Package org.exoplatform.commons.utils

Class HTMLSanitizer

java.lang.Object
org.exoplatform.commons.utils.HTMLSanitizer
public abstract class HTMLSanitizer extends Object
Prevent XSS/XEE attacks by encoding user HTML inputs. This class will be used to encode data in in presentation layer.

  • Field Details

    • IFRAME_ALLOWED_HOSTS_PROPERTY

      public static final String IFRAME_ALLOWED_HOSTS_PROPERTY
      System property holding the comma-separated host names an iframe src may point to. An entry *.example.com allows every sub-domain of example.com, at any depth, but not example.com itself. When set, it replaces DEFAULT_IFRAME_ALLOWED_HOSTS; set to an empty value, no iframe keeps its src. A deployment that points the editors at another oEmbed provider (io.meeds.iframely.url) lists that provider's iframe host here, together with the defaults it still needs.
      See Also:

    • DEFAULT_IFRAME_ALLOWED_HOSTS

      public static final List<String> DEFAULT_IFRAME_ALLOWED_HOSTS
      The embed hosts whose iframes are kept when IFRAME_ALLOWED_HOSTS_PROPERTY is not set: if-cdn.com, where the editors' default oEmbed provider (ckeditor.iframe.ly) hosts the iframe of the embeds it returns, YouTube's and SoundCloud's included; cdn.iframe.ly, iframely's API iframe; and the players of YouTube, Vimeo, Dailymotion and Calameo, for an iframe from those providers that does not come through iframely.

    • POLICY_DEFINITION

      public static final Function<org.owasp.html.HtmlStreamEventReceiver,org.owasp.html.HtmlSanitizer.Policy> POLICY_DEFINITION
      A policy definition that matches the minimal HTML that eXo allows.

  • Constructor Details

    • HTMLSanitizer

      public HTMLSanitizer()

  • Method Details

    • sanitize

      public static String sanitize(String html)
      This service reads HTML from input forms and writes sanitized content to a StringBuffer
      Parameters:
      html - The String object
      Returns:
      The sanitized HTML to store in DB layer

    • getAllowedIframeHosts

      public static List<String> getAllowedIframeHosts()
      Returns:
      the host names an iframe src may point to: the "io.meeds.sanitizer.iframe.allowedHosts" system property when set, else DEFAULT_IFRAME_ALLOWED_HOSTS

    • isAllowedIframeSrc

      public static boolean isAllowedIframeSrc(String src)
      Parameters:
      src - an iframe src value, entity-decoded
      Returns:
      true when it is an https or protocol-relative URL whose host is exactly one of getAllowedIframeHosts(), or a sub-domain of one of its *. entries