Package org.broadleafcommerce.core.web.security

Class XssFilter

java.lang.Object
org.springframework.web.filter.GenericFilterBean
org.springframework.web.filter.OncePerRequestFilter
org.broadleafcommerce.common.web.filter.AbstractIgnorableOncePerRequestFilter
org.broadleafcommerce.core.web.security.XssFilter
All Implemented Interfaces:
jakarta.servlet.Filter, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanNameAware, org.springframework.beans.factory.DisposableBean, org.springframework.beans.factory.InitializingBean, org.springframework.context.EnvironmentAware, org.springframework.core.env.EnvironmentCapable, org.springframework.core.Ordered, org.springframework.web.context.ServletContextAware
@ConditionalOnNotAdmin @Component("blXssFilter") public class XssFilter extends AbstractIgnorableOncePerRequestFilter

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    protected org.springframework.core.env.Environment
    environment
     
    protected boolean
    siteXssWrapperEnabled
     
    protected String[]
    whiteListParamNames
     
    protected String[]
    whiteListUris
     

    Fields inherited from class org.springframework.web.filter.OncePerRequestFilter

    ALREADY_FILTERED_SUFFIX

    Fields inherited from class org.springframework.web.filter.GenericFilterBean

    logger

    Fields inherited from interface org.springframework.core.Ordered

    HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

  • Constructor Summary

    Constructors
    Constructor
    Description
    XssFilter()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    destroy()
     
    protected void
    doFilterInternalUnlessIgnored(jakarta.servlet.http.HttpServletRequest httpServletRequest, jakarta.servlet.http.HttpServletResponse httpServletResponse, jakarta.servlet.FilterChain filterChain)
     
    int
    getOrder()
     
    void
    init()
     
    protected boolean
    isWhiteListUrl(String requestURI)
     
    protected XssRequestWrapper
    wrapRequest(jakarta.servlet.http.HttpServletRequest httpServletRequest)
     

    Methods inherited from class org.broadleafcommerce.common.web.filter.AbstractIgnorableOncePerRequestFilter

    doFilterInternal, isIgnored

    Methods inherited from class org.springframework.web.filter.OncePerRequestFilter

    doFilter, doFilterNestedErrorDispatch, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted, shouldNotFilter, shouldNotFilterAsyncDispatch, shouldNotFilterErrorDispatch

    Methods inherited from class org.springframework.web.filter.GenericFilterBean

    addRequiredProperty, afterPropertiesSet, createEnvironment, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • environment

      @Autowired protected org.springframework.core.env.Environment environment

    • siteXssWrapperEnabled

      @Value("${blc.site.enable.xssWrapper:false}") protected boolean siteXssWrapperEnabled

    • whiteListUris

      protected String[] whiteListUris

    • whiteListParamNames

      protected String[] whiteListParamNames

  • Constructor Details

    • XssFilter

      public XssFilter()

  • Method Details

    • destroy

      public void destroy()
      Specified by:
      destroy in interface org.springframework.beans.factory.DisposableBean
      Specified by:
      destroy in interface jakarta.servlet.Filter
      Overrides:
      destroy in class org.springframework.web.filter.GenericFilterBean

    • init

      @PostConstruct public void init()

    • doFilterInternalUnlessIgnored

      protected void doFilterInternalUnlessIgnored(jakarta.servlet.http.HttpServletRequest httpServletRequest, jakarta.servlet.http.HttpServletResponse httpServletResponse, jakarta.servlet.FilterChain filterChain) throws IOException, jakarta.servlet.ServletException
      Specified by:
      doFilterInternalUnlessIgnored in class AbstractIgnorableOncePerRequestFilter
      Throws:
      IOException
      jakarta.servlet.ServletException

    • wrapRequest

      protected XssRequestWrapper wrapRequest(jakarta.servlet.http.HttpServletRequest httpServletRequest)

    • isWhiteListUrl

      protected boolean isWhiteListUrl(String requestURI)

    • getOrder

      public int getOrder()