@@ -18,174 +18,176 @@ public final class XSS {
1818 private XSS () {}
1919
2020 /**
21- * Perform am URI path <strong>escape</strong> operation on a <tt >String</tt > input using
22- * <tt >UTF-8</tt > as encoding.
21+ * Perform am URI path <strong>escape</strong> operation on a <code >String</code > input using
22+ * <code >UTF-8</code > as encoding.
2323 *
2424 * <p>The following are the only allowed chars in an URI path (will not be escaped):
2525 *
2626 * <ul>
27- * <li><tt >A-Z a-z 0-9</tt >
28- * <li><tt >- . _ ~</tt >
29- * <li><tt >! $ & ' ( ) * + , ; =</tt >
30- * <li><tt >: @</tt >
31- * <li><tt >/</tt >
27+ * <li><code >A-Z a-z 0-9</code >
28+ * <li><code >- . _ ~</code >
29+ * <li><code >! $ & ' ( ) * + , ; =</code >
30+ * <li><code >: @</code >
31+ * <li><code >/</code >
3232 * </ul>
3333 *
3434 * <p>All other chars will be escaped by converting them to the sequence of bytes that represents
35- * them in the <tt >UTF-8</tt > and then representing each byte in <tt >%HH</tt > syntax, being
36- * <tt >HH</tt > the hexadecimal representation of the byte.
35+ * them in the <code >UTF-8</code > and then representing each byte in <code >%HH</code > syntax,
36+ * being <code >HH</code > the hexadecimal representation of the byte.
3737 *
3838 * <p>This method is <strong>thread-safe</strong>.
3939 *
40- * @param value the <tt >String</tt > to be escaped.
41- * @return The escaped result <tt >String</tt >. As a memory-performance improvement, will return
42- * the exact same object as the <tt >text</tt > input argument if no escaping modifications were
43- * required (and no additional <tt >String</tt > objects will be created during processing).
44- * Will return <tt >null</tt > if input is <tt >null</tt >.
40+ * @param value the <code >String</code > to be escaped.
41+ * @return The escaped result <code >String</code >. As a memory-performance improvement, will
42+ * return the exact same object as the <code >text</code > input argument if no escaping
43+ * modifications were required (and no additional <code >String</code > objects will be created
44+ * during processing). Will return <code >null</code > if input is <code >null</code >.
4545 */
4646 public static @ Nullable String uri (@ Nullable String value ) {
4747 return UriEscape .escapeUriPath (value );
4848 }
4949
5050 /**
51- * Perform an HTML5 level 2 (result is ASCII) <strong>escape</strong> operation on a
52- * <tt>String</tt > input.
51+ * Perform an HTML5 level 2 (result is ASCII) <strong>escape</strong> operation on a <code>String
52+ * </code > input.
5353 *
5454 * <p><em>Level 2</em> means this method will escape:
5555 *
5656 * <ul>
57- * <li>The five markup-significant characters: <tt ><</tt >, <tt >></tt >, <tt >&</tt>,
58- * <tt> "</tt > and <tt >'</tt >
57+ * <li>The five markup-significant characters: <code ><</code >, <code >></code >, <code >&
58+ * </code>, <code> "</code > and <code >'</code >
5959 * <li>All non ASCII characters.
6060 * </ul>
6161 *
6262 * <p>This escape will be performed by replacing those chars by the corresponding HTML5 Named
63- * Character References (e.g. <tt >'&acute;'</tt >) when such NCR exists for the replaced
64- * character, and replacing by a decimal character reference (e.g. <tt >'&#8345;'</tt>) when
65- * there there is no NCR for the replaced character.
63+ * Character References (e.g. <code >'&acute;'</code >) when such NCR exists for the replaced
64+ * character, and replacing by a decimal character reference (e.g. <code >'&#8345;'</code>)
65+ * when there there is no NCR for the replaced character.
6666 *
6767 * <p>This method is <strong>thread-safe</strong>.
6868 *
69- * @param value the <tt >String</tt > to be escaped.
