Skip to content

Commit cdf4221

Browse files
author
chrisisbeef
committed
Issue 34 - Solution Contributed by Ed Schaller (schallee (at) darkmist (dot) net)
http://code.google.com/p/owasp-esapi-java/issues/detail?id=34
1 parent 8d6831b commit cdf4221

5 files changed

Lines changed: 52 additions & 177 deletions

File tree

‎src/main/java/META-INF/esapi.tld‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<!DOCTYPE taglib PUBLIC "-//Sun Microsystems, Inc.//DTD JSP Tag Library 1.1//EN" "http://java.sun.com/j2ee/dtds/web-jsptaglibrary_1_1.dtd">
4+
5+
<taglib>
6+
7+
<tlibversion>2.0</tlibversion>
8+
<jspversion>1.1</jspversion>
9+
10+
<shortname>esapi</shortname>
11+
<uri>http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API</uri>
12+
13+
<tag>
14+
<name>encodeForHTML</name>
15+
<tagclass>org.owasp.esapi.tags.EncodeForHTMLTag</tagclass>
16+
<bodycontent>JSP</bodycontent>
17+
</tag>
18+
19+
<tag>
20+
<name>encodeForJavaScript</name>
21+
<tagclass>org.owasp.esapi.tags.EncodeForHTMLTag</tagclass>
22+
<bodycontent>JSP</bodycontent>
23+
</tag>
24+
25+
<tag>
26+
<name>encodeForHTMLAttribute</name>
27+
<tagclass>org.owasp.esapi.tags.EncodeForHTMLTag</tagclass>
28+
<bodycontent>JSP</bodycontent>
29+
</tag>
30+
31+
<tag>
32+
<name>encodeForVBScript</name>
33+
<tagclass>org.owasp.esapi.tags.EncodeForVBScriptTag</tagclass>
34+
<bodycontent>JSP</bodycontent>
35+
</tag>
36+
37+
</taglib>

‎src/main/java/org/owasp/esapi/tags/EncodeForHTMLAttributeTag.java‎

Lines changed: 4 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
import javax.servlet.jsp.JspTagException;
66
import javax.servlet.jsp.JspWriter;
77
import javax.servlet.jsp.tagext.BodyContent;
8-
import javax.servlet.jsp.tagext.BodyTag;
98
import javax.servlet.jsp.tagext.BodyTagSupport;
109

1110
import org.owasp.esapi.ESAPI;
@@ -20,26 +19,7 @@ public class EncodeForHTMLAttributeTag extends BodyTagSupport {
2019
/**
2120
*
2221
*/
23-
private static final long serialVersionUID = 1L;
24-
private String name;
25-
26-
/**
27-
*
28-
*/
29-
public EncodeForHTMLAttributeTag() {}
30-
31-
32-
33-
/**
34-
*
35-
* @return
36-
*/
37-
public int doStartTag() {
38-
39-
//return EVAL_BODY_TAG; <-- Deprecated
40-
return BodyTag.EVAL_BODY_BUFFERED;
41-
}
42-
22+
private static final long serialVersionUID = 2L;
4323

4424
/**
4525
*
@@ -58,33 +38,14 @@ public int doAfterBody() throws JspTagException {
5838

5939
Encoder e = ESAPI.encoder();
6040

61-
out.println( e.encodeForHTMLAttribute(content) );
41+
out.print( e.encodeForHTMLAttribute(content) );
6242
body.clearBody();
6343

64-
return EVAL_PAGE;
44+
return SKIP_BODY;
6545

6646
} catch (IOException ioe) {
67-
throw new JspTagException("error in encodeForHTML tag doAfterBody()",ioe);
47+
throw new JspTagException("error writing to body's enclosing writer",ioe);
6848
}
6949

7050
}
71-
72-
73-
/**
74-
*
75-
* @return
76-
*/
77-
public String getName() {
78-
return name;
79-
}
80-
81-
/**
82-
*
83-
* @param name
84-
*/
85-
public void setName(String name) {
86-
this.name = name;
87-
}
88-
89-
9051
}

‎src/main/java/org/owasp/esapi/tags/EncodeForHTMLJavaScriptTag.java‎

Lines changed: 4 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
import javax.servlet.jsp.JspTagException;
66
import javax.servlet.jsp.JspWriter;
77
import javax.servlet.jsp.tagext.BodyContent;
8-
import javax.servlet.jsp.tagext.BodyTag;
98
import javax.servlet.jsp.tagext.BodyTagSupport;
109

1110
import org.owasp.esapi.ESAPI;
@@ -20,26 +19,7 @@ public class EncodeForHTMLJavaScriptTag extends BodyTagSupport {
2019
/**
2120
*
2221
*/
23-
private static final long serialVersionUID = 1L;
24-
private String name;
25-
26-
/**
27-
*
28-
*/
29-
public EncodeForHTMLJavaScriptTag() {}
30-
31-
32-
33-
/**
34-
*
35-
* @return
36-
*/
37-
public int doStartTag() {
38-
39-
//return EVAL_BODY_TAG; <-- Deprecated
40-
return BodyTag.EVAL_BODY_BUFFERED;
41-
}
42-
22+
private static final long serialVersionUID = 2L;
4323

