Comments (5)
Are you generating HTML with the result? In that case, you need to take care to properly escape URLs (and the rest of the text).
from autolink-java.
Thanks.
-
When you say "properly escape URLs", do you mean encoding the URLs that I find via
autolink-java
(i.e.:new URI(...)
)? -
When you say "escape...the rest of the text", what should I escape? The text has already been cleaned of
html
to ensure that it's only plain text.
Thanks.
from autolink-java.
-
So let's say you have a link that looks like this:
http://example.com/foo_"bar"_baz
.If you just generate a
<a href="">...</a>
and put the URL in between the quotes there, you get the following:<a href="http://example.com/foo_"bar"_baz>...</a>
.See that there's a problem with the quotes there? That's why you need to escape the URL. See this Stackoverflow answer for some options. Note that you might also want to whitelist some schemes, e.g. only allow
http:
andhttps:
. -
It's a bit hard to help when I don't know what you are doing with the resulting text, but check what happens if you have a
<
in your text, etc.
In general, you should get familiar with what the problem is with XSS, maybe read this guide about it: https://www.owasp.org/index.php/Testing_for_Cross_site_scripting
from autolink-java.
Hey, thanks a lot.
-
I construct a new
URI
Object in order to escape the URL. As outlined in this answer.
I do this for the URL rather than using one of the methods outlined in the answer you referenced because it seems that constructing a newURI
is specifically intended for escaping URLs.
Regarding whitelisting certain protocols, Which protocols (other thanhttp
andhttps
) are whitelisted when building aLinkExtractor
withLinkType.URL
? Is there a special method for whitelisting? Or do I do it myself by usingString
'sstartsWith()
or something? -
I see what you mean, I used the
StringEscapeUtils
class as outlined in the answer you referenced for this purpose.
Thank you.
from autolink-java.
There's no whitelisting in the library itself, it will return URIs with any scheme. So you should check the scheme of the URI yourself to decide whether to turn it into a link or not. If you're using URI
, you can use the getScheme()
method.
No worries, hope it helped.
from autolink-java.
Related Issues (20)
- Don't autolink if authority is only "end" characters HOT 2
- support of git/github links automatic linking HOT 3
- Potentially misparsed URL HOT 3
- Adapt autolink-java to replace rinku in JRuby HOT 1
- Possible code injection HOT 6
- Links with non-ASCII characters are not always extracted HOT 1
- URL Parsing getting stuck for non clickable URL HOT 3
- URL having consecutive "https://https://" are parsed as it is HOT 1
- Creole links contain the link text as well HOT 2
- Extract Phone numbers (request) HOT 1
- Linkify domain-only links (without scheme or www) HOT 1
- Do not insert HtmlTag when there is already a tag HOT 1
- Issue in extracting links if they are just extracted by commas HOT 1
- Some url without http and www domain HOT 2
- Add jlink-compatible Java9/Jigsaw module-info
- Version 0.10.2 broke binary compatibility HOT 1
- URL containing a single quote in middle results in unexpected ending HOT 1
- Dealing with | symbol HOT 4
- Stop URL on < or > HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from autolink-java.