org.apache.sling.xss.impl

## Class XSSFilterImpl

- java.lang.Object
- - org.apache.sling.xss.impl.XSSFilterImpl

All Implemented Interfaces:
  org.apache.sling.api.resource.observation.ExternalResourceChangeListener, org.apache.sling.api.resource.observation.ResourceChangeListener, XSSFilter

    @Service(value={org.apache.sling.api.resource.observation.ResourceChangeListener.class,XSSFilter.class})
     @Property(name="resource.change.types",value={"ADDED","CHANGED","REMOVED"}) @Property(name="resource.paths",value="sling/xss/config.xml")
    public class XSSFilterImpl
    extends Object
    implements XSSFilter, org.apache.sling.api.resource.observation.ResourceChangeListener, org.apache.sling.api.resource.observation.ExternalResourceChangeListener

This class implements the `XSSFilter` using the Antisamy XSS protection library found at http://code.google.com/p/owaspantisamy/.

### Field Summary

Fields
`static String` `DEFAULT_POLICY_PATH`

### Fields inherited from interface org.apache.sling.xss.XSSFilter

`DEFAULT_CONTEXT`

### Fields inherited from interface org.apache.sling.api.resource.observation.ResourceChangeListener

`CHANGES, PATHS`

### Constructor Summary

Constructors
Constructor and Description
`XSSFilterImpl()`

### Method Summary

All Methods Instance Methods Concrete Methods
`protected void` `activate()`
`boolean` `check(ProtectionContext context, String src)` Indicates whether or not a given source string contains XSS policy violations.
`boolean` `check(ProtectionContext context, String src, String policy)`
`String` `filter(ProtectionContext context, String src)` Protects the given source string from containing XSS stuff.
`String` `filter(ProtectionContext context, String src, String policy)`
`String` `filter(String src)` Prevents the given source string from containing XSS stuff.
`boolean` `hasPolicy(String policyName)`
`boolean` `isValidHref(String url)` Checks if the given URL is valid to be used for the `href` attribute in a `a` tag.
`void` `loadPolicy(String policyName, InputStream policyStream)`
`void` `onChange(List<org.apache.sling.api.resource.observation.ResourceChange> resourceChanges)`
`void` `resetDefaultPolicy()`
`void` `setDefaultPolicy(InputStream policyStream)`
`void` `unloadPolicy(String policyName)`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Field Detail

#### DEFAULT_POLICY_PATH

    public static final String DEFAULT_POLICY_PATH

See Also:
  Constant Field Values

### Constructor Detail

#### XSSFilterImpl

    public XSSFilterImpl()

### Method Detail

#### onChange

    public void onChange(List<org.apache.sling.api.resource.observation.ResourceChange> resourceChanges)

Specified by:
  `onChange` in interface `org.apache.sling.api.resource.observation.ResourceChangeListener`

#### check

    public boolean check(ProtectionContext context,
                         String src)

Description copied from interface: `XSSFilter`
Indicates whether or not a given source string contains XSS policy violations.

Specified by:
  `check` in interface `XSSFilter`
Parameters:
  `context` - context to use for checking
  `src` - source string
Returns:
  true if the source is violation-free

#### filter

    public String filter(String src)

Description copied from interface: `XSSFilter`
Prevents the given source string from containing XSS stuff.

The default protection context is used for checking.

Specified by:
  `filter` in interface `XSSFilter`
Parameters:
  `src` - source string
Returns:
  string that does not contain XSS stuff

#### filter

    public String filter(ProtectionContext context,
                         String src)

Description copied from interface: `XSSFilter`
Protects the given source string from containing XSS stuff.

Specified by:
  `filter` in interface `XSSFilter`
Parameters:
  `context` - context to use for checking
  `src` - source string
Returns:
  string that does not contain XSS stuff

#### activate

    @Activate
    protected void activate()

#### check

    public boolean check(ProtectionContext context,
                         String src,
                         String policy)

#### filter

    public String filter(ProtectionContext context,
                         String src,
                         String policy)

#### setDefaultPolicy

    public void setDefaultPolicy(InputStream policyStream)
                          throws Exception

Throws:
  `Exception`

#### resetDefaultPolicy

    public void resetDefaultPolicy()

#### loadPolicy

    public void loadPolicy(String policyName,
                           InputStream policyStream)
                    throws Exception

Throws:
  `Exception`

#### unloadPolicy

    public void unloadPolicy(String policyName)

#### hasPolicy

    public boolean hasPolicy(String policyName)

#### isValidHref

    public boolean isValidHref(String url)

Description copied from interface: `XSSFilter`
Checks if the given URL is valid to be used for the `href` attribute in a `a` tag.

The default protection context is used for checking.

Specified by:
  `isValidHref` in interface `XSSFilter`
Parameters:
  `url` - the URL that should be validated
Returns:
  true if the URL is violation-free