| <HTML> |
| <BODY BGCOLOR="white"> |
| <PRE> |
| <FONT color="green">001</FONT> // Copyright (c) 2011, Mike Samuel<a name="line.1"></a> |
| <FONT color="green">002</FONT> // All rights reserved.<a name="line.2"></a> |
| <FONT color="green">003</FONT> //<a name="line.3"></a> |
| <FONT color="green">004</FONT> // Redistribution and use in source and binary forms, with or without<a name="line.4"></a> |
| <FONT color="green">005</FONT> // modification, are permitted provided that the following conditions<a name="line.5"></a> |
| <FONT color="green">006</FONT> // are met:<a name="line.6"></a> |
| <FONT color="green">007</FONT> //<a name="line.7"></a> |
| <FONT color="green">008</FONT> // Redistributions of source code must retain the above copyright<a name="line.8"></a> |
| <FONT color="green">009</FONT> // notice, this list of conditions and the following disclaimer.<a name="line.9"></a> |
| <FONT color="green">010</FONT> // Redistributions in binary form must reproduce the above copyright<a name="line.10"></a> |
| <FONT color="green">011</FONT> // notice, this list of conditions and the following disclaimer in the<a name="line.11"></a> |
| <FONT color="green">012</FONT> // documentation and/or other materials provided with the distribution.<a name="line.12"></a> |
| <FONT color="green">013</FONT> // Neither the name of the OWASP nor the names of its contributors may<a name="line.13"></a> |
| <FONT color="green">014</FONT> // be used to endorse or promote products derived from this software<a name="line.14"></a> |
| <FONT color="green">015</FONT> // without specific prior written permission.<a name="line.15"></a> |
| <FONT color="green">016</FONT> // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS<a name="line.16"></a> |
| <FONT color="green">017</FONT> // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT<a name="line.17"></a> |
| <FONT color="green">018</FONT> // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS<a name="line.18"></a> |
| <FONT color="green">019</FONT> // FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE<a name="line.19"></a> |
| <FONT color="green">020</FONT> // COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,<a name="line.20"></a> |
| <FONT color="green">021</FONT> // INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,<a name="line.21"></a> |
| <FONT color="green">022</FONT> // BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;<a name="line.22"></a> |
| <FONT color="green">023</FONT> // LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER<a name="line.23"></a> |
| <FONT color="green">024</FONT> // CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT<a name="line.24"></a> |
| <FONT color="green">025</FONT> // LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN<a name="line.25"></a> |
| <FONT color="green">026</FONT> // ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE<a name="line.26"></a> |
| <FONT color="green">027</FONT> // POSSIBILITY OF SUCH DAMAGE.<a name="line.27"></a> |
| <FONT color="green">028</FONT> <a name="line.28"></a> |
| <FONT color="green">029</FONT> package org.owasp.html;<a name="line.29"></a> |
| <FONT color="green">030</FONT> <a name="line.30"></a> |
| <FONT color="green">031</FONT> import com.google.common.collect.ImmutableMap;<a name="line.31"></a> |
| <FONT color="green">032</FONT> <a name="line.32"></a> |
| <FONT color="green">033</FONT> /**<a name="line.33"></a> |
| <FONT color="green">034</FONT> * From section 8.1.2.6 of http://www.whatwg.org/specs/web-apps/current-work/<a name="line.34"></a> |
| <FONT color="green">035</FONT> * <p><a name="line.35"></a> |
| <FONT color="green">036</FONT> * The text in CDATA and RCDATA elements must not contain any<a name="line.36"></a> |
| <FONT color="green">037</FONT> * occurrences of the string "</" (U+003C LESS-THAN SIGN, U+002F<a name="line.37"></a> |
