UrlQuerySanitizer

UrlQuerySanitizer

UrlQuerySanitizer ()

Constructs a UrlQuerySanitizer.

Defaults:

• unregistered parameters are not allowed.
• the last instance of a repeated parameter is preferred.
• The default value sanitizer is an AllIllegal value sanitizer.

UrlQuerySanitizer

UrlQuerySanitizer (String url)

Constructs a UrlQuerySanitizer and parse a URL. This constructor is provided for convenience when the default parsing behavior is acceptable.

Because the URL is parsed before the constructor returns, there isn't a chance to configure the sanitizer to change the parsing behavior.

UrlQuerySanitizer sanitizer = new UrlQuerySanitizer(myUrl); String name = sanitizer.getValue("name");

Defaults:

• unregistered parameters are allowed.
• the last instance of a repeated parameter is preferred.
• The default value sanitizer is an AllIllegal value sanitizer.

  Parameters
  url	String

getAllButNulAndAngleBracketsLegal

UrlQuerySanitizer.ValueSanitizer getAllButNulAndAngleBracketsLegal ()

Return a value sanitizer that allows any special characters except angle brackets ('<' and '>') and Nul ('\0'). Allows script URLs.

getAllButNulLegal

UrlQuerySanitizer.ValueSanitizer getAllButNulLegal ()

Return a value sanitizer that allows everything except Nul ('\0') characters. Script URLs are allowed.

getAllButWhitespaceLegal

UrlQuerySanitizer.ValueSanitizer getAllButWhitespaceLegal ()

Return a value sanitizer that allows everything except Nul ('\0') characters, space (' '), and other whitespace characters. Script URLs are allowed.

getAllIllegal

UrlQuerySanitizer.ValueSanitizer getAllIllegal ()

Return a value sanitizer that does not allow any special characters, and also does not allow script URLs.

getAllowUnregisteredParamaters

boolean getAllowUnregisteredParamaters ()

Get whether or not unregistered parameters are allowed. If not allowed, they will be dropped when a query is parsed.

getAmpAndSpaceLegal

UrlQuerySanitizer.ValueSanitizer getAmpAndSpaceLegal ()

Return a value sanitizer that does not allow any special characters except ampersand ('&') and space (' '). Does not allow script URLs.

getAmpLegal

UrlQuerySanitizer.ValueSanitizer getAmpLegal ()

Return a value sanitizer that does not allow any special characters except ampersand ('&'). Does not allow script URLs.

getEffectiveValueSanitizer

UrlQuerySanitizer.ValueSanitizer getEffectiveValueSanitizer (String parameter)

Get the effective value sanitizer for a parameter. Like getValueSanitizer, except if there is no value sanitizer registered for a parameter, and unregistered paramaters are allowed, then the default value sanitizer is returned.

getParameterList

List<UrlQuerySanitizer.ParameterValuePair> getParameterList ()

An array list of all of the parameter value pairs in the sanitized query, in the order they appeared in the query. May contain duplicate parameters.

Note: Do not modify this list. Treat it as a read-only list.

getParameterSet

Set<String> getParameterSet ()

Get a set of all of the parameters found in the sanitized query.

Note: Do not modify this set. Treat it as a read-only set.

getPreferFirstRepeatedParameter

boolean getPreferFirstRepeatedParameter ()

Get whether or not the first occurrence of a repeated parameter is preferred.

getSpaceLegal

UrlQuerySanitizer.ValueSanitizer getSpaceLegal ()

Return a value sanitizer that does not allow any special characters except space (' '). Does not allow script URLs.

getUnregisteredParameterValueSanitizer

UrlQuerySanitizer.ValueSanitizer getUnregisteredParameterValueSanitizer ()

Get the current value sanitizer used when processing unregistered parameter values.

