owasp html清理程序中的isValid（）方法

Question

I have a page in my application where user can enter HTML input. Now in order to avoid XSS attack i am using OWASP HTML Sanitizer to sanitize the user input. If the user input is not valid according to the policy i just want to throw the user out.

is there a way to simple check if the input html is valid against the policy without sanitizing ?

something like

public static boolean isValid(String input, Policy policy);

Answer 1

You can define yourself the isValid method but I'm not sure you can do it without calling the sanitize method.

// Define the policy factory
PolicyFactory polFac = new HtmlPolicyBuilder()
    .allowElements("a", "p")
    .allowAttributes("href").onElements("a")
    .toFactory(); 

boolean isValid(String input, PolicyFactory polFac){
    return input.equals(polFac.sanitize(input));
}

You can obtain a more robust version of isValid using the second version of the sanitize method (in the PolicyFactory class) that reports the names of rejected element and attributes.