Markup language for Java that is XSS safe

Question

I'm writing a java webapp and I'd like to let my users enter text containing markup that is XSS / Cross-Site-Scripting safe. I'd like to save the user generated markup to a database and display it as HTML.

I am aware of markdown but this allows raw HTML to be entered which is not XSS safe.

Are there any wiki-like / markdown-like interpreters in java that are XSS safe? I'd also like to hear of any javascript / wysiwig editors that might help here.

Alternatively, are there any XSS filters in java that can sanitize HTML so that it is XSS safe.

Answer 1

Take a look at JSoup, which allows you to specify a Whitelist: http://jsoup.org/cookbook/cleaning-html/whitelist-sanitizer

Answer 2

I use Markdown (actually Pegdown) together with Jsoup which works well.

Jsoup...

• cleans user-submitted content against a safe white-list, to prevent XSS attacks.
• output tidy HTML