String regexReplace(Pattern regex_pattern,
                                   String replacement,
                                   String s)

processTag

private String processTag(String s)

processParamProtocol

private String processParamProtocol(String s)

decodeEntities

private String decodeEntities(String s)

validateEntities

private String validateEntities(String s)

encodeQuotes

private String encodeQuotes(String s)

checkEntity

private String checkEntity(String preamble,
                           String term)

isValidEntity

private boolean isValidEntity(String entity)

inArray

private static boolean inArray(String s,
                               String[] array)

allowed

private boolean allowed(String name)

allowedAttribute

private boolean allowedAttribute(String name,
                                 String paramName)