Top Description Methods
jakarta.mvc.security

public Interface Encoders

Imports
jakarta.mvc.MvcContext
Interface that provides encoders to escape code in JavaScript, HTML, etc. Encoding data is a way to prevent XSS attacks by ensuring it is not misinterpreted as running code. Implementations of this interface are injectable and accessible from EL via the MvcContext class as mvc.encoders.
Author
Santiago Pericas-Geertsen
Since
1.0
See Also
OWASP Encoder Project

Method Summary

Modifier and TypeMethod and Description
public String

Returns:

encoded string.
html(String
string to encode.
s)

Encoding for HTML code in attributes or content.

public String

Returns:

encoded string.
js(String
string to encode.
s)

Encoding for JavaScript code in attributes or script blocks.

Method Detail

htmlback to summary
public String html(String s)

Encoding for HTML code in attributes or content. It MUST support encoding of (at least) the following characters:

Encoding Table
Input CharacterEncoding
&&
<&lt;
>&gt;
"&#34;
'&#39;
Parameters
s:String

string to encode.

Returns:String

encoded string.

jsback to summary
public String js(String s)

Encoding for JavaScript code in attributes or script blocks. It MUST support encoding of (at least) the following characters:

Encoding Table
Input CharacterEncoding
U+0008 (BS)\b
U+0009 (HT)\t
U+000A (LF)\n
U+000C (FF)\f
U+000D (CR)\r
/\/
\\\
"\x22
&\x26
'\x27
U+0000-U001F\x##
Parameters
s:String

string to encode.

Returns:String

encoded string.