com.google.common.html.types

Class SafeUrls

java.lang.Object

com.google.common.html.types.SafeUrls

@GwtCompatible
public final class SafeUrls
extends Object

Protocol conversions and factory methods for SafeUrl.

Method Summary

Modifier and Type	Method and Description
static SafeUrl	fromConstant(String url) Creates a SafeUrl from the given compile-time constant string url.
static SafeUrl	fromProto(SafeUrlProto proto) Deserializes a SafeUrlProto into a SafeUrl instance.
static SafeUrl	sanitize(String url) Creates a SafeUrl object from the given url, validating that the input string matches a pattern of commonly used safe URLs.
static SafeUrl	sanitize(String url, Set<CustomSafeUrlScheme> extraAllowedSchemes) Creates a SafeUrl object from the given url, validating that the input string matches a pattern of commonly used safe URLs.
static String	sanitizeAsString(String url, String identifier) Sanitizes the given url, validating that the input string matches a pattern of commonly used safe URLs.
static SafeUrlProto	toProto(SafeUrl url) Serializes a SafeUrl into its opaque protocol message representation.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

fromProto

public static SafeUrl fromProto(SafeUrlProto proto)

Deserializes a SafeUrlProto into a SafeUrl instance.

Protocol-message forms are intended to be opaque. The fields of the protocol message should be considered encapsulated and are not intended for direct inspection or manipulation. Protocol message forms of this type should be produced by toProto(SafeUrl) or its equivalent in other implementation languages.

Important: It is unsafe to invoke this method on a protocol message that has been received from an entity outside the application's trust domain. Data coming from the browser is outside the application's trust domain.

toProto

public static SafeUrlProto toProto(SafeUrl url)

Serializes a SafeUrl into its opaque protocol message representation.

Protocol message forms of this type are intended to be opaque. The fields of the returned protocol message should be considered encapsulated and are not intended for direct inspection or manipulation. Protocol messages can be converted back into a SafeUrl using fromProto(SafeUrlProto).

fromConstant

public static SafeUrl fromConstant(@CompileTimeConstant
                                   String url)

Creates a SafeUrl from the given compile-time constant string url.

No runtime validation or sanitization is performed on url; being under application control, it is simply assumed to comply with the SafeUrl contract.

sanitize

public static SafeUrl sanitize(String url)

Creates a SafeUrl object from the given url, validating that the input string matches a pattern of commonly used safe URLs. If url fails validation, this method returns a SafeUrl, SafeUrl.INNOCUOUS, which contains an innocuous string, SafeUrl.INNOCUOUS_STRING.

Specifically, url may be a URL with any of the default safe schemes (http, https, ftp, mailto), or a relative URL (i.e., a URL without a scheme; specifically, a scheme-relative, absolute-path-relative, or path-relative URL).

See Also:

http://url.spec.whatwg.org/#concept-relative-url

sanitize

public static SafeUrl sanitize(String url,
                               Set<CustomSafeUrlScheme> extraAllowedSchemes)

Creates a SafeUrl object from the given url, validating that the input string matches a pattern of commonly used safe URLs. If url fails validation, this method returns a SafeUrl, SafeUrl.INNOCUOUS, which contains an innocuous string, SafeUrl.INNOCUOUS_STRING.

url is sanitized as in sanitize(String), additionally permitting the custom schemes listed in extraAllowedSchemes.

sanitizeAsString

public static String sanitizeAsString(String url,
                                      @CompileTimeConstant
                                      String identifier)

Sanitizes the given url, validating that the input string matches a pattern of commonly used safe URLs. If url fails validation, this method returns about:invalid#identifier, with the given identifier. The identifier allows users to trace a sanitized value to the library that performed the sanitization and hence should be a unique string like "zLibraryNamez".

Specifically, url may be a URL with any of the default safe schemes (http, https, ftp, mailto), or a relative URL (i.e., a URL without a scheme; specifically, a scheme-relative, absolute-path-relative, or path-relative URL).

See Also:

http://url.spec.whatwg.org/#concept-relative-url