70- * @return The escaped result <tt >String</tt >. As a memory-performance improvement, will return
71- * the exact same object as the <tt >text</tt > input argument if no escaping modifications were
72- * required (and no additional <tt >String</tt > objects will be created during processing).
73- * Will return <tt >null</tt > if input is <tt >null</tt >.
69+ * @param value the <code >String</code > to be escaped.
70+ * @return The escaped result <code >String</code >. As a memory-performance improvement, will
71+ * return the exact same object as the <code >text</code > input argument if no escaping
72+ * modifications were required (and no additional <code >String</code > objects will be created
73+ * during processing). Will return <code >null</code > if input is <code >null</code >.
7474 */
7575 public static @ Nullable String html (@ Nullable String value ) {
7676 return HtmlEscape .escapeHtml5 (value );
7777 }
7878
7979 /**
8080 * Perform a JavaScript level 2 (basic set and all non-ASCII chars) <strong>escape</strong>
81- * operation on a <tt >String</tt > input.
81+ * operation on a <code >String</code > input.
8282 *
8383 * <p><em>Level 2</em> means this method will escape:
8484 *
8585 * <ul>
8686 * <li>The JavaScript basic escape set:
8787 * <ul>
88- * <li>The <em>Single Escape Characters</em>: <tt>\0</tt> (<tt>U+0000</tt>),
89- * <tt>\b</tt> (<tt>U+0008</tt>), <tt>\t</tt> (<tt>U+0009</tt>),
90- * <tt>\n</tt> (<tt>U+000A</tt>), <tt>\v</tt> (<tt>U+000B</tt>),
91- * <tt>\f</tt> (<tt>U+000C</tt>), <tt>\r</tt> (<tt>U+000D</tt>),
92- * <tt>\"</tt> (<tt>U+0022</tt>), <tt>\'</tt> (<tt>U+0027</tt>),
93- * <tt>\\</tt> (<tt>U+005C</tt>) and <tt>\/</tt> (<tt>U+002F</tt>).
94- * Note that <tt>\/</tt> is optional, and will only be used when the
95- * <tt>/</tt> symbol appears after <tt><</tt>, as in <tt></</tt>. This
96- * is to avoid accidentally closing <tt><script></tt> tags in HTML. Also, note
97- * that <tt>\v</tt> (<tt>U+000B</tt>) is actually included as a Single Escape
98- * Character in the JavaScript (ECMAScript) specification, but will not be used as it
99- * is not supported by Microsoft Internet Explorer versions < 9.
88+ * <li>The <em>Single Escape Characters</em>: <code>\0</code> (<code>U+0000</code>),
89+ * <code>\b</code> (<code>U+0008</code>), <code>\t</code> (<code>U+0009</code>
90+ * ), <code>\n</code> (<code>U+000A</code>), <code>\v</code> (<code>U+000B
91+ * </code>), <code>\f</code> (<code>U+000C</code>), <code>\r</code> (<code>
92+ * U+000D</code>), <code>\"</code> (<code>U+0022</code>), <code>\'
93+ * </code> (<code>U+0027</code>), <code>\\</code> (<code>U+005C</code>) and
94+ * <code>\/</code> (<code>U+002F</code>). Note that <code>\/</code> is
95+ * optional, and will only be used when the <code>/</code> symbol appears after
96+ * <code><</code>, as in <code></</code>. This is to avoid accidentally
97+ * closing <code><script></code> tags in HTML. Also, note that <code>\v
98+ * </code> (<code>U+000B</code>) is actually included as a Single Escape Character in
99+ * the JavaScript (ECMAScript) specification, but will not be used as it is not
100+ * supported by Microsoft Internet Explorer versions < 9.
100101 * <li>Two ranges of non-displayable, control characters (some of which are already part
101- * of the <em>single escape characters</em> list): <tt >U+0001</tt > to <tt >U+001F</tt>
102- * and <tt >U+007F</tt > to <tt >U+009F</tt >.
