@ParametersAreNonnullByDefault public final class UnsafeSanitizedContentOrdainer extends Object
Creating a SanitizedContent object is potentially dangerous, as it means you're swearing in advance the content won't cause a cross site scripting vulnerability. In the long term it is nearly impossible to show that any piece of code will always produce safe content -- for example, a parameter that is safe one day may be vulnerable after a refactoring that uses it in a different way.
We suggest you limit your usage of this to just a few files in your code base. Create a small set of utility files that generate and sanitize at the same time. Example utilities:
| Modifier and Type | Method and Description |
|---|---|
static SanitizedContent |
ordainAsSafe(String value,
SanitizedContent.ContentKind kind)
Faithfully assumes the provided value is "safe" and marks it not to be re-escaped.
|
static SanitizedContent |
ordainAsSafe(String value,
SanitizedContent.ContentKind kind,
Dir dir)
Faithfully assumes the provided value is "safe" and marks it not to be re-escaped.
|
public static SanitizedContent ordainAsSafe(String value, SanitizedContent.ContentKind kind)
When you "ordain" a string as safe content, it means that Soy will NOT re-escape or validate the contents if printed in the relevant context. You can use this to insert known-safe HTML into a template via a parameter.
This doesn't do a lot of strict checking, but makes it easier to differentiate safe constants in your code.
public static SanitizedContent ordainAsSafe(String value, SanitizedContent.ContentKind kind, @Nullable Dir dir)
When you "ordain" a string as safe content, it means that Soy will NOT re-escape or validate the contents if printed in the relevant context. You can use this to insert known-safe HTML into a template via a parameter.
This doesn't do a lot of strict checking, but makes it easier to differentiate safe constants in your code.