Package org.cyclos.impl.utils

Class HtmlSanitizerPolicy

java.lang.Object

org.cyclos.impl.utils.HtmlSanitizerPolicy

public class HtmlSanitizerPolicy
extends Object

Based on the AntiSamy EBay example.

eBay (http://www.ebay.com/) is the most popular online auction site in the universe, as far as I can tell. It is a public site so anyone is allowed to post listings with rich HTML content. It's not surprising that given the attractiveness of eBay as a target that it has been subject to a few complex XSS attacks. Listings are allowed to contain much more rich content than, say, Slashdot- so it's attack surface is considerably larger. The following tags appear to be accepted by eBay (they don't publish rules): <a>,...

Constructor Summary

Constructors

Constructor	Description
HtmlSanitizerPolicy()

Method Summary

Modifier and Type	Method	Description
static org.owasp.html.PolicyFactory	adminsPolicy()	Returns a policy suitable for administrators
static org.owasp.html.PolicyFactory	usersPolicy()	Returns a policy suitable for users

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

HtmlSanitizerPolicy

public HtmlSanitizerPolicy()

Method Detail

adminsPolicy

public static org.owasp.html.PolicyFactory adminsPolicy()

Returns a policy suitable for administrators

usersPolicy

public static org.owasp.html.PolicyFactory usersPolicy()

Returns a policy suitable for users