Difference between revisions of "OWASP Java Encoder Project"

Contextual Output Encoding

<body><%= Encode.forHtml(UNTRUSTED) %></body>

<textarea name="text"><%= Encode.forHtmlContent(UNTRUSTED) %></textarea>

<input type="text" name="address" value="<%= Encode.forHtmlAttribute(UNTRUSTED) %>" />

<div style="width:<= Encode.forCssString(UNTRUSTED) %>">
<div style="background:<= Encode.forCssUrl(UNTRUSTED) %>">

 <script type="text/javascript">
 var msg = "<%= Encode.forJavaScriptBlock(UNTRUSTED) %>";
 alert(msg);
 </script>

 <button 
 onclick="alert('<%= Encode.forJavaScriptAttribute(UNTRUSTED) %>');">
 click me</button>

<a href="/search?value=<%= Encode.forUriComponent(UNTRUSTED) %>&order=1#top">

<a href="/page/<%= Encode.forUriComponent(UNTRUSTED) %>">

String url = validateURL(untrustedInput);

 <a href="<%= Encode.forHtmlAttribute(untrustedUrl) %>">
 <%= Encode.forHtmlContent(untrustedLinkName) %>
 </a>

<%@page contentType="text/html" pageEncoding="UTF-8"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
   "http://www.w3.org/TR/html4/loose.dtd">
<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>
<html>
   <head>
       <title><e:forHtml value="${param.title}" /></title>
   </head>
   <body>
       <h1>${e:forHtml(param.data)}</h1>
   </body>
</html>

<dependency>
   <groupId>org.owasp.encoder</groupId>
   <artifactId>encoder</artifactId>
   <version>1.2</version>
</dependency>

<dependency>
   <groupId>org.owasp.encoder</groupId>
   <artifactId>encoder-jsp</artifactId>
   <version>1.2</version>
</dependency>

<input value="this is the value">
<input value=`this is the value`>

<div id=a><input value="``onmouseover=alert(1)"></div> 
<div id=b></div>
<script>b.innerHTML=a.innerHTML</script>

<input value=``onmouseover=alert(1)>

<input value="" onmouseover="alert(1)">

<input value="``onmouseover=alert(1)">

<script>a.innerHTML=b.innerHTML.replace(/`/g, "`");</script>

<input value=&#96;&#96;onmouseover=alert(1)>

@@ Line 18: / Line 18: @@
 ==Quick Overview==
-The OWASP Java Encoder library is intended for quick contextual encoding with very little overhead, either in performance or usage. To get started, simply add the encoder-1.2.jar, import org.owasp.encoder.Encode and start encoding.
+The OWASP Java Encoder library is intended for quick contextual encoding with very little overhead, either in performance or usage. To get started, simply add the encoder-1.2.1.jar, import org.owasp.encoder.Encode and start encoding.
-Please look at the [http://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder/1.2/encoder-1.2-javadoc.jar javadoc for Encode] to see the variety of contexts for which you can encode. Tag libraries and JSP EL functions can be found in the encoder-jsp-1.2.jar.
+Please look at the [http://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder/1.2/encoder-1.2-javadoc.jar javadoc for Encode] to see the variety of contexts for which you can encode. Tag libraries and JSP EL functions can be found in the encoder-jsp-1.2.1.jar.
 Happy Encoding!
@@ Line 70: / Line 70: @@
 == News and Events ==
+* [19 February 2017] 1.1.1 Released!
 * [11 June 2016] No reported issues and library use is strong!
 * [1 May 2015] Moved to GitHub
@@ Line 172: / Line 173: @@
 = Deploy the Java Encoder Project =
-The OWASP Java Encoder version 1.2 is now available in central!
+The OWASP Java Encoder version 1.2.1 is now available in central!
 [http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.owasp.encoder%22 OWASP Encoder at Maven Central].

Difference between revisions of "OWASP Java Encoder Project"

Revision as of 18:52, 19 February 2017

OWASP Java Encoder Project

Introduction

Quick Overview

Licensing

What is this?

Important Links

Mailing List

Project Leaders

Related Projects

Quick Download

News and Events

In Print

Classifications

Navigation menu

Search