com.bea.p13n.util.encoding
Class EncodingUtil

java.lang.Object
  com.bea.p13n.util.encoding.EncodingUtil

public class EncodingUtil
extends Object

Constructor Summary

EncodingUtil()

Method Summary

static String	decodeXSS(String text) This helper method can be used to reverse the encoding done in encodeXSS(java.lang.String).
static String	encodeXSS(String text) This helper method can be used to help prevent Cross Site Scripting vulnerabilities.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

EncodingUtil

public EncodingUtil()

Method Detail

encodeXSS

public static String encodeXSS(String text)

This helper method can be used to help prevent Cross Site Scripting vulnerabilities. Any Servlet or JSP which sends user input (eg. query parameters in HTTP requests) to be rendered into a user's browser needs to use this method to encode the user input. This ensures that any HTML in their input (either malicious or otherwise) is not executed by the browser. This is achieved by converting characters to their HTML escaped form. For example, '&' is converted to '&'.

A full description of Cross Site Scripting (XSS) vulnerabilities can be found at http://www.cert.org/tech_tips/malicious_code_mitigation.html. Dictates the following character encoding:

Character	Encoding
"	"
%	%
&	&
'	'
(	(
)	)
+	+
;	&#59;
<	&#60;
>	&#62;
?	&#63;

Taken from Utils.

Parameters

text - dynamic text which is going to be encoded and sent as html (eg. URL)

Returns

encoded text - returns null for null text param

decodeXSS

public static String decodeXSS(String text)

This helper method can be used to reverse the encoding done in encodeXSS(java.lang.String).

Parameters

text - dynamic text which is going to be decoded

Returns

encoded text - returns null for null text param