OWASP AntiSamy

https://owasp.org/www-project-antisamy/
Admin
OWASP AntiSamy is an API that validates and sanitizes user-supplied HTML and CSS to prevent...
Tokens:1,907
Snippets:22
Trust Score:10
Update:5 months ago
Show doc for...
Tokens:
Raw
### Scanning with Policy File Object

Source: https://owasp.org/www-project-antisamy

This example demonstrates scanning HTML input using a policy file provided as a File object.

```APIDOC
## Scanning with Policy File Object

This example demonstrates scanning HTML input using a policy file provided as a File object.

### Method
```java
AntiSamy as = new AntiSamy();
CleanResults cr = as.scan(dirtyInput, new File(policyFilePath));
```

### Parameters
* `dirtyInput` (String): The HTML input string to be scanned.
* `policyFilePath` (String): The path to the policy file, used to create a File object.

### Response
* `CleanResults` (Object): An object containing the results of the scan.
```

--------------------------------

### Invoking AntiSamy with a Policy File

Source: https://owasp.org/www-project-antisamy

This example demonstrates the basic usage of the AntiSamy library, including loading a policy file and scanning dirty HTML input.

```APIDOC
## Invoking AntiSamy with a Policy File

This example demonstrates the basic usage of the AntiSamy library, including loading a policy file and scanning dirty HTML input.

### Method
```java
import org.owasp.validator.html.*;

Policy policy = Policy.getInstance(POLICY_FILE_LOCATION);

AntiSamy as = new AntiSamy();
CleanResults cr = as.scan(dirtyInput, policy);

MyUserDAO.storeUserProfile(cr.getCleanHTML()); // some custom function
```

### Parameters
* `POLICY_FILE_LOCATION` (String): The location of the policy file.
* `dirtyInput` (String): The HTML input string to be scanned.

### Response
* `CleanResults` (Object): An object containing the results of the scan, including clean HTML and error messages.
```

--------------------------------

### Scanning with Policy File Path

Source: https://owasp.org/www-project-antisamy

This example shows how to scan HTML input using a policy file specified by its file path.

```APIDOC
## Scanning with Policy File Path

This example shows how to scan HTML input using a policy file specified by its file path.

### Method
```java
AntiSamy as = new AntiSamy();
CleanResults cr = as.scan(dirtyInput, policyFilePath);
```

### Parameters
* `dirtyInput` (String): The HTML input string to be scanned.
* `policyFilePath` (String): The path to the policy file.

### Response
* `CleanResults` (Object): An object containing the results of the scan.
```

--------------------------------

### Add AntiSamy Dependency via Maven

Source: https://owasp.org/www-project-antisamy

Include this dependency in your project's pom.xml to use the OWASP AntiSamy library.

```xml
<dependency>
    <groupId>org.owasp.antisamy</groupId>
    <projectId>antisamy</projectId>
  </dependency>
```

--------------------------------

### Invoke AntiSamy with Policy File Path

Source: https://owasp.org/www-project-antisamy

Scan HTML content using a policy file specified by its file path. This is a convenient way to directly reference the policy file in the scan method.

```java
AntiSamy as = new AntiSamy();
CleanResults cr = as.scan(dirtyInput, policyFilePath);

```

--------------------------------

### Invoke AntiSamy with Policy Object

Source: https://owasp.org/www-project-antisamy

This is the primary method for scanning HTML. It requires loading a policy file into a Policy object first. Ensure the policy file path is correctly set.

```java
import org.owasp.validator.html.*;

Policy policy = Policy.getInstance(POLICY_FILE_LOCATION);

AntiSamy as = new AntiSamy();
CleanResults cr = as.scan(dirtyInput, policy);

MyUserDAO.storeUserProfile(cr.getCleanHTML()); // some custom function

```

--------------------------------

### Invoke AntiSamy with Policy File Object

Source: https://owasp.org/www-project-antisamy

Scan HTML content by providing a File object representing the policy file. This offers flexibility when the policy file is already represented as a File object.

```java
AntiSamy as = new AntiSamy();
CleanResults cr = as.scan(dirtyInput, new File(policyFilePath));

```

--------------------------------

### Analyzing CleanResults

Source: https://owasp.org/www-project-antisamy

This section details the methods available on the CleanResults object to retrieve scan information.

```APIDOC
## Analyzing CleanResults

The `CleanResults` object provides access to the results of an AntiSamy scan.

### Methods
* `getErrorMessages()`: Returns a list of String error messages encountered during the scan.
* `getCleanHTML()`: Returns the cleaned, safe HTML output.
* `getCleanXMLDocumentFragment()`: Returns the cleaned, safe XML Document Fragment, which is reflected in `getCleanHTML()`.
* `getScanTime()`: Returns the scan time in seconds.
```

--------------------------------

### Analyze CleanResults Object

Source: https://owasp.org/www-project-antisamy

The CleanResults object contains the output of the scan. Use its methods to retrieve error messages, the cleaned HTML, or the scan time.

```java
getErrorMessages() - a list of String error messages
getCleanHTML() - the clean, safe HTML output
getCleanXMLDocumentFragment() - the clean, safe XMLDocumentFragment which is reflected in getCleanHTML()
getScanTime() - returns the scan time in seconds

```
Tokens:
Raw