public final class RedirectQuery extends Object
A redirect query string is later handed to
response.sendRedirect(); it must therefore only ever contain the
known numeric parameters with integer values. Crafted input containing a
scheme, host, or embedded HTML entity must be rejected so the redirect
target can never be an external URL.
| Modifier and Type | Method and Description |
|---|---|
static boolean | isSafeRedirectQuery(String qs)Validate a redirect query string. |
static boolean | isValidNumeric(String str)Test whether the given string is exactly a signed 32-bit integer,
without throwing. |
public static boolean isSafeRedirectQuery(String qs)
p, sort, st and
search parameters with integer values separated by '&'.
Anything else - a scheme, a host, a different parameter, or an
embedded entity like "&" - is rejected.qs - the query string, may be null or emptypublic static boolean isValidNumeric(String str)
matches() + parseInt()
combination, an extremely long digit string cannot escape as an
uncaught NumberFormatException.str - the string to test, may be null