| <FONT color="green">038</FONT> * SOLIDUS) followed by characters that case-insensitively match the<a name="line.38"></a> |
| <FONT color="green">039</FONT> * tag name of the element followed by one of U+0009 CHARACTER<a name="line.39"></a> |
| <FONT color="green">040</FONT> * TABULATION, U+000A LINE FEED (LF), U+000B LINE TABULATION, U+000C<a name="line.40"></a> |
| <FONT color="green">041</FONT> * FORM FEED (FF), U+0020 SPACE, U+003E GREATER-THAN SIGN (>), or<a name="line.41"></a> |
| <FONT color="green">042</FONT> * U+002F SOLIDUS (/), unless that string is part of an escaping<a name="line.42"></a> |
| <FONT color="green">043</FONT> * text span.<a name="line.43"></a> |
| <FONT color="green">044</FONT> * </p><a name="line.44"></a> |
| <FONT color="green">045</FONT> *<a name="line.45"></a> |
| <FONT color="green">046</FONT> * <p><a name="line.46"></a> |
| <FONT color="green">047</FONT> * See also<a name="line.47"></a> |
| <FONT color="green">048</FONT> * http://www.whatwg.org/specs/web-apps/current-work/#cdata-rcdata-restrictions<a name="line.48"></a> |
| <FONT color="green">049</FONT> * for the elements which fall in each category.<a name="line.49"></a> |
| <FONT color="green">050</FONT> * </p><a name="line.50"></a> |
| <FONT color="green">051</FONT> *<a name="line.51"></a> |
| <FONT color="green">052</FONT> * @author Mike Samuel <mikesamuel@gmail.com><a name="line.52"></a> |
| <FONT color="green">053</FONT> */<a name="line.53"></a> |
| <FONT color="green">054</FONT> public enum HtmlTextEscapingMode {<a name="line.54"></a> |
| <FONT color="green">055</FONT> /**<a name="line.55"></a> |
| <FONT color="green">056</FONT> * Normally escaped character data that breaks around comments and tags.<a name="line.56"></a> |
| <FONT color="green">057</FONT> */<a name="line.57"></a> |
| <FONT color="green">058</FONT> PCDATA,<a name="line.58"></a> |
| <FONT color="green">059</FONT> /**<a name="line.59"></a> |
| <FONT color="green">060</FONT> * A span of text where HTML special characters are interpreted literally,<a name="line.60"></a> |
| <FONT color="green">061</FONT> * as in a SCRIPT tag.<a name="line.61"></a> |
| <FONT color="green">062</FONT> */<a name="line.62"></a> |
| <FONT color="green">063</FONT> CDATA,<a name="line.63"></a> |
| <FONT color="green">064</FONT> /**<a name="line.64"></a> |
| <FONT color="green">065</FONT> * Like {@link #CDATA} but only for certain browsers.<a name="line.65"></a> |
| <FONT color="green">066</FONT> */<a name="line.66"></a> |
| <FONT color="green">067</FONT> CDATA_SOMETIMES,<a name="line.67"></a> |
| <FONT color="green">068</FONT> /**<a name="line.68"></a> |
| <FONT color="green">069</FONT> * A span of text and character entity references where HTML special<a name="line.69"></a> |
| <FONT color="green">070</FONT> * characters are interpreted literally, as in a TITLE tag.<a name="line.70"></a> |
| <FONT color="green">071</FONT> */<a name="line.71"></a> |
| <FONT color="green">072</FONT> RCDATA,<a name="line.72"></a> |
| <FONT color="green">073</FONT> /**<a name="line.73"></a> |
| <FONT color="green">074</FONT> * A span of text where HTML special characters are interpreted literally,<a name="line.74"></a> |
| <FONT color="green">075</FONT> * where there is no end tag. PLAIN_TEXT runs until the end of the file.<a name="line.75"></a> |
| <FONT color="green">076</FONT> */<a name="line.76"></a> |
| <FONT color="green">077</FONT> PLAIN_TEXT,<a name="line.77"></a> |
| <FONT color="green">078</FONT> <a name="line.78"></a> |
| <FONT color="green">079</FONT> /**<a name="line.79"></a> |
| <FONT color="green">080</FONT> * Cannot contain data.<a name="line.80"></a> |
| <FONT color="green">081</FONT> */<a name="line.81"></a> |
| <FONT color="green">082</FONT> VOID,<a name="line.82"></a> |
| <FONT color="green">083</FONT> ;<a name="line.83"></a> |
| <FONT color="green">084</FONT> <a name="line.84"></a> |
