org.broadleafcommerce.core.web.security

Class XssFilter

java.lang.Object

org.springframework.web.filter.GenericFilterBean

org.springframework.web.filter.OncePerRequestFilter

org.broadleafcommerce.common.web.filter.AbstractIgnorableOncePerRequestFilter

org.broadleafcommerce.core.web.security.XssFilter

All Implemented Interfaces:

javax.servlet.Filter, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanNameAware, org.springframework.beans.factory.DisposableBean, org.springframework.beans.factory.InitializingBean, org.springframework.context.EnvironmentAware, org.springframework.core.env.EnvironmentCapable, org.springframework.core.Ordered, org.springframework.web.context.ServletContextAware

@ConditionalOnNotAdmin
 @Component(value="blXssFilter")
public class XssFilter
extends AbstractIgnorableOncePerRequestFilter

Field Summary

Fields

Modifier and Type	Field and Description
protected org.springframework.core.env.Environment	environment
protected boolean	siteXssWrapperEnabled
protected String[]	whiteListParamNames
protected String[]	whiteListUris

Fields inherited from class org.springframework.web.filter.OncePerRequestFilter

ALREADY_FILTERED_SUFFIX

Fields inherited from class org.springframework.web.filter.GenericFilterBean

logger

Fields inherited from interface org.springframework.core.Ordered

HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

Constructor Summary

Constructors

Constructor and Description
XssFilter()

Method Summary

Modifier and Type	Method and Description
void	destroy()
protected void	doFilterInternalUnlessIgnored(javax.servlet.http.HttpServletRequest httpServletRequest, javax.servlet.http.HttpServletResponse httpServletResponse, javax.servlet.FilterChain filterChain)
int	getOrder()
void	init()
protected boolean	isWhiteListUrl(String requestURI)
protected XssRequestWrapper	wrapRequest(javax.servlet.http.HttpServletRequest httpServletRequest)

Methods inherited from class org.broadleafcommerce.common.web.filter.AbstractIgnorableOncePerRequestFilter

doFilterInternal, isIgnored

Methods inherited from class org.springframework.web.filter.OncePerRequestFilter

doFilter, doFilterNestedErrorDispatch, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted, shouldNotFilter, shouldNotFilterAsyncDispatch, shouldNotFilterErrorDispatch

Methods inherited from class org.springframework.web.filter.GenericFilterBean

addRequiredProperty, afterPropertiesSet, createEnvironment, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

environment

@Autowired
protected org.springframework.core.env.Environment environment

siteXssWrapperEnabled

@Value(value="${blc.site.enable.xssWrapper:false}")
protected boolean siteXssWrapperEnabled

whiteListUris

protected String[] whiteListUris

whiteListParamNames

protected String[] whiteListParamNames

Constructor Detail

XssFilter

public XssFilter()

Method Detail

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter

Specified by:

destroy in interface org.springframework.beans.factory.DisposableBean

Overrides:

destroy in class org.springframework.web.filter.GenericFilterBean

init

@PostConstruct
public void init()

doFilterInternalUnlessIgnored

protected void doFilterInternalUnlessIgnored(javax.servlet.http.HttpServletRequest httpServletRequest,
                                             javax.servlet.http.HttpServletResponse httpServletResponse,
                                             javax.servlet.FilterChain filterChain)
                                      throws IOException,
                                             javax.servlet.ServletException

Specified by:

doFilterInternalUnlessIgnored in class AbstractIgnorableOncePerRequestFilter

Throws:

IOException

javax.servlet.ServletException

wrapRequest

protected XssRequestWrapper wrapRequest(javax.servlet.http.HttpServletRequest httpServletRequest)

isWhiteListUrl

protected boolean isWhiteListUrl(String requestURI)

getOrder

public int getOrder()