java.lang.Object
javax.servlet.ServletRequestWrapper
javax.servlet.http.HttpServletRequestWrapper
net.i2p.servlet.filters.XSSRequestWrapper
All Implemented Interfaces:
HttpServletRequest, ServletRequest
public class XSSRequestWrapperextends HttpServletRequestWrapper
Request wrapper to prevent XSS attacks.

  • Field Details

    • NON_WIN_PATTERN

      private static final String NON_WIN_PATTERN
      Whitelist of characters allowed in a parameter value, adapted from the OWASP ESAPI validation patterns. See also: ESAPI.properties
      See Also:

    • WIN_PATTERN

      private static final String WIN_PATTERN
      As above, with backslash added for Windows paths.
      See Also:

    • parameterValuePattern

      private static final Pattern parameterValuePattern
      Compiled whitelist for parameter values.

    • headerValuePattern

      private static final Pattern headerValuePattern
      Whitelist for header values, ASCII letters and common punctuation.

    • NOFILTER

      private static final String NOFILTER
      Parameter prefix marking a value to pass through unfiltered.
      See Also:

  • Constructor Details

    • XSSRequestWrapper

      public XSSRequestWrapper(HttpServletRequest servletRequest)
      Wraps a request so its parameters and headers are filtered of XSS payloads.
      Parameters:
      servletRequest - the request being wrapped, whose parameters and headers are filtered

  • Method Details