HtmlSanitizer (Jmix-ui 1.0 API)

java.lang.Object
- io.jmix.ui.sanitizer.HtmlSanitizer

```
@Component(value="ui_HtmlSanitizer")
public class HtmlSanitizer
extends java.lang.Object
```
Utility bean that sanitizes a sting of HTML according to the factory's policy to prevent Cross-site Scripting (XSS) in HTML context.
The default policy factory contains special policies for the font element, because the RichTextArea component supports the font element as value. Also default policy factory contains policies that are not contained in standard Sanitizers.

Field Summary

Fields
Modifier and Type	Field and Description
`protected static java.lang.String`	`A_ELEMENT_NAME`
`protected static java.lang.String`	`CLASS_ATTRIBUTE_NAME`
`protected static java.util.regex.Pattern`	`CLASS_PATTERN`
`protected static java.lang.String`	`CLASS_REGEXP` Html class regexp.
`protected static com.google.common.collect.ImmutableSet<java.lang.String>`	`DEFAULT_WHITELIST` The additional css schema whitelist that was not included in the default whitelist in `Sanitizers.STYLES`.
`protected static java.lang.String`	`FONT_COLOR_ATTRIBUTE_NAME`
`protected static java.util.regex.Pattern`	`FONT_COLOR_PATTERN`
`protected static java.lang.String`	`FONT_COLOR_REGEXP` Font color regexp.
`protected static java.lang.String`	`FONT_FACE_ATTRIBUTE_NAME`
`protected static java.util.regex.Pattern`	`FONT_FACE_PATTERN`
`protected static java.lang.String`	`FONT_FACE_REGEXP` Font face regexp.
`protected static java.lang.String`	`FONT_SIZE_ATTRIBUTE_NAME`
`protected static java.util.regex.Pattern`	`FONT_SIZE_PATTERN`
`protected static java.lang.String`	`FONT_SIZE_REGEXP` Font size regexp.
`protected static java.lang.String`	`HREF_ATTRIBUTE_NAME`
`protected static java.lang.String`	`NOOPENNER_REL_VALUE`
`protected static java.lang.String`	`NOREFERRER_REL_VALUE`
`protected org.owasp.html.PolicyFactory`	`policyFactory`
`protected static java.lang.String`	`TARGET_ATTRIBUTE_NAME`
`protected static com.google.common.collect.ImmutableSet<java.lang.String>`	`TARGET_ATTRIBUTE_VALUES`

Constructor Summary

Constructors
Constructor and Description

HtmlSanitizer()

Constructors
Constructor and Description
`HtmlSanitizer()`

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method and Description
`protected com.google.common.collect.ImmutableMap<java.lang.String,org.owasp.html.CssSchema.Property>`	`getAdditionalStylePolicies()`
`org.owasp.html.PolicyFactory`	`getPolicyFactory()`
`protected void`	`initDefaultPolicyFactory()` Init default policy factory that is used to produce HTML sanitizer policies that sanitize a sting of HTML.
`java.lang.String`	`sanitize(java.lang.String html)` Sanitizes a string of HTML according to the factory's policy.
`void`	`setPolicyFactory(org.owasp.html.PolicyFactory policyFactory)` Sets policy factory.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Field Detail
  - FONT_SIZE_REGEXP
```
protected static final java.lang.String FONT_SIZE_REGEXP
```
    Font size regexp. Intended to match size attribute value of font element.
    Regexp explanation:
    - [0-7] - matches a number in the range 0 to 7
    - | - acts like a boolean OR
    - [+-]?(?:[0-9]+) - matches a relative font size value
    Example:
```
      &lt;font size="7"/&gt;
 
```
    See Also:
    
    Constant Field Values
  - FONT_SIZE_PATTERN
```
protected static final java.util.regex.Pattern FONT_SIZE_PATTERN
```
  - FONT_SIZE_ATTRIBUTE_NAME
```
protected static final java.lang.String FONT_SIZE_ATTRIBUTE_NAME
```
    See Also:
    
    Constant Field Values
  - FONT_FACE_REGEXP
```
protected static final java.lang.String FONT_FACE_REGEXP
```
    Font face regexp. Intended to match face attribute value of font element.
    Regexp explanation:
    - [\w;, \-]+ - matches font names separated by comma or semicolon
    Example:
```
      &lt;font face="Verdana"/&gt;
 
```
    See Also:
    
    Constant Field Values
  - FONT_FACE_PATTERN
```
protected static final java.util.regex.Pattern FONT_FACE_PATTERN
```
  - FONT_FACE_ATTRIBUTE_NAME
```
protected static final java.lang.String FONT_FACE_ATTRIBUTE_NAME
```
    See Also:
    
    Constant Field Values
  - FONT_COLOR_REGEXP
```
protected static final java.lang.String FONT_COLOR_REGEXP
```
    Font color regexp. Intended to match color attribute value that of font element.
    Regexp explanation:
    - (#(?:[0-9a-f]{2}){2,4}|(#[0-9a-f]{3}) - matches hexademical color
    - | - acts like a boolean OR
    - (rgb|hsl)a?\((-?\d+%?[,\s]+){2,3}\s*[d\.]+%?\) - matches RGB, RGBA, HSL, HSLA colors
    - "color_name" - matches color by name
    Example:
```
      &lt;font color="#0000ff"/&gt;
 
