Top Description Inners Fields Constructors Methods
org.apache.catalina.filters

public Class AddDefaultCharsetFilter

extends FilterBase
Class Inheritance
Imports
java.io.IOException, java.nio.charset.Charset, jakarta.servlet.FilterChain, .FilterConfig, .ServletException, .ServletRequest, .ServletResponse, jakarta.servlet.http.HttpServletResponse, .HttpServletResponseWrapper, org.apache.juli.logging.Log, .LogFactory

Filter that explicitly sets the default character set for media subtypes of the "text" type to ISO-8859-1, or another user defined character set. RFC2616 explicitly states that browsers must use ISO-8859-1 if no character set is defined for media with subtype "text". However, browsers may attempt to auto-detect the character set. This may be exploited by an attacker to perform an XSS attack. Internet Explorer has this behaviour by default. Other browsers have an option to enable it.
This filter prevents the attack by explicitly setting a character set. Unless the provided character set is explicitly overridden by the user - in which case they deserve everything they get - the browser will adhere to an explicitly set character set, thus preventing the XSS attack.

Nested and Inner Type Summary

Modifier and TypeClass and Description
public static class
AddDefaultCharsetFilter.ResponseWrapper

Wrapper that adds a character set for text media types if no character set is specified.

Field Summary

Modifier and TypeField and Description
private static final String
private String
private final Log
Inherited from org.apache.catalina.filters.FilterBase:
sm

Constructor Summary

AccessConstructor and Description
public

Method Summary

Modifier and TypeMethod and Description
public void
doFilter(ServletRequest
The request to process
request
,
ServletResponse
The response associated with the request
response
,
FilterChain
Provides access to the next filter in the chain for this filter to pass the request and response to for further processing
chain
)

Implements jakarta.servlet.Filter.doFilter.

The doFilter method of the Filter is called by the container each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain.

protected Log
public void
init(FilterConfig
The configuration information associated with the filter instance being initialised
filterConfig
)

Overrides org.apache.catalina.filters.FilterBase.init.

Overrides default jakarta.servlet.Filter.init.

Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.

public void
setEncoding(String encoding)

Inherited from org.apache.catalina.filters.FilterBase:
isConfigProblemFatal

Field Detail

DEFAULT_ENCODINGback to summary
private static final String DEFAULT_ENCODING
encodingback to summary
private String encoding
logback to summary
private final Log log

Constructor Detail

AddDefaultCharsetFilterback to summary
public AddDefaultCharsetFilter()

Method Detail

doFilterback to summary
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException

Implements jakarta.servlet.Filter.doFilter.

Doc from jakarta.servlet.Filter.doFilter.

The doFilter method of the Filter is called by the container each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain. The FilterChain passed in to this method allows the Filter to pass on the request and response to the next entity in the chain.

A typical implementation of this method would follow the following pattern:-
1. Examine the request
2. Optionally wrap the request object with a custom implementation to filter content or headers for input filtering
3. Optionally wrap the response object with a custom implementation to filter content or headers for output filtering
4. a) Either invoke the next entity in the chain using the FilterChain object (chain.doFilter()),
4. b) or not pass on the request/response pair to the next entity in the filter chain to block the request processing
5. Directly set headers on the response after invocation of the next entity in the filter chain.

Parameters
request:ServletRequest

The request to process

response:ServletResponse

The response associated with the request

chain:FilterChain

Provides access to the next filter in the chain for this filter to pass the request and response to for further processing

Annotations
@Override
Exceptions
IOException:
if an I/O error occurs during this filter's processing of the request
ServletException:
if the processing fails for any other reason
getLoggerback to summary
protected Log getLogger()

Implements abstract org.apache.catalina.filters.FilterBase.getLogger.

Annotations
@Override
initback to summary
public void init(FilterConfig filterConfig) throws ServletException

Overrides org.apache.catalina.filters.FilterBase.init.

Overrides default jakarta.servlet.Filter.init.

Doc from org.apache.catalina.filters.FilterBase.init.

Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.

Parameters
filterConfig:FilterConfig

The configuration information associated with the filter instance being initialised

Annotations
@Override
Exceptions
ServletException:
if isConfigProblemFatal() returns true and a configured parameter does not have a matching setter
setEncodingback to summary
public void setEncoding(String encoding)
org.apache.catalina.filters back to summary

public Class AddDefaultCharsetFilter.ResponseWrapper

extends HttpServletResponseWrapper
Class Inheritance

Wrapper that adds a character set for text media types if no character set is specified.

Field Summary

Modifier and TypeField and Description
private String

Constructor Summary

AccessConstructor and Description
public

Method Summary

Modifier and TypeMethod and Description
public void
addHeader(String
the name of the header
name
,
String
the additional header value If it contains octet string, it should be encoded according to RFC 2047 (http://www.ietf.org/rfc/rfc2047.txt)
value
)

Overrides jakarta.servlet.http.HttpServletResponseWrapper.addHeader.

Implements jakarta.servlet.http.HttpServletResponse.addHeader.

The default behavior of this method is to return addHeader(String name, String value) on the wrapped response object.

public void
setCharacterEncoding(String
a String specifying only the character set defined by IANA Character Sets (http://www.iana.org/assignments/character-sets)
charset
)

Overrides jakarta.servlet.ServletResponseWrapper.setCharacterEncoding.