Note: The default unregistered parameter value sanitizer is one that doesn't allow any special characters, similar to what is returned by calling createAllIllegal.

getUrlAndSpaceLegal

UrlQuerySanitizer.ValueSanitizer getUrlAndSpaceLegal ()

Return a value sanitizer that allows all the characters used by encoded URLs and allows spaces, which are not technically legal in encoded URLs, but commonly appear anyway. Does not allow script URLs.

getUrlLegal

UrlQuerySanitizer.ValueSanitizer getUrlLegal ()

Return a value sanitizer that allows all the characters used by encoded URLs. Does not allow script URLs.

getValue

String getValue (String parameter)

Get the value for a parameter in the current sanitized query. Returns null if the parameter does not exit.

getValueSanitizer

UrlQuerySanitizer.ValueSanitizer getValueSanitizer (String parameter)

Get the value sanitizer for a parameter. Returns null if there is no value sanitizer registered for the parameter.

hasParameter

boolean hasParameter (String parameter)

Check if a parameter exists in the current sanitized query.

parseQuery

void parseQuery (String query)

Parse a query. A query string is any number of parameter-value clauses separated by any non-zero number of ampersands. A parameter-value clause is a parameter followed by an equal sign, followed by a value. If the equal sign is missing, the value is assumed to be the empty string.

parseUrl

void parseUrl (String url)

Parse the query parameters out of an encoded URL. Works by extracting the query portion from the URL and then calling parseQuery(). If there is no query portion it is treated as if the query portion is an empty string.

registerParameter

void registerParameter (String parameter, 
                UrlQuerySanitizer.ValueSanitizer valueSanitizer)

Register a value sanitizer for a particular parameter. Can also be used to replace or remove an already-set value sanitizer.

Registering a non-null value sanitizer for a particular parameter makes that parameter a registered parameter.

registerParameters

void registerParameters (String[] parameters, 
                UrlQuerySanitizer.ValueSanitizer valueSanitizer)

Register a value sanitizer for an array of parameters.

setAllowUnregisteredParamaters

void setAllowUnregisteredParamaters (boolean allowUnregisteredParamaters)

Set whether or not unregistered parameters are allowed. If they are not allowed, then they will be dropped when a query is sanitized.

Defaults to false.

setPreferFirstRepeatedParameter

void setPreferFirstRepeatedParameter (boolean preferFirstRepeatedParameter)

Set whether or not the first occurrence of a repeated parameter is preferred. True means the first repeated parameter is preferred. False means that the last repeated parameter is preferred.

The preferred parameter is the one that is returned when getParameter is called.

defaults to false.

setUnregisteredParameterValueSanitizer

void setUnregisteredParameterValueSanitizer (UrlQuerySanitizer.ValueSanitizer sanitizer)

Set the value sanitizer used when processing unregistered parameter values.

unescape

String unescape (String string)

Unescape an escaped string.

• '+' characters are replaced by ' ' characters.
• Valid "%xx" escape sequences are replaced by the corresponding unescaped character.
• Invalid escape sequences such as %1z", are passed through unchanged.

  Parameters
  string	String: the escaped string

  Returns
  String	the unescaped string.

addSanitizedEntry

void addSanitizedEntry (String parameter, 
                String value)

Record a sanitized parameter-value pair. Override if you want to do additional filtering or validation.

clear

void clear ()

Clear the existing entries. Called to get ready to parse a new query string.

decodeHexDigit

int decodeHexDigit (char c)

Convert a character that represents a hexidecimal digit into an integer. If the character is not a hexidecimal digit, then -1 is returned. Both upper case and lower case hex digits are allowed.

isHexDigit

boolean isHexDigit (char c)

Test if a character is a hexidecimal digit. Both upper case and lower case hex digits are allowed.

parseEntry

void parseEntry (String parameter, 
                String value)

Parse an escaped parameter-value pair. The default implementation unescapes both the parameter and the value, then looks up the effective value sanitizer for the parameter and uses it to sanitize the value. If all goes well then addSanitizedValue is called with the unescaped parameter and the sanitized unescaped value.