```
    See Also:
    
    Constant Field Values
  - FONT_COLOR_PATTERN
```
protected static final java.util.regex.Pattern FONT_COLOR_PATTERN
```
  - FONT_COLOR_ATTRIBUTE_NAME
```
protected static final java.lang.String FONT_COLOR_ATTRIBUTE_NAME
```
    See Also:
    
    Constant Field Values
  - CLASS_REGEXP
```
protected static final java.lang.String CLASS_REGEXP
```
    Html class regexp. Intended to match class attribute value.
    Regexp explanation:
    - a-zA-Z - matches a single character in the range: a-z, A-Z
    - 0-9 - matches a single character in the range: 0-9
    - , - matches a comma character
    - \\s - matches any whitespace character
    - \\- - matches a dash character
    - _ - matches an underscore character
    - []+ - matches between one and unlimited times
    Example:
```
      &lt;div class="v-app"/&gt;
 
```
    See Also:
    
    Constant Field Values
  - CLASS_PATTERN
```
protected static final java.util.regex.Pattern CLASS_PATTERN
```
  - CLASS_ATTRIBUTE_NAME
```
protected static final java.lang.String CLASS_ATTRIBUTE_NAME
```
    See Also:
    
    Constant Field Values
  - A_ELEMENT_NAME
```
protected static final java.lang.String A_ELEMENT_NAME
```
    See Also:
    
    Constant Field Values
  - HREF_ATTRIBUTE_NAME
```
protected static final java.lang.String HREF_ATTRIBUTE_NAME
```
    See Also:
    
    Constant Field Values
  - TARGET_ATTRIBUTE_NAME
```
protected static final java.lang.String TARGET_ATTRIBUTE_NAME
```
    See Also:
    
    Constant Field Values
  - TARGET_ATTRIBUTE_VALUES
```
protected static final com.google.common.collect.ImmutableSet<java.lang.String> TARGET_ATTRIBUTE_VALUES
```
  - NOOPENNER_REL_VALUE
```
protected static final java.lang.String NOOPENNER_REL_VALUE
```
    See Also:
    
    Constant Field Values
  - NOREFERRER_REL_VALUE
```
protected static final java.lang.String NOREFERRER_REL_VALUE
```
    See Also:
    
    Constant Field Values
  - DEFAULT_WHITELIST
```
protected static final com.google.common.collect.ImmutableSet<java.lang.String> DEFAULT_WHITELIST
```
    The additional css schema whitelist that was not included in the default whitelist in Sanitizers.STYLES. .
  - policyFactory
```
protected org.owasp.html.PolicyFactory policyFactory
```
- Constructor Detail
  - HtmlSanitizer
```
public HtmlSanitizer()
```
- Method Detail
  - sanitize
```
public java.lang.String sanitize(@Nullable
                                 java.lang.String html)
```
    Sanitizes a string of HTML according to the factory's policy.
    
    Parameters:
    
    html - the string of HTML to sanitize
    
    Returns:
    
    a string of HTML that complies with the factory's policy
  - getPolicyFactory
```
public org.owasp.html.PolicyFactory getPolicyFactory()
```
    Returns:
    
    a policy factory
  - setPolicyFactory
```
public void setPolicyFactory(org.owasp.html.PolicyFactory policyFactory)
```
    Sets policy factory.
    
    Parameters:
    
    policyFactory - a policy factory
  - initDefaultPolicyFactory
```
protected void initDefaultPolicyFactory()
```
    Init default policy factory that is used to produce HTML sanitizer policies that sanitize a sting of HTML.
  - getAdditionalStylePolicies
```
protected com.google.common.collect.ImmutableMap<java.lang.String,org.owasp.html.CssSchema.Property> getAdditionalStylePolicies()
```
    Returns:
    
    additional style policies that were not included in Sanitizers.STYLES.

Class HtmlSanitizer

Field Summary

Constructor Summary

Method Summary

Methods inherited from class java.lang.Object

Field Detail

FONT_SIZE_REGEXP

FONT_SIZE_PATTERN

FONT_SIZE_ATTRIBUTE_NAME

FONT_FACE_REGEXP

FONT_FACE_PATTERN

FONT_FACE_ATTRIBUTE_NAME

FONT_COLOR_REGEXP

FONT_COLOR_PATTERN

FONT_COLOR_ATTRIBUTE_NAME

CLASS_REGEXP

CLASS_PATTERN

CLASS_ATTRIBUTE_NAME

A_ELEMENT_NAME

HREF_ATTRIBUTE_NAME

TARGET_ATTRIBUTE_NAME

TARGET_ATTRIBUTE_VALUES

NOOPENNER_REL_VALUE

NOREFERRER_REL_VALUE

DEFAULT_WHITELIST

policyFactory

Constructor Detail

HtmlSanitizer

Method Detail

sanitize

getPolicyFactory

setPolicyFactory

initDefaultPolicyFactory

getAdditionalStylePolicies