forked from ESAPI/esapi-java-legacy
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathCSSCodec.java
More file actions
131 lines (116 loc) · 3.56 KB
/
Copy pathCSSCodec.java
File metadata and controls
131 lines (116 loc) · 3.56 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
/**
* OWASP Enterprise Security API (ESAPI)
*
* This file is part of the Open Web Application Security Project (OWASP)
* Enterprise Security API (ESAPI) project. For details, please see
* <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
*
* Copyright (c) 2007 - The OWASP Foundation
*
* The ESAPI is published by OWASP under the BSD license. You should read and accept the
* LICENSE before you use, modify, and/or redistribute this software.
*
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
* @created 2007
*/
package org.owasp.esapi.codecs;
/**
* Implementation of the Codec interface for backslash encoding frequently used in JavaScript.
*
* @author Jeff Williams (jeff.williams .at. aspectsecurity.com) <a
* href="http://www.aspectsecurity.com">Aspect Security</a>
* @since June 1, 2007
* @see org.owasp.esapi.Encoder
*/
public class CSSCodec implements Codec {
public CSSCodec() {
}
public String encode( String input ) {
StringBuffer sb = new StringBuffer();
for ( int i=0; i<input.length(); i++ ) {
char c = input.charAt(i);
sb.append( encodeCharacter( new Character( c ) ) );
}
return sb.toString();
}
/**
* Returns backslash encoded character. This implementation does not support
* \\### Latin encoded characters in octal as it is not in ECMAScript v3.
*/
public String encodeCharacter( Character c ) {
char ch = c.charValue();
// encode up to 256 \x syntax
if ( ch <= 256 ) {
return "\\" + ch;
}
// otherwise encode with \\HHHHHH
String temp = Integer.toHexString((int)ch);
return "\\" + temp.toUpperCase() + " ";
}
public String decode( String input ) {
StringBuffer sb = new StringBuffer();
PushbackString pbs = new PushbackString( input );
while ( pbs.hasNext() ) {
Character c = decodeCharacter( pbs );
if ( c != null ) {
sb.append( c );
} else {
sb.append( pbs.next() );
}
}
return sb.toString();
}
/**
* Returns the decoded version of the character starting at index, or
* null if no decoding is possible.
*
* Formats all are legal both upper/lower case:
* \\x - special characters
* \\HHHH
*/
public Character decodeCharacter( PushbackString input ) {
input.mark();
Character first = input.next();
if ( first == null ) {
input.reset();
return null;
}
// if this is not an encoded character, return null
if ( first.charValue() != '\\' ) {
input.reset();
return null;
}
Character second = input.next();
if ( second == null ) {
input.reset();
return null;
}
// look for \HHH format
if ( input.isHexDigit( second ) ) {
// Search for up to 6 hex digits following until a space
StringBuffer sb = new StringBuffer();
sb.append( second );
for ( int i=0; i<5; i++ ) {
Character c = input.next();
if ( c == null || c.charValue() == 0x20 ) break;
if ( input.isHexDigit(c) ) {
sb.append( c );
} else {
input.pushback( c );
break;
}
}
try {
// parse the hex digit and create a character
int i = Integer.parseInt(sb.toString(), 16);
// TODO: in Java 1.5 you can test whether this is a valid code point
// with Character.isValidCodePoint() et al.
return new Character( (char)i );
} catch( NumberFormatException e ) {
// throw an exception for malformed entity?
// just continue which will reset and return null
}
}
return second;
}
}