You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@commons.apache.org by Gabriel Reis <bi...@gmail.com> on 2008/09/02 20:28:42 UTC
isEscaped
Hi,
Is there any tool to verify if a String is escaped? Something like this:
assertFalse( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
assertTrue( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
[]s
Gabriel
Re: isEscaped
Posted by Garrett Smith <dh...@gmail.com>.
On Tue, Sep 2, 2008 at 7:00 PM, Ted Dunning <te...@gmail.com> wrote:
> Depends on the goal.
>
> An absolutely precise decision may be rather complex.
>
>
> But a simpler decision that guarantees never to say yes to something that
> has any active HTML is much easier. I think that absence of <'s and only
> clearly valid entity references makes that true. It may be that there are
> subtle cases of safely escaped HTML that fall outside this filter. Whether
> that is a problem for you depends on your application.
>
this & that ?
There are many entities. HTML Entities, XML Entities.
isEscaped would have to account for a negation of all of unescaped entities.
not: < | ' | " | & | \u00a0 should suffice reasonably well. The last
one is nbsp or #160/
Garrett
> On Tue, Sep 2, 2008 at 6:32 PM, F. Andy Seidl
> <fa...@myst-technology.com>wrote:
>
>> >> Isn't this a pretty simple regex? Just look for <'s and &'s without
>> entity syntax <<
>>
>> I suspect that creating a really robust test would involve dealing with a
>> number of gotchas. For example, is this string escaped?
>>
>> StringEscapeUtils.isHtmlEscaped ("Use this HTML:
>> '<b>text</b>'")
>>
>> -- fas
>>
>> F. Andy Seidl
>> MyST Technology Partners, Inc.
>>
>> -----Original Message-----
>> From: Ted Dunning [mailto:ted.dunning@gmail.com]
>> Sent: Tuesday, September 02, 2008 2:48 PM
>> To: Commons Users List
>> Subject: Re: isEscaped
>>
>> Isn't this a pretty simple regex? Just look for <'s and &'s without entity
>> syntax.
>>
>> On Tue, Sep 2, 2008 at 11:28 AM, Gabriel Reis <bi...@gmail.com> wrote:
>>
>> > Hi,
>> >
>> > Is there any tool to verify if a String is escaped? Something like this:
>> >
>> > assertFalse( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>> >
>> > assertTrue( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>> >
>> >
>> > []s
>> > Gabriel
>> >
>>
>>
>>
>> --
>> ted
>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: user-unsubscribe@commons.apache.org
>> For additional commands, e-mail: user-help@commons.apache.org
>>
>>
>
>
> --
> ted
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@commons.apache.org
For additional commands, e-mail: user-help@commons.apache.org
Re: isEscaped
Posted by Ted Dunning <te...@gmail.com>.
Depends on the goal.
An absolutely precise decision may be rather complex.
But a simpler decision that guarantees never to say yes to something that
has any active HTML is much easier. I think that absence of <'s and only
clearly valid entity references makes that true. It may be that there are
subtle cases of safely escaped HTML that fall outside this filter. Whether
that is a problem for you depends on your application.
On Tue, Sep 2, 2008 at 6:32 PM, F. Andy Seidl
<fa...@myst-technology.com>wrote:
> >> Isn't this a pretty simple regex? Just look for <'s and &'s without
> entity syntax <<
>
> I suspect that creating a really robust test would involve dealing with a
> number of gotchas. For example, is this string escaped?
>
> StringEscapeUtils.isHtmlEscaped ("Use this HTML:
> '<b>text</b>'")
>
> -- fas
>
> F. Andy Seidl
> MyST Technology Partners, Inc.
>
> -----Original Message-----
> From: Ted Dunning [mailto:ted.dunning@gmail.com]
> Sent: Tuesday, September 02, 2008 2:48 PM
> To: Commons Users List
> Subject: Re: isEscaped
>
> Isn't this a pretty simple regex? Just look for <'s and &'s without entity
> syntax.
>
> On Tue, Sep 2, 2008 at 11:28 AM, Gabriel Reis <bi...@gmail.com> wrote:
>
> > Hi,
> >
> > Is there any tool to verify if a String is escaped? Something like this:
> >
> > assertFalse( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
> >
> > assertTrue( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
> >
> >
> > []s
> > Gabriel
> >
>
>
>
> --
> ted
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@commons.apache.org
> For additional commands, e-mail: user-help@commons.apache.org
>
>
--
ted
RE: isEscaped
Posted by "F. Andy Seidl" <fa...@myst-technology.com>.
>> Isn't this a pretty simple regex? Just look for <'s and &'s without
entity syntax <<
I suspect that creating a really robust test would involve dealing with a
number of gotchas. For example, is this string escaped?