102+ * of the <em>single escape characters</em> list): <code >U+0001</code > to <code >U+001F
103+ * </code> and <code >U+007F</code > to <code >U+009F</code >.
103104 * </ul>
104105 * <li>All non ASCII characters.
105106 * </ul>
106107 *
107108 * <p>This escape will be performed by using the Single Escape Chars whenever possible. For
108- * escaped characters that do not have an associated SEC, default to using <tt >\xFF</tt >
109- * Hexadecimal Escapes if possible (characters <= <tt >U+00FF</tt >), then default to
110- * <tt> \uFFFF</tt > Hexadecimal Escapes. This type of escape <u>produces the smallest escaped
109+ * escaped characters that do not have an associated SEC, default to using <code >\xFF</code >
110+ * Hexadecimal Escapes if possible (characters <= <code >U+00FF</code >), then default to <code>
111+ * \uFFFF</code > Hexadecimal Escapes. This type of escape <u>produces the smallest escaped
111112 * string possible</u>.
112113 *
113114 * <p>This method is <strong>thread-safe</strong>.
114115 *
115- * @param value the <tt >String</tt > to be escaped.
116- * @return The escaped result <tt >String</tt >. As a memory-performance improvement, will return
117- * the exact same object as the <tt >text</tt > input argument if no escaping modifications were
118- * required (and no additional <tt >String</tt > objects will be created during processing).
119- * Will return <tt >null</tt > if input is <tt >null</tt >.
116+ * @param value the <code >String</code > to be escaped.
117+ * @return The escaped result <code >String</code >. As a memory-performance improvement, will
118+ * return the exact same object as the <code >text</code > input argument if no escaping
119+ * modifications were required (and no additional <code >String</code > objects will be created
120+ * during processing). Will return <code >null</code > if input is <code >null</code >.
120121 */
121122 public static @ Nullable String javaScript (@ Nullable String value ) {
122123 return JavaScriptEscape .escapeJavaScript (value );
123124 }
124125
125126 /**
126127 * Perform a JSON level 2 (basic set and all non-ASCII chars) <strong>escape</strong> operation on
127- * a <tt >String</tt > input.
128+ * a <code >String</code > input.
128129 *
129130 * <p><em>Level 2</em> means this method will escape:
130131 *
131132 * <ul>
132133 * <li>The JSON basic escape set:
133134 * <ul>
134- * <li>The <em>Single Escape Characters</em>: <tt >\b</tt > (<tt >U+0008</tt >),
135- * <tt >\t</tt > (<tt >U+0009</tt >), <tt >\n</tt > (<tt >U+000A</tt>),
136- * <tt >\f</tt > (<tt >U+000C</tt >), <tt >\r</tt > (<tt >U+000D</tt>),
137- * <tt> \"</tt > (<tt >U+0022</tt >), <tt >\\</tt > (<tt>U+005C</tt>) and
138- * <tt> \/</tt > (<tt >U+002F</tt >). Note that <tt>\/</tt> is optional,
139- * and will only be used when the <tt >/</tt> symbol appears after <tt><</tt>,
140- * as in <tt ></</tt >. This is to avoid accidentally closing
141- * <tt ><script></tt > tags in HTML.
135+ * <li>The <em>Single Escape Characters</em>: <code >\b</code > (<code >U+0008</code >),
136+ * <code >\t</code > (<code >U+0009</code >), <code >\n</code > (<code >U+000A</code>
137+ * ), <code >\f</code > (<code >U+000C</code >), <code >\r</code > (<code >U+000D
138+ * </code>), <code> \"</code > (<code >U+0022</code >), <code >\\</code > (
139+ * <code>U+005C</code>) and <code> \/</code > (<code >U+002F</code >). Note that
140+ * <code>\/</code> is optional, and will only be used when the <code >/
141+ * </code> symbol appears after <code><</code>, as in <code ></</code >. This
142+ * is to avoid accidentally closing <code ><script></code > tags in HTML.
