• Home
• javax.mvc
• javax.mvc-api
• 1.0-pfd
• source code
• Encoders.java

×

Project download

Many resources are needed to download a project. Please understand that we have to compensate our server costs. Thank you in advance.
Project price only 1 $

You can buy this project and download/modify it how often you want.

javax.mvc.security.Encoders Maven / Gradle / Ivy

/*
 * Copyright © 2017 Ivar Grimstad ([email protected])
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package javax.mvc.security;

/**
 * Interface that provides encoders to escape code in JavaScript, HTML,
 * etc. Encoding data is a way to prevent XSS attacks by ensuring it is not
 * misinterpreted as running code. Implementations of this interface are injectable
 * and accessible from EL via the {@link javax.mvc.MvcContext} class as {@code mvc.encoders}.
 *
 * @author Santiago Pericas-Geertsen
 * @see OWASP Encoder Project
 * @since 1.0
 */
public interface Encoders {

    /**
     * 
Encoding for JavaScript code in attributes or script blocks. It MUST support
     * encoding of (at least) the following characters:
     *
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
Input Character
Encoding
U+0008 (BS)
\b
U+0009 (HT)
\t
U+000A (LF)
\n
U+000C (FF)
\f
U+000D (CR)
\r
/
\/
\
\\
"
\x22
&
\x26
'
\x27
U+0000-U001F
\x##
     *
     * @param s string to encode.
     * @return encoded string.
     */
    String js(String s);

    /**
     * 
Encoding for HTML code in attributes or content. It MUST support encoding of
     * (at least) the following characters:
     *
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
     * 
Input Character
Encoding
&
&
<
&lt;
>
&gt;
"
&#34;
'
&#39;
     *
     * @param s string to encode.
     * @return encoded string.
     */
    String html(String s);
}