4424
/**
4525
*
@@ -58,32 +38,14 @@ public int doAfterBody() throws JspTagException {
5838

5939
Encoder e = ESAPI.encoder();
6040

61-
out.println( e.encodeForJavaScript(content) );
41+
out.print( e.encodeForJavaScript(content) );
6242
body.clearBody();
6343

64-
return EVAL_PAGE;
44+
return SKIP_BODY;
6545

6646
} catch (IOException ioe) {
67-
throw new JspTagException("error in encodeForHTML tag doAfterBody()",ioe);
47+
throw new JspTagException("error writing to body's enclosing writer",ioe);
6848
}
6949

7050
}
71-
72-
73-
/**
74-
*
75-
* @return
76-
*/
77-
public String getName() {
78-
return name;
79-
}
80-
81-
/**
82-
*
83-
* @param name
84-
*/
85-
public void setName(String name) {
86-
this.name = name;
87-
}
88-
8951
}

‎src/main/java/org/owasp/esapi/tags/EncodeForHTMLTag.java‎

Lines changed: 4 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
import javax.servlet.jsp.JspTagException;
66
import javax.servlet.jsp.JspWriter;
77
import javax.servlet.jsp.tagext.BodyContent;
8-
import javax.servlet.jsp.tagext.BodyTag;
98
import javax.servlet.jsp.tagext.BodyTagSupport;
109

1110
import org.owasp.esapi.ESAPI;
@@ -20,25 +19,7 @@ public class EncodeForHTMLTag extends BodyTagSupport {
2019
/**
2120
*
2221
*/
23-
private static final long serialVersionUID = 1L;
24-
private String name;
25-
26-
/**
27-
*
28-
*/
29-
public EncodeForHTMLTag() {}
30-
31-
32-
/**
33-
*
34-
* @return
35-
*/
36-
public int doStartTag() {
37-
38-
//return EVAL_BODY_TAG; <-- Deprecated
39-
return BodyTag.EVAL_BODY_BUFFERED;
40-
}
41-
22+
private static final long serialVersionUID = 2L;
4223

4324
/**
4425
*
@@ -57,33 +38,14 @@ public int doAfterBody() throws JspTagException {
5738

5839
Encoder e = ESAPI.encoder();
5940

60-
out.println( e.encodeForHTML(content) );
41+
out.print( e.encodeForHTML(content) );
6142
body.clearBody();
6243

63-
return EVAL_PAGE;
44+
return SKIP_BODY;
6445

6546
} catch (IOException ioe) {
66-
throw new JspTagException("error in encodeForHTML tag doAfterBody()",ioe);
47+
throw new JspTagException("error writing to body's enclosing writer",ioe);
6748
}
6849

6950
}
70-
71-
72-
/**
73-
*
74-
* @return
75-
*/
76-
public String getName() {
77-
return name;
78-
}
79-
80-
/**
81-
*
82-
* @param name
83-
*/
84-
public void setName(String name) {
85-
this.name = name;
86-
}
87-
88-
8951
}

‎src/main/java/org/owasp/esapi/tags/EncodeForVBScriptTag.java‎

Lines changed: 3 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
import javax.servlet.jsp.JspTagException;
66
import javax.servlet.jsp.JspWriter;
77
import javax.servlet.jsp.tagext.BodyContent;
8-
import javax.servlet.jsp.tagext.BodyTag;
98
import javax.servlet.jsp.tagext.BodyTagSupport;
109

1110
import org.owasp.esapi.ESAPI;
@@ -20,35 +19,7 @@ public class EncodeForVBScriptTag extends BodyTagSupport {
2019
/**
2120
*
2221
*/
23-
private static final long serialVersionUID = 1L;
24-
private String name;
25-
26-
/**
27-
*
28-
*/
29-
public EncodeForVBScriptTag() {}
30-
31-
32-
/**
33-
*
34-
* @return
35-
*/
36-
public int doStartTag() {
37-
38-
//return EVAL_BODY_TAG; <-- Deprecated
39-
return BodyTag.EVAL_BODY_BUFFERED;
40-
41-
}
42-
43-
/**
44-
*
45-
* @return
46-
*/
47-
public int doEndTag() {
48-
49-
return SKIP_BODY;
50-
51-
}
22+
private static final long serialVersionUID = 2L;
5223

5324
/**
5425
*
@@ -67,32 +38,14 @@ public int doAfterBody() throws JspTagException {
6738

6839
try {
6940

70-
out.println( e.encodeForVBScript(content) );
41+
out.print( e.encodeForVBScript(content) );
7142
body.clearBody();
7243

7344
} catch (IOException ioe) {
74-
throw new JspTagException("error in encodeForHTML tag doAfterBody()",ioe);
45+
throw new JspTagException("error writing to body's enclosing writer",ioe);
7546
}
7647

7748
return SKIP_BODY;
7849

7950
}
80-
81-
/**
82-
*
83-
* @return
84-
*/
85-
public String getName() {
86-
return name;
87-
}
88-
89-
/**
90-
*
91-
* @param name
92-
*/
93-
public void setName(String name) {
94-
this.name = name;
95-
}
96-
97-
9851
}

0 commit comments

Comments
 (0)