org.apache.sling.xss

## Interface XSSFilter

All Known Implementing Classes:
  XSSFilterImpl

    @ProviderType
    public interface XSSFilter

This service should be used to protect output against potential XSS attacks. The protection is context based.

### Field Summary

Fields
`static ProtectionContext` `DEFAULT_CONTEXT` Default context.

### Method Summary

All Methods Instance Methods Abstract Methods
`boolean` `check(ProtectionContext context, String src)` Indicates whether or not a given source string contains XSS policy violations.
`String` `filter(ProtectionContext context, String src)` Protects the given source string from containing XSS stuff.
`String` `filter(String src)` Prevents the given source string from containing XSS stuff.
`boolean` `isValidHref(String url)` Checks if the given URL is valid to be used for the `href` attribute in a `a` tag.

### Field Detail

#### DEFAULT_CONTEXT

    static final ProtectionContext DEFAULT_CONTEXT

Default context.

### Method Detail

#### check

    boolean check(ProtectionContext context,
                  String src)

Indicates whether or not a given source string contains XSS policy violations.

Parameters:
  `context` - context to use for checking
  `src` - source string
Returns:
  true if the source is violation-free
Throws:
  `NullPointerException` - if context is `null`

#### filter

    String filter(String src)

Prevents the given source string from containing XSS stuff.

The default protection context is used for checking.

Parameters:
  `src` - source string
Returns:
  string that does not contain XSS stuff

#### filter

    String filter(ProtectionContext context,
                  String src)

Protects the given source string from containing XSS stuff.

Parameters:
  `context` - context to use for checking
  `src` - source string
Returns:
  string that does not contain XSS stuff
Throws:
  `NullPointerException` - if context is `null`

#### isValidHref

    boolean isValidHref(String url)

Checks if the given URL is valid to be used for the `href` attribute in a `a` tag.

The default protection context is used for checking.

Parameters:
  `url` - the URL that should be validated
Returns:
  true if the URL is violation-free