| <FONT color="green">085</FONT> private static final ImmutableMap<String, HtmlTextEscapingMode> ESCAPING_MODES<a name="line.85"></a> |
| <FONT color="green">086</FONT> = ImmutableMap.<String, HtmlTextEscapingMode>builder()<a name="line.86"></a> |
| <FONT color="green">087</FONT> .put("iframe", CDATA)<a name="line.87"></a> |
| <FONT color="green">088</FONT> // HTML5 does not treat listing as CDATA and treats XMP as deprecated,<a name="line.88"></a> |
| <FONT color="green">089</FONT> // but HTML2 does at<a name="line.89"></a> |
| <FONT color="green">090</FONT> // http://www.w3.org/MarkUp/1995-archive/NonStandard.html<a name="line.90"></a> |
| <FONT color="green">091</FONT> // Listing is not supported by browsers.<a name="line.91"></a> |
| <FONT color="green">092</FONT> .put("listing", CDATA_SOMETIMES)<a name="line.92"></a> |
| <FONT color="green">093</FONT> .put("xmp", CDATA)<a name="line.93"></a> |
| <FONT color="green">094</FONT> <a name="line.94"></a> |
| <FONT color="green">095</FONT> // Technically, noembed, noscript and noframes are CDATA_SOMETIMES but<a name="line.95"></a> |
| <FONT color="green">096</FONT> // we can only be hurt by allowing tag content that looks like text so<a name="line.96"></a> |
| <FONT color="green">097</FONT> // we treat them as regular..<a name="line.97"></a> |
| <FONT color="green">098</FONT> //.put("noembed", CDATA_SOMETIMES)<a name="line.98"></a> |
| <FONT color="green">099</FONT> //.put("noframes", CDATA_SOMETIMES)<a name="line.99"></a> |
| <FONT color="green">100</FONT> //.put("noscript", CDATA_SOMETIMES)<a name="line.100"></a> |
| <FONT color="green">101</FONT> .put("comment", CDATA_SOMETIMES) // IE only<a name="line.101"></a> |
| <FONT color="green">102</FONT> <a name="line.102"></a> |
| <FONT color="green">103</FONT> // Runs till end of file.<a name="line.103"></a> |
| <FONT color="green">104</FONT> .put("plaintext", PLAIN_TEXT)<a name="line.104"></a> |
| <FONT color="green">105</FONT> <a name="line.105"></a> |
| <FONT color="green">106</FONT> .put("script", CDATA)<a name="line.106"></a> |
| <FONT color="green">107</FONT> .put("style", CDATA)<a name="line.107"></a> |
| <FONT color="green">108</FONT> <a name="line.108"></a> |
| <FONT color="green">109</FONT> // Textarea and Title are RCDATA, not CDATA, so decode entity references.<a name="line.109"></a> |
| <FONT color="green">110</FONT> .put("textarea", RCDATA)<a name="line.110"></a> |
| <FONT color="green">111</FONT> .put("title", RCDATA)<a name="line.111"></a> |
| <FONT color="green">112</FONT> <a name="line.112"></a> |
| <FONT color="green">113</FONT> // Nodes that can't contain content.<a name="line.113"></a> |
| <FONT color="green">114</FONT> // http://www.w3.org/TR/html-markup/syntax.html#void-elements<a name="line.114"></a> |
| <FONT color="green">115</FONT> .put("area", VOID)<a name="line.115"></a> |
| <FONT color="green">116</FONT> .put("base", VOID)<a name="line.116"></a> |
| <FONT color="green">117</FONT> .put("br", VOID)<a name="line.117"></a> |
| <FONT color="green">118</FONT> .put("col", VOID)<a name="line.118"></a> |
| <FONT color="green">119</FONT> .put("command", VOID)<a name="line.119"></a> |
| <FONT color="green">120</FONT> .put("embed", VOID)<a name="line.120"></a> |
| <FONT color="green">121</FONT> .put("hr", VOID)<a name="line.121"></a> |
| <FONT color="green">122</FONT> .put("img", VOID)<a name="line.122"></a> |
| <FONT color="green">123</FONT> .put("input", VOID)<a name="line.123"></a> |
| <FONT color="green">124</FONT> .put("keygen", VOID)<a name="line.124"></a> |
| <FONT color="green">125</FONT> .put("link", VOID)<a name="line.125"></a> |
| <FONT color="green">126</FONT> .put("meta", VOID)<a name="line.126"></a> |
| <FONT color="green">127</FONT> .put("param", VOID)<a name="line.127"></a> |
| <FONT color="green">128</FONT> .put("source", VOID)<a name="line.128"></a> |
| <FONT color="green">129</FONT> .put("track", VOID)<a name="line.129"></a> |
