CODEWITHSUNDEEP
javaowasphtml-sanitizing
programmer
programmer

Reputation: 165

How to sanitize URL-escaped String in Java?

I am using org.owasp.html.PolicyFactory class to build my policy. It sanitizes text like

<script>alert(...);</script>

but does nothing with text like

%3cscript%3ealert(...)%3c/script%3e

One solution is to decode text first:

URLDecoder.decode(oldValue, StandardCharsets.UTF_8)

but I don't know is it the right way to do it, what bugs can appear, in what cases the exceptions will be thrown, etc. Does OWASP library supports such feature?

Upvotes: 1

Views: 1224

Answers (0)

Related Questions