How to use

XssFilter

in

com.nhncorp.lucy.security.xss

/**
 * @param value String
 * @return String
 */
@Override
public String doFilter(String value) {
  return filter.doFilter(value);
}

/**
 * 이 메소드는 XssFilter 객체를 리턴한다.
 *
 * @return XssFilter 객체
 * @throws XssFilterException
 *             {@code "lucy-xss.xml"} 로딩 실패 시 발생(malformed인 경우).
 */
public static XssFilter getInstance() throws XssFilterException {
  return getInstance(CONFIG, false);
}

private void serialize(Writer writer, Collection<Content> contents, StringWriter neloLogWriter) throws IOException {
  if (contents != null && !contents.isEmpty()) {
    for (Content content : contents) {
      if (content instanceof Text || content instanceof Description) {
        content.serialize(writer);
      } else if (content instanceof Comment) {
        this.serialize(writer, Comment.class.cast(content));
      } else if (content instanceof IEHackExtensionElement) {
        this.serialize(writer, IEHackExtensionElement.class.cast(content), neloLogWriter);
      } else if (content instanceof Element) {
        this.serialize(writer, Element.class.cast(content), neloLogWriter);
      }
    }
  }
}

private void serialize(Writer writer, Element element, StringWriter neloLogWriter) throws IOException {
  boolean hasAttrXss = false;
  checkRuleRemove(element);
      this.serialize(writer, element.getContents(), neloLogWriter);
      checkRule(element);
      this.serialize(writer, element.getContents(), neloLogWriter);

  return filter;
filter = new XssFilter(XssConfiguration.newInstance(fileName));
  filter.commentFilter = XssFilter.getCommentFilterInstance(filter.config);

if (content instanceof Element) {
  Element tag = Element.class.cast(content);
  this.checkRule(tag);

  /**
   * 이 메소드는 주석 내 태그 필터링을 위한 XssFilter 객체를 리턴한다.
   *
   * @param config
   *            XSS Filter Configuration
   * @return XssFilter 객체
   */
  public static XssFilter getCommentFilterInstance(XssConfiguration config) {

    XssFilter filter = new XssFilter(config);
//        filter.isNeloLogEnabled = filter.config.enableNeloAsyncLog();
    filter.service = filter.config.getService();
    filter.blockingPrefixEnabled = filter.config.isEnableBlockingPrefix();
    filter.blockingPrefix = filter.config.getBlockingPrefix();

    filter.withoutComment = true;
/*        filter.neloElementMSG = ELELMENT_NELO_MSG;
    filter.neloAttrMSG = ATTRIBUTE_NELO_MSG;
    filter.neloElementRemoveMSG = ELELMENT_REMOVE_NELO_MSG;*/

    filter.filteringTagInCommentEnabled = true;

    return filter;
  }
 

public static XssFilter getInstance(boolean withoutComment) throws XssFilterException {
  return getInstance(CONFIG, withoutComment);
}

/**
 * 이 메소드는 XSS({@code Cross Site Scripting})이 포함된 위험한 코드에 대하여 신뢰할 수 있는 코드로
 * 변환하거나, 삭제하는 기능을 제공한다. <br/> {@code "lucy-xss.xml"} 설정(사용자 설정 파일)에 따라 필터링을 수행한다.
 * 사용자 설정 파일을 명시적으로 지정하지 않는 getInstance() 로 필터 객체를 생성했을 경우, lucy-xss-superset.xml 설정을 사용한다.
 *
 * @param dirty
 *            XSS({@code Cross Site Scripting})이 포함된 위험한 코드.
 * @return 신뢰할 수 있는 코드.
 */
public String doFilter(String dirty) {
  StringWriter writer = new StringWriter();
  doFilter(dirty, writer);
  return writer.toString();
}

  this.serialize(writer, contents, neloLogWriter);
} catch (IOException ioe) {

public static XssFilter getInstance(String fileName) throws XssFilterException {
  return getInstance(fileName, false);
}

this.serialize(writer, ie.getContents(), neloLogWriter);
this.serialize(writer, ie.getContents(), neloLogWriter);

/**
 * @param values String[]
 * @return void
 */
@Override
public void init(String[] values) {
  if (values == null || values.length == 0) {
    filter = XssFilter.getInstance();
  } else {
    switch (values.length) {
      case 1:
        if (isBoolean(values[0])) {
          filter = XssFilter.getInstance(convertBoolean(values[0]));	
        } else {
          filter = XssFilter.getInstance(values[0]);
        }
        break;
      case 2:
        filter = XssFilter.getInstance(values[0], convertBoolean(values[1]));	
        break;
      default:
        filter = null;
        break;
    }
  }
}