SecureEncoder contains many methods for manipulating untrusted data Strings into RFC-Compliant Strings for a given context by encoding “bad” data into the proper format.
This class does not have a constructor, so you cannot create it directly.
| Method | Description |
|---|---|
| static forHtmlContent(String) | Encodes a given input for use in a general HTML context. |
| static forHtmlInDoubleQuoteAttribute(String) | Encodes a given input for use in an HTML Attribute guarded by a double quote. |
| static forHtmlInSingleQuoteAttribute(String) | Encodes a given input for use in an HTML Attribute guarded by a single quote. |
| static forHtmlUnquotedAttribute(String) | Encodes a given input for use in an HTML Attribute left unguarded. |
| static forJSONValue(String) | Encodes a given input for use in a JSON Object Value to prevent escaping into a trusted context. |
| static forJavaScriptInAttribute(String) | Encodes a given input for use in JavaScript inside an HTML attribute. |
| static forJavaScriptInBlock(String) | Encodes a given input for use in JavaScript inside an HTML block. |
| static forJavaScriptInHTML(String) | Encodes a given input for use in JavaScript inside an HTML context. |
| static forJavaScriptInSource(String) | Encodes a given input for use in JavaScript inside a JavaScript source file. |
| static forUriComponent(String) | Encodes a given input for use as a component of a URI. |
| static forUriComponentStrict(String) | Encodes a given input for use as a component of a URI. |
| static forXmlCommentContent(String) | Encodes a given input for use in an XML comments. |
| static forXmlContent(String) | Encodes a given input for use in a general XML context. |
| static forXmlInDoubleQuoteAttribute(String) | Encodes a given input for use in an XML attribute guarded by a double quote. |
| static forXmlInSingleQuoteAttribute(String) | Encodes a given input for use in an XML attribute guarded by a single quote. |
assign, create, create, defineProperties, defineProperty, entries, freeze, fromEntries, getOwnPropertyDescriptor, getOwnPropertyNames, getOwnPropertySymbols, getPrototypeOf, hasOwnProperty, is, isExtensible, isFrozen, isPrototypeOf, isSealed, keys, preventExtensions, propertyIsEnumerable, seal, setPrototypeOf, toLocaleString, toString, valueOf, values
Encodes a given input for use in a general HTML context. E.g. text content and text attributes. This method takes the UNION of allowed characters between the two context, so may be more imprecise that the more specific contexts. Generally, this method is preferred unless you specifically understand the context in which untrusted data will be output.
Example Usage:
1<div>${SecureEncoder.forHtmlContent(unsafeData)}</div>
2
3<input value="${SecureEncoder.forHtmlContent(unsafeData)}" />Flow:
Parameters:
Returns:
Encodes a given input for use in an HTML Attribute guarded by a double quote. This method is preferred if you understand exactly how the output of this will be used in the HTML document.
Example Usage:
1<div id="${SecureEncoder.forHtmlInDoubleQuoteAttribute(unsafeData)}"></div>Flow:
Parameters:
Returns:
Encodes a given input for use in an HTML Attribute guarded by a single quote. This method is preferred if you understand exactly how the output of this will be used in the HTML document.
Example Usage:
1<div id='${SecureEncoder.forHtmlInSingleQuoteAttribute(unsafeData)}'></div>Flow:
Parameters:
Returns:
Encodes a given input for use in an HTML Attribute left unguarded. This method is preferred if you understand exactly how the output of this will be used in the HTML document.
Example Usage:
1<div id=${SecureEncoder.forHtmlUnquotedAttribute(unsafeData)}></div>Flow:
Parameters:
Returns:
Encodes a given input for use in a JSON Object Value to prevent escaping into a trusted context.
Example Usage:
1var json = {"trusted_data" : SecureEncoder.forJSONValue(unsafeData)};
2return JSON.stringify(json);Flow:
Parameters:
Returns:
Encodes a given input for use in JavaScript inside an HTML attribute. This method is preferred if you understand exactly how the output of the will be used in the page
Example Usage:
1<button onclick="alert('${SecureEncoder.forJavaScriptInAttribute(unsafeData)}');">Flow:
Parameters:
Returns:
Encodes a given input for use in JavaScript inside an HTML block. This method is preferred if you understand exactly how the output of the will be used in the page
Example Usage:
1<script type="text/javascript">
2 var data = "${SecureEncoder.forJavaScriptInBlock(unsafeData)}";
3</script>Flow:
Parameters:
Returns:
Encodes a given input for use in JavaScript inside an HTML context. This method takes the UNION of allowed characters among the other contexts, so may be more imprecise that the more specific contexts. Generally, this method is preferred unless you specifically understand the context in which untrusted data will be output.
Example Usage:
1<script type="text/javascript">
2 var data = "${SecureEncoder.forJavaScriptInHTML(unsafeData)}";
3</script>
4
5<button onclick="alert('${SecureEncoder.forJavaScriptInHTML(unsafeData)}');">Flow:
Parameters:
Returns:
Encodes a given input for use in JavaScript inside a JavaScript source file. This method is preferred if you understand exactly how the output of the will be used in the page
Example Usage:
1<...inside foobar.js...>
2var data = "${SecureEncoder.forJavaScriptInSource(unsafeData)}";Flow:
Parameters:
Returns:
Encodes a given input for use as a component of a URI. This is equivalent to javascript's encodeURIComponent and does a realistic job of encoding.
Example Usage:
1<a href="http://host.com?value=${SecureEncoder.forUriComponent(unsafeData)}"/>Allows:
1A-Z, a-z, 0-9, -, _, ., ~, !, *, ', (, )Flow:
Parameters:
Returns:
Encodes a given input for use as a component of a URI. This is a strict encoder and fully complies with RFC3986.
Example Usage:
1<a href="http://host.com?value=${SecureEncoder.forUriComponentStrict(unsafeData)}"/>Allows:
1A-Z, a-z, 0-9, -, _, ., ~Flow:
Parameters:
Returns:
Encodes a given input for use in an XML comments. This method is preferred if you understand the context in which untrusted data will be output.
Note: It is recommended that you use a real parser, as this method can be misused, but is left here if a parser is unavailable to you
Example Usage:
1<!-- ${SecureEncoder.forXmlCommentContent(unsafeData)} -->Flow:
Parameters:
Returns:
Encodes a given input for use in a general XML context. E.g. text content and text attributes. This method takes the UNION of allowed characters between the other contexts, so may be more imprecise that the more specific contexts. Generally, this method is preferred unless you specifically understand the context in which untrusted data will be output.
Note: It is recommended that you use a real parser, as this method can be misused, but is left here if a parser is unavailable to you
Example Usage:
1<foo>${SecureEncoder.forXmlContent(unsafeData)}</foo>
2
3<bar attr="${SecureEncoder.forXmlContent(unsafeData)}"></bar>Flow:
Parameters:
Returns:
Encodes a given input for use in an XML attribute guarded by a double quote. This method is preferred if you understand the context in which untrusted data will be output.
Note: It is recommended that you use a real parser, as this method can be misused, but is left here if a parser is unavailable to you
Example Usage:
1<bar attr="${SecureEncoder.forXmlInDoubleQuoteAttribute(unsafeData)}"></bar>Flow:
Parameters:
Returns:
Encodes a given input for use in an XML attribute guarded by a single quote. This method is preferred if you understand the context in which untrusted data will be output.
Note: It is recommended that you use a real parser, as this method can be misused, but is left here if a parser is unavailable to you
Example Usage:
1<bar attr='${SecureEncoder.forXmlInSingleQuoteAttribute(unsafeData)}'></bar>Flow:
Parameters:
Returns:
j