Implements jakarta.servlet.ServletResponse.setCharacterEncoding.

Sets the character encoding (MIME charset) of the response being sent to the client, for example, to UTF-8.

public void
setContentType(String
a String specifying the MIME type of the content
contentType
)

Overrides jakarta.servlet.ServletResponseWrapper.setContentType.

Implements jakarta.servlet.ServletResponse.setContentType.

Sets the content type of the response being sent to the client, if the response has not been committed yet.

public void
setHeader(String
the name of the header
name
,
String
the header value If it contains octet string, it should be encoded according to RFC 2047 (http://www.ietf.org/rfc/rfc2047.txt)
value
)

Overrides jakarta.servlet.http.HttpServletResponseWrapper.setHeader.

Implements jakarta.servlet.http.HttpServletResponse.setHeader.

The default behavior of this method is to return setHeader(String name, String value) on the wrapped response object.

Inherited from jakarta.servlet.http.HttpServletResponseWrapper:
addCookieaddDateHeaderaddIntHeadercontainsHeaderencodeRedirectURLencodeURLgetHeadergetHeaderNamesgetHeadersgetStatusgetTrailerFieldssendErrorsendErrorsendRedirectsetDateHeadersetIntHeadersetStatussetTrailerFields

Field Detail

encodingback to summary
private String encoding

Constructor Detail

ResponseWrapperback to summary
public ResponseWrapper(HttpServletResponse response, String encoding)

Method Detail

addHeaderback to summary
public void addHeader(String name, String value)

Overrides jakarta.servlet.http.HttpServletResponseWrapper.addHeader.

Implements jakarta.servlet.http.HttpServletResponse.addHeader.

Doc from jakarta.servlet.http.HttpServletResponseWrapper.addHeader.

The default behavior of this method is to return addHeader(String name, String value) on the wrapped response object.

Parameters
name:String

Doc from jakarta.servlet.http.HttpServletResponse.addHeader.

the name of the header

value:String

Doc from jakarta.servlet.http.HttpServletResponse.addHeader.

the additional header value If it contains octet string, it should be encoded according to RFC 2047 (http://www.ietf.org/rfc/rfc2047.txt)

Annotations
@Override
setCharacterEncodingback to summary
public void setCharacterEncoding(String charset)

Overrides jakarta.servlet.ServletResponseWrapper.setCharacterEncoding.

Implements jakarta.servlet.ServletResponse.setCharacterEncoding.

Doc from jakarta.servlet.ServletResponse.setCharacterEncoding.

Sets the character encoding (MIME charset) of the response being sent to the client, for example, to UTF-8. If the character encoding has already been set by container default, ServletContext default, setContentType or setLocale, this method overrides it. Calling setContentType with the String of text/html and calling this method with the String of UTF-8 is equivalent with calling setContentType with the String of text/html; charset=UTF-8.

This method can be called repeatedly to change the character encoding. This method has no effect if it is called after getWriter has been called or after the response has been committed.

Containers must communicate the character encoding used for the servlet response's writer to the client if the protocol provides a way for doing so. In the case of HTTP, the character encoding is communicated as part of the Content-Type header for text media types. Note that the character encoding cannot be communicated via HTTP headers if the servlet does not specify a content type; however, it is still used to encode text written via the servlet response's writer.

Parameters
charset:String

a String specifying only the character set defined by IANA Character Sets (http://www.iana.org/assignments/character-sets)

Annotations
@Override
setContentTypeback to summary
public void setContentType(String contentType)

Overrides jakarta.servlet.ServletResponseWrapper.setContentType.

Implements jakarta.servlet.ServletResponse.setContentType.

Doc from jakarta.servlet.ServletResponse.setContentType.

Sets the content type of the response being sent to the client, if the response has not been committed yet. The given content type may include a character encoding specification, for example, text/html;charset=UTF-8. The response's character encoding is only set from the given content type if this method is called before getWriter is called.

This method may be called repeatedly to change content type and character encoding. This method has no effect if called after the response has been committed. It does not set the response's character encoding if it is called after getWriter has been called or after the response has been committed.

Containers must communicate the content type and the character encoding used for the servlet response's writer to the client if the protocol provides a way for doing so. In the case of HTTP, the Content-Type header is used.

Parameters
contentType:String

a String specifying the MIME type of the content

Annotations
@Override
setHeaderback to summary
public void setHeader(String name, String value)

Overrides jakarta.servlet.http.HttpServletResponseWrapper.setHeader.

Implements jakarta.servlet.http.HttpServletResponse.setHeader.

Doc from jakarta.servlet.http.HttpServletResponseWrapper.setHeader.

The default behavior of this method is to return setHeader(String name, String value) on the wrapped response object.

Parameters
name:String

Doc from jakarta.servlet.http.HttpServletResponse.setHeader.

the name of the header

value:String

Doc from jakarta.servlet.http.HttpServletResponse.setHeader.

the header value If it contains octet string, it should be encoded according to RFC 2047 (http://www.ietf.org/rfc/rfc2047.txt)

Annotations
@Override