AfflictionNetworks/samskivert
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tightened up restrictHTML regexes to prevent <\!-- or unclosed " html defacement

Browse Source 
git-svn-id: https://samskivert.googlecode.com/svn/trunk@1691 6335cc39-0255-0410-8fd6-9bcaacd3b74c
This commit is contained in:
elizabeth
2005-08-08 23:12:59 +00:00
parent f359b77ff5
commit f19198cbce
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
projects/samskivert/src/java/com/samskivert/util/StringUtil.java
+7 -3
View File
@@ -166,16 +166,20 @@ public class StringUtil
allow.add("<b>"); allow.add("</b>");
allow.add("<i>"); allow.add("</i>");
allow.add("<u>"); allow.add("</u>");
allow.add("<font [^<>]*[^<>-]>"); allow.add("</font>");
allow.add("<font [^\"<>!-]*(\"[^\"<>!-]*\"[^\"<>!-]*)*>");
allow.add("</font>");
allow.add("<br>"); allow.add("</br>");
allow.add("<p>"); allow.add("</p>");
allow.add("<hr>"); allow.add("</hr>");
}
if (allowImages) {
allow.add("<img [^<>]*[^<>-]>"); allow.add("</img>");
// Until I find a way to disallow "---", no - can be in a url
allow.add("<img [^\"<>!-]*(\"[^\"<>!-]*\"[^\"<>!-]*)*>");
allow.add("</img>");
}
if (allowLinks) {
allow.add("<a href=[^<>]*[^<>-]>"); allow.add("</a>");
allow.add("<a href=[^\"<>!-]*(\"[^\"<>!-]*\"[^\"<>!-]*)*>");
allow.add("</a>");
}
String[] regexes = new String[allow.size()];