org.owasp.esapi.reference.validation

Class HTMLValidationRule

java.lang.Object

org.owasp.esapi.reference.validation.BaseValidationRule

org.owasp.esapi.reference.validation.StringValidationRule

org.owasp.esapi.reference.validation.HTMLValidationRule

All Implemented Interfaces:

ValidationRule

public class HTMLValidationRule
extends StringValidationRule

A validator performs syntax and possibly semantic validation of a single piece of data from an untrusted source.

Since:

June 1, 2007

Author:

Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security

See Also:

Validator

Field Summary

Fields inherited from class org.owasp.esapi.reference.validation.StringValidationRule

blacklistPatterns, maxLength, minLength, whitelistPatterns

Fields inherited from class org.owasp.esapi.reference.validation.BaseValidationRule

allowNull, encoder

Constructor Summary

Constructors

Constructor and Description
HTMLValidationRule(String typeName)
HTMLValidationRule(String typeName, Encoder encoder)
HTMLValidationRule(String typeName, Encoder encoder, String whitelistPattern)

Method Summary

Modifier and Type	Method and Description
String	getValid(String context, String input) Parse the input, throw exceptions if validation fails
String	sanitize(String context, String input) The method is similar to ValidationRuile.getSafe except that it returns a harmless object that may or may not have any similarity to the original input (in some cases you may not care).

Methods inherited from class org.owasp.esapi.reference.validation.StringValidationRule

addBlacklistPattern, addBlacklistPattern, addWhitelistPattern, addWhitelistPattern, setCanonicalize, setMaximumLength, setMinimumLength

Methods inherited from class org.owasp.esapi.reference.validation.BaseValidationRule

assertValid, charArrayToSet, getEncoder, getSafe, getTypeName, getValid, isAllowNull, isValid, setAllowNull, setEncoder, setTypeName, whitelist, whitelist

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

HTMLValidationRule

public HTMLValidationRule(String typeName)

HTMLValidationRule

public HTMLValidationRule(String typeName,
                          Encoder encoder)

HTMLValidationRule

public HTMLValidationRule(String typeName,
                          Encoder encoder,
                          String whitelistPattern)

Method Detail

getValid

public String getValid(String context,
                       String input)
                throws ValidationException

Parse the input, throw exceptions if validation fails

Specified by:

getValid in interface ValidationRule

Overrides:

getValid in class StringValidationRule

Parameters:

context - for logging

input - the value to be parsed

Returns:

a validated value

Throws:

ValidationException - Thrown if any validation rules fail, except when the ESAPI.properties> property "Validator.HtmlValidationAction" is set to clean. The default ESAPI.properties> property file has "Validator.HtmlValidationAction" is set to throw, which results in a ValidationException being thrown if any of the validation rules fail. releases. See ESAPI GitHub Issues 521 for futher details.

See Also:

ValidationRule.getValid(String context, String input, ValidationErrorList errorList)

sanitize

public String sanitize(String context,
                       String input)

The method is similar to ValidationRuile.getSafe except that it returns a harmless object that may or may not have any similarity to the original input (in some cases you may not care). In most cases this should be the same as the getSafe method only instead of throwing an exception, return some default value.

Overrides:

sanitize in class StringValidationRule

Returns:

a parsed version of the input or a default value.