| <HTML> |
| <BODY BGCOLOR="white"> |
| <PRE> |
| <FONT color="green">001</FONT> // Copyright (c) 2011, Mike Samuel<a name="line.1"></a> |
| <FONT color="green">002</FONT> // All rights reserved.<a name="line.2"></a> |
| <FONT color="green">003</FONT> //<a name="line.3"></a> |
| <FONT color="green">004</FONT> // Redistribution and use in source and binary forms, with or without<a name="line.4"></a> |
| <FONT color="green">005</FONT> // modification, are permitted provided that the following conditions<a name="line.5"></a> |
| <FONT color="green">006</FONT> // are met:<a name="line.6"></a> |
| <FONT color="green">007</FONT> //<a name="line.7"></a> |
| <FONT color="green">008</FONT> // Redistributions of source code must retain the above copyright<a name="line.8"></a> |
| <FONT color="green">009</FONT> // notice, this list of conditions and the following disclaimer.<a name="line.9"></a> |
| <FONT color="green">010</FONT> // Redistributions in binary form must reproduce the above copyright<a name="line.10"></a> |
| <FONT color="green">011</FONT> // notice, this list of conditions and the following disclaimer in the<a name="line.11"></a> |
| <FONT color="green">012</FONT> // documentation and/or other materials provided with the distribution.<a name="line.12"></a> |
| <FONT color="green">013</FONT> // Neither the name of the OWASP nor the names of its contributors may<a name="line.13"></a> |
| <FONT color="green">014</FONT> // be used to endorse or promote products derived from this software<a name="line.14"></a> |
| <FONT color="green">015</FONT> // without specific prior written permission.<a name="line.15"></a> |
| <FONT color="green">016</FONT> // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS<a name="line.16"></a> |
| <FONT color="green">017</FONT> // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT<a name="line.17"></a> |
| <FONT color="green">018</FONT> // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS<a name="line.18"></a> |
| <FONT color="green">019</FONT> // FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE<a name="line.19"></a> |
| <FONT color="green">020</FONT> // COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,<a name="line.20"></a> |
| <FONT color="green">021</FONT> // INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,<a name="line.21"></a> |
| <FONT color="green">022</FONT> // BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;<a name="line.22"></a> |
| <FONT color="green">023</FONT> // LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER<a name="line.23"></a> |
| <FONT color="green">024</FONT> // CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT<a name="line.24"></a> |
| <FONT color="green">025</FONT> // LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN<a name="line.25"></a> |
| <FONT color="green">026</FONT> // ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE<a name="line.26"></a> |
| <FONT color="green">027</FONT> // POSSIBILITY OF SUCH DAMAGE.<a name="line.27"></a> |
| <FONT color="green">028</FONT> <a name="line.28"></a> |
| <FONT color="green">029</FONT> package org.owasp.html;<a name="line.29"></a> |
| <FONT color="green">030</FONT> <a name="line.30"></a> |
| <FONT color="green">031</FONT> import javax.annotation.Nullable;<a name="line.31"></a> |
| <FONT color="green">032</FONT> import javax.annotation.concurrent.Immutable;<a name="line.32"></a> |
| <FONT color="green">033</FONT> <a name="line.33"></a> |
| <FONT color="green">034</FONT> /**<a name="line.34"></a> |
| <FONT color="green">035</FONT> * A policy that can be applied to an HTML attribute to decide whether or not to<a name="line.35"></a> |
| <FONT color="green">036</FONT> * allow it in the output, possibly after transforming its value.<a name="line.36"></a> |
| <FONT color="green">037</FONT> *<a name="line.37"></a> |
| <FONT color="green">038</FONT> * @author Mike Samuel <mikesamuel@gmail.com><a name="line.38"></a> |
