java.lang.Object
org.klomp.snark.web.RedirectQuery
public final class RedirectQueryextends Object
Validation for the numeric query strings used by the post/redirect/get pattern in the web UI.

A redirect query string is later handed to response.sendRedirect(); it must therefore only ever contain the known numeric parameters with integer values. Crafted input containing a scheme, host, or embedded HTML entity must be rejected so the redirect target can never be an external URL.

  • Constructor Details

    • RedirectQuery

      private RedirectQuery()
      Static class, no instances.

  • Method Details

    • isSafeRedirectQuery

      public static boolean isSafeRedirectQuery(String qs)
      Validate a redirect query string. It must be null/empty, or start with '?' and contain only the p, sort, st and search parameters with integer values separated by '&'. Anything else - a scheme, a host, a different parameter, or an embedded entity like "&" - is rejected.
      Parameters:
      qs - the query string, may be null or empty
      Returns:
      true if the query string is safe to redirect to

    • isValidNumeric

      public static boolean isValidNumeric(String str)
      Test whether the given string is exactly a signed 32-bit integer, without throwing. Unlike a naive matches() + parseInt() combination, an extremely long digit string cannot escape as an uncaught NumberFormatException.
      Parameters:
      str - the string to test, may be null
      Returns:
      true if the string parses cleanly to an int