Package overit.geocall.ui.cleaner

Class Cleaner

java.lang.Object
overit.geocall.ui.cleaner.Cleaner
All Implemented Interfaces:
Serializable
Direct Known Subclasses:
HtmlCleaner, NoneCleaner, RtfCleaner, TextCleaner, XmlCleaner
public abstract class Cleaner extends Object implements Serializable
Abstract class that must be extended to implements a Cleaner object, i.e. the object that perform the input sanitization to prevent the cross site scripting attacks
See Also:

  • Constructor Summary

    Constructors
    Constructor
    Description
    Cleaner()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    String
    clean(String html)
    Makes the sanitization of the string passed as parameter.
    static final Cleaner
    html()
    html cleaner provider for a single thread
    static final Cleaner
    none()
    dumb cleaner provider for a single thread
    abstract String
    quote(String html)
    Quotes the string passed as parameter, to prevent browser unwanted interpretation.
    static final Cleaner
    rtf()
    rtf cleaner provider for a single thread
    abstract Cleaner
    safeCopy()
    Deprecated.
    use equivalent static method Cleaner object
    static Cleaner
    safeInstance(String name)
    Factory that returns a cleaner based on the name and looking for it in the cleaner dictionary, defined in the system configuration.
    abstract String
    sift(String html)
    Sifts the string to find and remove insecure substrings.
    static final Cleaner
    text()
    text cleaner provider for a single thread
    protected String
    unQuote(String html)
    Unquotes the string passed as parameter.
    For example this method replace all "&lt;" with "<" ecc.
    static final Cleaner
    xml()
    xml cleaner provider for a single thread

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • Cleaner

      public Cleaner()

  • Method Details

    • text

      public static final Cleaner text()
      text cleaner provider for a single thread
      Returns:
      return a cleaner for text

    • xml

      public static final Cleaner xml()
      xml cleaner provider for a single thread
      Returns:
      return a cleaner for xml

    • none

      public static final Cleaner none()
      dumb cleaner provider for a single thread
      Returns:
      return a dumb cleaner

    • rtf

      public static final Cleaner rtf()
      rtf cleaner provider for a single thread
      Returns:
      return a cleaner for rtf

    • html

      public static final Cleaner html()
      html cleaner provider for a single thread
      Returns:
      return a cleaner for html

    • safeInstance

      public static Cleaner safeInstance(String name)
      Factory that returns a cleaner based on the name and looking for it in the cleaner dictionary, defined in the system configuration.
      Parameters:
      name - "none" to obtain a NoneCleaner, "text" to obtain a TextCleaner, "rtf" to obtain a RtfCleaner, "html" to obtain a HtmlCleaner
      Returns:
      A thread safe Cleraner

    • safeCopy

      @Deprecated public abstract Cleaner safeCopy()
      Deprecated.
      use equivalent static method Cleaner object
      Must returns a copy of this object totally independent of the original, only if the cleaning methodology was not thread safe
      Returns:
      A copy of the object totally independent of the original if the cleaning methodology was not thread safe

    • clean

      public String clean(String html)
      Makes the sanitization of the string passed as parameter. The sanitizaion process is composed by 2 phases: drop (to remove insecure substrings) and quote (to quote strings for the browser)
      Parameters:
      html - The string to be sanitized
      Returns:
      The sanitized string

    • sift

      public abstract String sift(String html)
      Sifts the string to find and remove insecure substrings.
      Parameters:
      html - The string to be sifted
      Returns:
      The string without the insecure substrings

    • quote

      public abstract String quote(String html)
      Quotes the string passed as parameter, to prevent browser unwanted interpretation.
      Parameters:
      html - The string to be quoted
      Returns:
      The quoted string

    • unQuote

      protected String unQuote(String html)
      Unquotes the string passed as parameter.
      For example this method replace all "&lt;" with "<" ecc.
      Parameters:
      html - The string to be unquoted.
      Returns:
      The unquoted string.