| | |
|---|
| | | import org.jsoup.safety.Cleaner; |
|---|
| | | import org.jsoup.safety.Whitelist; |
|---|
| | | |
|---|
| | | import com.google.inject.Inject; |
|---|
| | | import com.google.inject.Singleton; |
|---|
| | | |
|---|
| | | /** |
|---|
| | | * Implementation of an XSS filter based on JSoup. |
|---|
| | | * |
|---|
| | | * @author James Moger |
|---|
| | | * |
|---|
| | | */ |
|---|
| | | @Singleton |
|---|
| | | public class JSoupXssFilter implements XssFilter { |
|---|
| | | |
|---|
| | | private final Cleaner none; |
|---|
| | | |
|---|
| | | private final Cleaner relaxed; |
|---|
| | | |
|---|
| | | @Inject |
|---|
| | | public JSoupXssFilter() { |
|---|
| | | none = new Cleaner(Whitelist.none()); |
|---|
| | | relaxed = new Cleaner(getRelaxedWhiteList()); |
|---|
| | |
|---|
| | | "sub", "sup", "table", "tbody", "td", "tfoot", "th", "thead", "tr", "tt", "u", |
|---|
| | | "ul", "var") |
|---|
| | | |
|---|
| | | .addAttributes("a", "href", "title") |
|---|
| | | .addAttributes("a", "class", "href", "style", "target", "title") |
|---|
| | | .addAttributes("blockquote", "cite") |
|---|
| | | .addAttributes("col", "span", "width") |
|---|
| | | .addAttributes("colgroup", "span", "width") |
|---|
| | | .addAttributes("div", "class", "style") |
|---|
| | | .addAttributes("img", "align", "alt", "height", "src", "title", "width") |
|---|
| | | .addAttributes("ol", "start", "type") |
|---|
| | | .addAttributes("q", "cite") |
|---|
| | | .addAttributes("table", "summary", "width") |
|---|
| | | .addAttributes("td", "abbr", "axis", "colspan", "rowspan", "width") |
|---|
| | | .addAttributes("th", "abbr", "axis", "colspan", "rowspan", "scope", "width") |
|---|
| | | .addAttributes("span", "class", "style") |
|---|
| | | .addAttributes("table", "class", "style", "summary", "width") |
|---|
| | | .addAttributes("td", "abbr", "axis", "class", "colspan", "rowspan", "style", "width") |
|---|
| | | .addAttributes("th", "abbr", "axis", "class", "colspan", "rowspan", "scope", "style", "width") |
|---|
| | | .addAttributes("ul", "type") |
|---|
| | | |
|---|
| | | .addEnforcedAttribute("a", "rel", "nofollow") |
|---|