| <FONT color="green">130</FONT> .put("wbr", VOID)<a name="line.130"></a> |
| <FONT color="green">131</FONT> .build();<a name="line.131"></a> |
| <FONT color="green">132</FONT> <a name="line.132"></a> |
| <FONT color="green">133</FONT> <a name="line.133"></a> |
| <FONT color="green">134</FONT> /**<a name="line.134"></a> |
| <FONT color="green">135</FONT> * The mode used for content following a start tag with the given name.<a name="line.135"></a> |
| <FONT color="green">136</FONT> */<a name="line.136"></a> |
| <FONT color="green">137</FONT> public static HtmlTextEscapingMode getModeForTag(String canonTagName) {<a name="line.137"></a> |
| <FONT color="green">138</FONT> HtmlTextEscapingMode mode = ESCAPING_MODES.get(canonTagName);<a name="line.138"></a> |
| <FONT color="green">139</FONT> return mode != null ? mode : PCDATA;<a name="line.139"></a> |
| <FONT color="green">140</FONT> }<a name="line.140"></a> |
| <FONT color="green">141</FONT> <a name="line.141"></a> |
| <FONT color="green">142</FONT> /**<a name="line.142"></a> |
| <FONT color="green">143</FONT> * True iff the content following the given tag allows escaping text<a name="line.143"></a> |
| <FONT color="green">144</FONT> * spans: {@code <!--&hellip;-->} that escape even things that might<a name="line.144"></a> |
| <FONT color="green">145</FONT> * be an end tag for the corresponding open tag.<a name="line.145"></a> |
| <FONT color="green">146</FONT> */<a name="line.146"></a> |
| <FONT color="green">147</FONT> public static boolean allowsEscapingTextSpan(String canonTagName) {<a name="line.147"></a> |
| <FONT color="green">148</FONT> // <xmp> and <plaintext> do not admit escaping text spans.<a name="line.148"></a> |
| <FONT color="green">149</FONT> return "style".equals(canonTagName) || "script".equals(canonTagName)<a name="line.149"></a> |
| <FONT color="green">150</FONT> || "noembed".equals(canonTagName) || "noscript".equals(canonTagName)<a name="line.150"></a> |
| <FONT color="green">151</FONT> || "noframes".equals(canonTagName);<a name="line.151"></a> |
| <FONT color="green">152</FONT> }<a name="line.152"></a> |
| <FONT color="green">153</FONT> <a name="line.153"></a> |
| <FONT color="green">154</FONT> /**<a name="line.154"></a> |
| <FONT color="green">155</FONT> * True if content immediately following the start tag must be treated as<a name="line.155"></a> |
| <FONT color="green">156</FONT> * special CDATA so that &lt;'s are not treated as starting tags, comments<a name="line.156"></a> |
| <FONT color="green">157</FONT> * or directives.<a name="line.157"></a> |
| <FONT color="green">158</FONT> */<a name="line.158"></a> |
| <FONT color="green">159</FONT> public static boolean isTagFollowedByLiteralContent(String canonTagName) {<a name="line.159"></a> |
| <FONT color="green">160</FONT> HtmlTextEscapingMode mode = getModeForTag(canonTagName);<a name="line.160"></a> |
| <FONT color="green">161</FONT> return mode != PCDATA && mode != VOID;<a name="line.161"></a> |
| <FONT color="green">162</FONT> }<a name="line.162"></a> |
| <FONT color="green">163</FONT> <a name="line.163"></a> |
| <FONT color="green">164</FONT> /**<a name="line.164"></a> |
| <FONT color="green">165</FONT> * True iff the tag cannot contain any content -- will an HTML parser consider<a name="line.165"></a> |
| <FONT color="green">166</FONT> * the element to have ended immediately after the start tag.<a name="line.166"></a> |
| <FONT color="green">167</FONT> */<a name="line.167"></a> |
| <FONT color="green">168</FONT> public static boolean isVoidElement(String canonTagName) {<a name="line.168"></a> |
| <FONT color="green">169</FONT> return getModeForTag(canonTagName) == VOID;<a name="line.169"></a> |
| <FONT color="green">170</FONT> }<a name="line.170"></a> |
| <FONT color="green">171</FONT> }<a name="line.171"></a> |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| </PRE> |
| </BODY> |
| </HTML> |
