Package org.owasp.esapi.codecs

Class XMLEntityCodec

  • All Implemented Interfaces:
    Codec<java.lang.Character>
    public class XMLEntityCodec
extends AbstractCharacterCodec
    Implementation of the Codec interface for XML entity encoding. This differes from HTML entity encoding in that only the following named entities are predefined:
    • lt
    • gt
    • amp
    • apos
    • quot
    However, the XML Specification 1.0 states in section 4.6 "Predefined Entities" that these should still be declared for interoperability purposes. As such, encoding in this class will not use them. It's also worth noting that unlike the HTMLEntityCodec, a trailing semicolon is required and all valid codepoints are accepted. Note that it is a REALLY bad idea to use this for decoding as an XML document can declare arbitrary entities that this Codec has no way of knowing about. Decoding is included for completeness but it's use is not recommended. Use a XML parser instead!

    • Constructor Detail

      • XMLEntityCodec

        public XMLEntityCodec()

    • Method Detail

      • encodeCharacter

        public java.lang.String encodeCharacter​(char[] immune,
                                        java.lang.Character c)
        WARNING!!!! Passing a standard char to this method will resolve to the Encodes a Character using XML entities as necessary.
        Specified by:
        encodeCharacter in interface Codec<java.lang.Character>
        Overrides:
        encodeCharacter in class AbstractCodec<java.lang.Character>
        Parameters:
        immune - characters that should not be encoded as entities
        c - the Character to encode
        Returns:
        the encoded Character
        See Also:
        method instead of this one!!! YOU HAVE BEEN WARNED!!!!

      • decodeCharacter

        public java.lang.Character decodeCharacter​(PushbackSequence<java.lang.Character> input)
        Returns the decoded version of the next character from the input string and advances the current character in the PushbackSequence. If the current character is not encoded, this method MUST reset the PushbackString. Returns the decoded version of the character starting at index, or null if no decoding is possible. Legal formats:
        • &#dddd;
        • &#xhhhh;
        • &name;
        Specified by:
        decodeCharacter in interface Codec<java.lang.Character>
        Overrides:
        decodeCharacter in class AbstractCodec<java.lang.Character>
        Parameters:
        input - the Character to decode
        Returns:
        the decoded Character