| <FONT color="green">039</FONT> * @see HtmlPolicyBuilder.AttributeBuilder#matching(AttributePolicy)<a name="line.39"></a> |
| <FONT color="green">040</FONT> */<a name="line.40"></a> |
| <FONT color="green">041</FONT> @TCB public interface AttributePolicy {<a name="line.41"></a> |
| <FONT color="green">042</FONT> <a name="line.42"></a> |
| <FONT color="green">043</FONT> /**<a name="line.43"></a> |
| <FONT color="green">044</FONT> * @param elementName the lower-case element name.<a name="line.44"></a> |
| <FONT color="green">045</FONT> * @param attributeName the lower-case attribute name.<a name="line.45"></a> |
| <FONT color="green">046</FONT> * @param value the attribute value without quotes and with HTML entities<a name="line.46"></a> |
| <FONT color="green">047</FONT> * decoded.<a name="line.47"></a> |
| <FONT color="green">048</FONT> *<a name="line.48"></a> |
| <FONT color="green">049</FONT> * @return {@code null} to disallow the attribute or the adjusted value if<a name="line.49"></a> |
| <FONT color="green">050</FONT> * allowed.<a name="line.50"></a> |
| <FONT color="green">051</FONT> */<a name="line.51"></a> |
| <FONT color="green">052</FONT> public @Nullable String apply(<a name="line.52"></a> |
| <FONT color="green">053</FONT> String elementName, String attributeName, String value);<a name="line.53"></a> |
| <FONT color="green">054</FONT> <a name="line.54"></a> |
| <FONT color="green">055</FONT> <a name="line.55"></a> |
| <FONT color="green">056</FONT> /** Utilities for working with attribute policies. */<a name="line.56"></a> |
| <FONT color="green">057</FONT> public static final class Util {<a name="line.57"></a> |
| <FONT color="green">058</FONT> <a name="line.58"></a> |
| <FONT color="green">059</FONT> /**<a name="line.59"></a> |
| <FONT color="green">060</FONT> * An attribute policy equivalent to applying all the given policies in<a name="line.60"></a> |
| <FONT color="green">061</FONT> * order, failing early if any of them fails.<a name="line.61"></a> |
| <FONT color="green">062</FONT> */<a name="line.62"></a> |
| <FONT color="green">063</FONT> public static final AttributePolicy join(AttributePolicy... policies) {<a name="line.63"></a> |
| <FONT color="green">064</FONT> <a name="line.64"></a> |
| <FONT color="green">065</FONT> class PolicyJoiner {<a name="line.65"></a> |
| <FONT color="green">066</FONT> AttributePolicy last = null;<a name="line.66"></a> |
| <FONT color="green">067</FONT> AttributePolicy out = null;<a name="line.67"></a> |
| <FONT color="green">068</FONT> <a name="line.68"></a> |
| <FONT color="green">069</FONT> void join(AttributePolicy p) {<a name="line.69"></a> |
| <FONT color="green">070</FONT> if (REJECT_ALL_ATTRIBUTE_POLICY.equals(p)) {<a name="line.70"></a> |
| <FONT color="green">071</FONT> out = p;<a name="line.71"></a> |
| <FONT color="green">072</FONT> } else if (!REJECT_ALL_ATTRIBUTE_POLICY.equals(out)) {<a name="line.72"></a> |
| <FONT color="green">073</FONT> if (p instanceof JoinedAttributePolicy) {<a name="line.73"></a> |
| <FONT color="green">074</FONT> JoinedAttributePolicy jap = (JoinedAttributePolicy) p;<a name="line.74"></a> |
| <FONT color="green">075</FONT> join(jap.first);<a name="line.75"></a> |
| <FONT color="green">076</FONT> join(jap.second);<a name="line.76"></a> |
| <FONT color="green">077</FONT> } else if (p != last) {<a name="line.77"></a> |
| <FONT color="green">078</FONT> last = p;<a name="line.78"></a> |
| <FONT color="green">079</FONT> if (out == null || IDENTITY_ATTRIBUTE_POLICY.equals(out)) {<a name="line.79"></a> |
| <FONT color="green">080</FONT> out = p;<a name="line.80"></a> |
| <FONT color="green">081</FONT> } else if (!IDENTITY_ATTRIBUTE_POLICY.equals(p)) {<a name="line.81"></a> |
| <FONT color="green">082</FONT> out = new JoinedAttributePolicy(out, p);<a name="line.82"></a> |
| <FONT color="green">083</FONT> }<a name="line.83"></a> |
| <FONT color="green">084</FONT> }<a name="line.84"></a> |