142143 * <li>Two ranges of non-displayable, control characters (some of which are already part
143- * of the <em>single escape characters</em> list): <tt>U+0000</tt> to <tt>U+001F</tt>
144- * (required by the JSON spec) and <tt>U+007F</tt> to <tt>U+009F</tt> (additional).
144+ * of the <em>single escape characters</em> list): <code>U+0000</code> to <code>U+001F
145+ * </code> (required by the JSON spec) and <code>U+007F</code> to <code>U+009F</code>
146+ * (additional).
145147 * </ul>
146148 * <li>All non ASCII characters.
147149 * </ul>
148150 *
149151 * <p>This escape will be performed by using the Single Escape Chars whenever possible. For
150- * escaped characters that do not have an associated SEC, default to <tt >\uFFFF</tt >
152+ * escaped characters that do not have an associated SEC, default to <code >\uFFFF</code >
151153 * Hexadecimal Escapes.
152154 *
153155 * <p>This method is <strong>thread-safe</strong>.
154156 *
155- * @param value the <tt >String</tt > to be escaped.
156- * @return The escaped result <tt >String</tt >. As a memory-performance improvement, will return
157- * the exact same object as the <tt >text</tt > input argument if no escaping modifications were
158- * required (and no additional <tt >String</tt > objects will be created during processing).
159- * Will return <tt >null</tt > if input is <tt >null</tt >.
157+ * @param value the <code >String</code > to be escaped.
158+ * @return The escaped result <code >String</code >. As a memory-performance improvement, will
159+ * return the exact same object as the <code >text</code > input argument if no escaping
160+ * modifications were required (and no additional <code >String</code > objects will be created
161+ * during processing). Will return <code >null</code > if input is <code >null</code >.
160162 */
161163 public static @ Nullable String json (@ Nullable String value ) {
162164 return JsonEscape .escapeJson (value );
163165 }
164166
165167 /**
166168 * Perform an XML 1.1 level 2 (markup-significant and all non-ASCII chars) <strong>escape</strong>
167- * operation on a <tt >String</tt > input.
169+ * operation on a <code >String</code > input.
168170 *
169171 * <p><em>Level 2</em> means this method will escape:
170172 *
171173 * <ul>
172- * <li>The five markup-significant characters: <tt ><</tt >, <tt >></tt >, <tt >&</tt>,
173- * <tt> "</tt > and <tt >'</tt >
174+ * <li>The five markup-significant characters: <code ><</code >, <code >></code >, <code >&
175+ * </code>, <code> "</code > and <code >'</code >
174176 * <li>All non ASCII characters.
175177 * </ul>
176178 *
177179 * <p>This escape will be performed by replacing those chars by the corresponding XML Character
178- * Entity References (e.g. <tt >'&lt;'</tt >) when such CER exists for the replaced character,
179- * and replacing by a hexadecimal character reference (e.g. <tt >'&#x2430;'</tt>) when there
180- * there is no CER for the replaced character.
180+ * Entity References (e.g. <code >'&lt;'</code >) when such CER exists for the replaced
181+ * character, and replacing by a hexadecimal character reference (e.g. <code >'&#x2430;'</code>
182+ * ) when there there is no CER for the replaced character.
181183 *
182184 * <p>This method is <strong>thread-safe</strong>.
183185 *
184- * @param value the <tt >String</tt > to be escaped.
185- * @return The escaped result <tt >String</tt >. As a memory-performance improvement, will return
186- * the exact same object as the <tt >text</tt > input argument if no escaping modifications were
187- * required (and no additional <tt >String</tt > objects will be created during processing).
188- * Will return <tt >null</tt > if input is <tt >null</tt >.
186+ * @param value the <code >String</code > to be escaped.
187+ * @return The escaped result <code >String</code >. As a memory-performance improvement, will
188+ * return the exact same object as the <code >text</code > input argument if no escaping
189+ * modifications were required (and no additional <code >String</code > objects will be created
190+ * during processing). Will return <code >null</code > if input is <code >null</code >.
189191 */
190192 public static @ Nullable String xml (@ Nullable String value ) {
191193 return XmlEscape .escapeXml11 (value );
0 commit comments