org.owasp.esapi.codecs

Class XMLEntityCodec

java.lang.Object

org.owasp.esapi.codecs.Codec

org.owasp.esapi.codecs.XMLEntityCodec

public class XMLEntityCodec
extends Codec

Implementation of the Codec interface for XML entity encoding. This differes from HTML entity encoding in that only the following named entities are predefined:

• lt
• gt
• amp
• apos
• quot

However, the XML Specification 1.0 states in section 4.6 "Predefined Entities" that these should still be declared for interoperability purposes. As such, encoding in this class will not use them. It's also worth noting that unlike the HTMLEntityCodec, a trailing semicolon is required and all valid codepoints are accepted. Note that it is a REALLY bad idea to use this for decoding as an XML document can declare arbitrary entities that this Codec has no way of knowing about. Decoding is included for completeness but it's use is not recommended. Use a XML parser instead!

Field Summary

Fields

Modifier and Type	Field and Description
private static java.lang.String	ALPHA_NUMERIC_STR
private static HashTrie<java.lang.Character>	entityToCharacterMap
private static java.util.Set<java.lang.Character>	UNENCODED_SET
private static java.lang.String	UNENCODED_STR

Constructor Summary

Constructors

Constructor and Description
XMLEntityCodec()

Method Summary

Modifier and Type	Method and Description
java.lang.Character	decodeCharacter(PushbackString input) Returns the decoded version of the next character from the input string and advances the current character in the PushbackString.
java.lang.String	encodeCharacter(char[] immune, java.lang.Character c) Default implementation that should be overridden in specific codecs.
private java.lang.Character	getNamedEntity(PushbackString input) Converts the rest of a named entity to a character.
private static java.lang.Character	getNumericEntity(PushbackString input) Converts the rest of a numeric entity to a character.
private static java.lang.Character	int2char(int i) Convert a integer code point to a Character.
private static java.lang.Character	parseHex(PushbackString input) Converts the rest of a hexidecimal numeric entity to a character.
private static java.lang.Character	parseNumber(PushbackString input) Converts the rest of a decimal numeric entity to a character.

Methods inherited from class org.owasp.esapi.codecs.Codec

containsCharacter, decode, encode, getHexForNonAlphanumeric, toHex, toOctal

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

ALPHA_NUMERIC_STR

private static final java.lang.String ALPHA_NUMERIC_STR

See Also:

Constant Field Values

UNENCODED_STR

private static final java.lang.String UNENCODED_STR

See Also:

Constant Field Values

UNENCODED_SET

private static final java.util.Set<java.lang.Character> UNENCODED_SET

entityToCharacterMap

private static final HashTrie<java.lang.Character> entityToCharacterMap

Constructor Detail

XMLEntityCodec

public XMLEntityCodec()

Method Detail

encodeCharacter

public java.lang.String encodeCharacter(char[] immune,
                                        java.lang.Character c)

Default implementation that should be overridden in specific codecs. Encodes a Character using XML entities as necessary.

Overrides:

encodeCharacter in class Codec

Parameters:

immune - characters that should not be encoded as entities

c - the Character to encode

Returns:

the encoded Character

decodeCharacter

public java.lang.Character decodeCharacter(PushbackString input)

Returns the decoded version of the next character from the input string and advances the current character in the PushbackString. If the current character is not encoded, this method MUST reset the PushbackString. Returns the decoded version of the character starting at index, or null if no decoding is possible. Legal formats:

• &#dddd;
• &#xhhhh;
• &name;

Overrides:

decodeCharacter in class Codec

Parameters:

input - the Character to decode

Returns:

the decoded Character

getNumericEntity

private static java.lang.Character getNumericEntity(PushbackString input)

Converts the rest of a numeric entity to a character.

Parameters:

input - The input to read from. It is assumed that input is positioned at the character after the &#

Returns:

The character decoded or null on failure.

int2char

private static java.lang.Character int2char(int i)

Convert a integer code point to a Character.

Parameters:

i - the integer

Returns:

i as a Character or null if i is a invalid code point or outside of the Java char range.

parseNumber

private static java.lang.Character parseNumber(PushbackString input)

Converts the rest of a decimal numeric entity to a character.

Parameters:

input - The input to read from. It is assumed that input is positioned at the character after the &# and that the next char is not a 'x' or 'X'.

Returns:

The character decoded or null on failutre.

parseHex

private static java.lang.Character parseHex(PushbackString input)

Converts the rest of a hexidecimal numeric entity to a character.

Parameters:

input - The input to read from. It is assumed that input is positioned at the character after the &#[xX]

Returns:

The character decoded or null on failutre.

getNamedEntity

private java.lang.Character getNamedEntity(PushbackString input)

Converts the rest of a named entity to a character. null if no decoding is possible.

Parameters:

input - The input to read from. It is assumed that input is positioned at the character after the &.

Returns:

The character decoded or null on failutre.