Skip to content

Changed/Fixed Lambda to anonymous class of ElementPolicy in doc #168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Apr 12, 2019
Merged

Changed/Fixed Lambda to anonymous class of ElementPolicy in doc #168

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ddbb77f
Changed/Fixed Lambda to anonymous class of ElementPolicy in doc
0xflotus Apr 12, 2019
ac2fab4
Update client-side-templates.md
0xflotus Apr 12, 2019
3fb3084
Update client-side-templates.md
0xflotus Apr 12, 2019
f7bb031
Update client-side-templates.md
0xflotus Apr 12, 2019
5013ab7
Update README.md
0xflotus Apr 12, 2019
a505ffa
Remove unnecessary curly bracket and dedent body
mikesamuel Apr 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 6 additions & 8 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,14 +66,12 @@ to do things like changing `h1`s to `div`s with a certain class:
PolicyFactory policy = new HtmlPolicyBuilder()
.allowElements("p")
.allowElements(
new ElementPolicy() {
(String elementName, List<String> attrs) -> {
// Add a class attribute.
attrs.add("class");
attrs.add("header-" + elementName);
// Return elementName to include, null to drop.
return "div";
}
(String elementName, List<String> attrs) -> {
// Add a class attribute.
attrs.add("class");
attrs.add("header-" + elementName);
// Return elementName to include, null to drop.
return "div";
}, "h1", "h2", "h3", "h4", "h5", "h6")
.toFactory();
String safeHTML = policy.sanitize(untrustedHTML);
Expand Down
2 changes: 1 addition & 1 deletion docs/client-side-templates.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ Many client-side templates look for special constructs in text nodes. Often, us

## Client side template / expression attributes

When filtering client-side templates, it should also be considered to fully cover attributes containing expressions and parseable information that might cause damage or lead to arbitary JavaScript execution.
When filtering client-side templates, it should also be considered to fully cover attributes containing expressions and parseable information that might cause damage or lead to arbitrary JavaScript execution.

| Template Language | Attrbutes | Notes |
|-------------------|-----------|-------|
Expand Down