| <FONT color="green">085</FONT> }<a name="line.85"></a> |
| <FONT color="green">086</FONT> }<a name="line.86"></a> |
| <FONT color="green">087</FONT> }<a name="line.87"></a> |
| <FONT color="green">088</FONT> <a name="line.88"></a> |
| <FONT color="green">089</FONT> PolicyJoiner pu = new PolicyJoiner();<a name="line.89"></a> |
| <FONT color="green">090</FONT> for (AttributePolicy policy : policies) {<a name="line.90"></a> |
| <FONT color="green">091</FONT> if (policy == null) { continue; }<a name="line.91"></a> |
| <FONT color="green">092</FONT> pu.join(policy);<a name="line.92"></a> |
| <FONT color="green">093</FONT> }<a name="line.93"></a> |
| <FONT color="green">094</FONT> return pu.out != null ? pu.out : IDENTITY_ATTRIBUTE_POLICY;<a name="line.94"></a> |
| <FONT color="green">095</FONT> }<a name="line.95"></a> |
| <FONT color="green">096</FONT> }<a name="line.96"></a> |
| <FONT color="green">097</FONT> <a name="line.97"></a> |
| <FONT color="green">098</FONT> <a name="line.98"></a> |
| <FONT color="green">099</FONT> public static final AttributePolicy IDENTITY_ATTRIBUTE_POLICY<a name="line.99"></a> |
| <FONT color="green">100</FONT> = new AttributePolicy() {<a name="line.100"></a> |
| <FONT color="green">101</FONT> public String apply(<a name="line.101"></a> |
| <FONT color="green">102</FONT> String elementName, String attributeName, String value) {<a name="line.102"></a> |
| <FONT color="green">103</FONT> return value;<a name="line.103"></a> |
| <FONT color="green">104</FONT> }<a name="line.104"></a> |
| <FONT color="green">105</FONT> };<a name="line.105"></a> |
| <FONT color="green">106</FONT> <a name="line.106"></a> |
| <FONT color="green">107</FONT> public static final AttributePolicy REJECT_ALL_ATTRIBUTE_POLICY<a name="line.107"></a> |
| <FONT color="green">108</FONT> = new AttributePolicy() {<a name="line.108"></a> |
| <FONT color="green">109</FONT> public @Nullable String apply(<a name="line.109"></a> |
| <FONT color="green">110</FONT> String elementName, String attributeName, String value) {<a name="line.110"></a> |
| <FONT color="green">111</FONT> return null;<a name="line.111"></a> |
| <FONT color="green">112</FONT> }<a name="line.112"></a> |
| <FONT color="green">113</FONT> };<a name="line.113"></a> |
| <FONT color="green">114</FONT> <a name="line.114"></a> |
| <FONT color="green">115</FONT> }<a name="line.115"></a> |
| <FONT color="green">116</FONT> <a name="line.116"></a> |
| <FONT color="green">117</FONT> @Immutable<a name="line.117"></a> |
| <FONT color="green">118</FONT> final class JoinedAttributePolicy implements AttributePolicy {<a name="line.118"></a> |
| <FONT color="green">119</FONT> final AttributePolicy first, second;<a name="line.119"></a> |
| <FONT color="green">120</FONT> <a name="line.120"></a> |
| <FONT color="green">121</FONT> JoinedAttributePolicy(AttributePolicy first, AttributePolicy second) {<a name="line.121"></a> |
| <FONT color="green">122</FONT> this.first = first;<a name="line.122"></a> |
| <FONT color="green">123</FONT> this.second = second;<a name="line.123"></a> |
| <FONT color="green">124</FONT> }<a name="line.124"></a> |
| <FONT color="green">125</FONT> <a name="line.125"></a> |
| <FONT color="green">126</FONT> public @Nullable String apply(<a name="line.126"></a> |
| <FONT color="green">127</FONT> String elementName, String attributeName, String value) {<a name="line.127"></a> |
| <FONT color="green">128</FONT> value = first.apply(elementName, attributeName, value);<a name="line.128"></a> |
| <FONT color="green">129</FONT> return value != null<a name="line.129"></a> |
| <FONT color="green">130</FONT> ? second.apply(elementName, attributeName, value) : null;<a name="line.130"></a> |
| <FONT color="green">131</FONT> }<a name="line.131"></a> |
| <FONT color="green">132</FONT> }<a name="line.132"></a> |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| </PRE> |
| </BODY> |
| </HTML> |
