|
|
| Line 1: |
Line 1: |
| − | = Main =
| |
| − |
| |
| − | <b>Welcome to the OWASP Java Encoder Project</b>
| |
| − |
| |
| − | <i>Contextual Output Encoding</i> is a computer programming technique necessary to stop [https://www.owasp.org/index.php/XSS_Prevention_Cheat_Sheet Cross Site Scripting]. This project is a Java 1.5 simple-to-use drop-in high-performance encoder class with little baggage.
| |
| − |
| |
| | {{Template:<includeonly>{{{1}}}</includeonly><noinclude>Project About</noinclude> | | {{Template:<includeonly>{{{1}}}</includeonly><noinclude>Project About</noinclude> |
| | | | |
| Line 56: |
Line 50: |
| | | project_about_page = Projects/OWASP Java Encoder Project | | | project_about_page = Projects/OWASP Java Encoder Project |
| | }} | | }} |
| − |
| |
| − | = Use the Java Encoder Project =
| |
| − |
| |
| − | The general API pattern to utilize the Java Encoder Project is
| |
| − | <b>"Encode.forContextName(untrustedData)"</b>, where "ContextName" is the
| |
| − | name of the target context and "untrustedData" in untrusted user input.
| |
| − |
| |
| − | == For example, to use in a JSP ==
| |
| − |
| |
| − | <b><input type="text" name="data" value="<%=
| |
| − | Encode.forHtmlAttribute(dataValue) %>" /></b>
| |
| − |
| |
| − | <b><textarea name="text"><%= Encode.forHtmlContent(textValue) %>" /></b>
| |
| − |
| |
| − | Generally <b>Encode.forHtml(...)</b> is safe but slightly less efficient for
| |
| − | the above two contexts (since it encodes more characters than
| |
| − | necessary).
| |
| − |
| |
| − | == For JavaScript string data ==
| |
| − |
| |
| − | <b><button onclick="alert('<%= Encode.forJavaScriptAttribute(alertMsg)
| |
| − | %>');">click me</button></b>
| |
| − |
| |
| − | <b>
| |
| − | <script type="text/javascript">
| |
| − | var msg = "<%= Encode.forJavaScriptBlock(message) %>";
| |
| − | alert(msg);
| |
| − | </script>
| |
| − | </b>
| |
| − |
| |
| − | Again generally Encode.forJavaScript is safe for the above two
| |
| − | context, but slightly less efficient since it encodes more characters.
| |
| − |
| |
| − | == Other Contexts ==
| |
| − |
| |
| − | Other contexts can be found in the org.owasp.Encode class methods,
| |
| − | including CSS strings, CSS urls, XML contexts, URIs and URI
| |
| − | components.
| |
| − |
| |
| − | = Build the Java Encoder Project =
| |
| − |
| |
| − | <b>checkout and run "mvn package" (using maven 2.0 or 3.0)</b>
| |
| − |
| |
| − | __NOTOC__ <headertabs />
| |
