This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Projects/OWASP Java Encoder Project"
m |
m |
||
| Line 1: | Line 1: | ||
| − | = Main | + | = Main = |
{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Project About</noinclude> | {{Template:<includeonly>{{{1}}}</includeonly><noinclude>Project About</noinclude> | ||
| Line 48: | Line 48: | ||
}} | }} | ||
| − | = | + | = Build the Java Encoder Project = |
| − | <b> | + | <b>checkout and run "mvn package" (using maven 2.0 or 3.0)</b> |
| − | + | = Use the Java Encoder Project = | |
| − | |||
| − | |||
| − | + | The general API pattern to utilize the Java Encoder Project is | |
| + | <b>"Encode.forContextName(untrustedData)"<b>, where "ContextName" is the | ||
| + | name of the target context and "untrustedData" in untrusted user input. | ||
| + | |||
| + | For example, to use in a JSP: | ||
<input type="text" name="data" value="<%= | <input type="text" name="data" value="<%= | ||
Revision as of 20:05, 30 March 2012
| PROJECT INFO What does this OWASP project offer you? |
RELEASE(S) INFO What releases are available for this project? | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
| |||||||||||||||||||||||||||||||||||||||||||||||
checkout and run "mvn package" (using maven 2.0 or 3.0)
The general API pattern to utilize the Java Encoder Project is "Encode.forContextName(untrustedData)"<b>, where "ContextName" is the name of the target context and "untrustedData" in untrusted user input.
For example, to use in a JSP:
<input type="text" name="data" value="<%= Encode.forHtmlAttribute(dataValue) %>" />
<textarea name="text"><%= Encode.forHtmlContent(textValue) %>" />
Generally Encode.forHtml(...) is safe but slightly less efficient for the above two contexts (since it encodes more characters than necessary).
For JavaScript string data, here's some more examples:
<button onclick="alert('<%= Encode.forJavaScriptAttribute(alertMsg) %>');">click me</button>
<script type="text/javascript"> var msg = "<%= Encode.forJavaScriptBlock(message) %>"; alert(msg); </script>
Again generally Encode.forJavaScript is safe for the above two context, but slightly less efficient since it encodes more characters.
Other contexts can be found in the org.owasp.Encode class methods, including CSS strings, CSS urls, XML contexts, URIs and URI components. Additional contexts can be added before rel 1.0 if you have any ideas.