StringEscapeUtils.isHtmlEscaped ("Use this HTML: '<b>text</b>'")
-- fas
F. Andy Seidl
MyST Technology Partners, Inc.
-----Original Message-----
From: Ted Dunning [mailto:ted.dunning@gmail.com]
Sent: Tuesday, September 02, 2008 2:48 PM
To: Commons Users List
Subject: Re: isEscaped
Isn't this a pretty simple regex? Just look for <'s and &'s without entity
syntax.
On Tue, Sep 2, 2008 at 11:28 AM, Gabriel Reis <bi...@gmail.com> wrote:
> Hi,
>
> Is there any tool to verify if a String is escaped? Something like this:
>
> assertFalse( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>
> assertTrue( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>
>
> []s
> Gabriel
>
--
ted
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@commons.apache.org
For additional commands, e-mail: user-help@commons.apache.org
Re: isEscaped
Posted by Ted Dunning <te...@gmail.com>.
Isn't this a pretty simple regex? Just look for <'s and &'s without entity
syntax.
On Tue, Sep 2, 2008 at 11:28 AM, Gabriel Reis <bi...@gmail.com> wrote:
> Hi,
>
> Is there any tool to verify if a String is escaped? Something like this:
>
> assertFalse( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>
> assertTrue( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>
>
> []s
> Gabriel
>
--
ted
Re: isEscaped
Posted by Ted Dunning <te...@gmail.com>.
On Wed, Sep 3, 2008 at 11:33 AM, Garrett Smith <dh...@gmail.com>wrote:
> This example:
>
> >> assertTrue( StringEscapeUtils.isHtmlEscaped("<b>text</b>")
> );
> >
> - is flawed.
>
> The flaw is searching for unescaped entities, not searching for no
> unescaped entities.
> ...
You make some good points.
But the real flaw is that we are all talking without knowing what the goal
really is.
> So, I think that Tim is probably getting at the problem better by
> asking: "What is the end goal?".
Exactly!
> And the OP has been silent.
The OP should be an inspiration to us all.
Re: isEscaped
Posted by Garrett Smith <dh...@gmail.com>.
On Wed, Sep 3, 2008 at 7:56 AM, Niall Pemberton
<ni...@gmail.com> wrote:
> On Tue, Sep 2, 2008 at 7:28 PM, Gabriel Reis <bi...@gmail.com> wrote:
>> Hi,
>>
>> Is there any tool to verify if a String is escaped? Something like this:
>>
"Escaped HTML" would be HTML that contains no unescaped HTML entities.
>> assertFalse( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>>
This example:
>> assertTrue( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>
- is flawed.
The flaw is searching for unescaped entities, not searching for no
unescaped entities.
It is a very basic logical fallacy called "Affirming the Consequent".
Example:
1. Escaped HTML contains escaped HTML Entities.
2. String S contains escaped HTML entities.
3. Therefore, String S is Escaped HTML.
We can also see that there is another fallacy here: A generalization
fallacy in (1). Escaped HTML contains escaped HTML Entities is not a
universal truth. If we change (1) to:-
"Escaped HTML usually contains HTML Entities"
- then we can easily see that (3) would not be implied unless we changed to:-
1. Escaped HTML *usually* contains escaped HTML Entities.
2. String S contains escaped HTML entities.
3. Therefore, String S is *probably* Escaped HTML.
But then we still have the ""Affirming the Consequent" error, because
it could be statistically possible that the application we are testing
deals with a lot of HTML code examples like:-
To make text bold, use the <b> tag.
> Perhaps one way to do this is to use the StringEscapeUtils's
> unescapeHtml() method and compare if the result equals the original.
>
> something like...
>
> if (value.equals(StringEscapeUtils.unescapeHtml(value))) {
> ...
> }
>
Method unescapeHTML converts escaped entities to the unescaped character.
That would not work.
Because:-
boolean isEscaped;
String value = "Use this HTML: '<b>text</b>'";
isEscaped = value.equals(StringEscapeUtils.unescapeHTML(value));
isEscaped would be false.
So, I think that Tim is probably getting at the problem better by
asking: "What is the end goal?".
And the OP has been silent.
Garrett
> http://commons.apache.org/lang/api-release/org/apache/commons/lang/StringEscapeUtils.html#unescapeHtml(java.lang.String)
>
> Niall
>
>> []s
>> Gabriel
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@commons.apache.org
> For additional commands, e-mail: user-help@commons.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@commons.apache.org
For additional commands, e-mail: user-help@commons.apache.org
Re: isEscaped
Posted by Niall Pemberton <ni...@gmail.com>.
On Tue, Sep 2, 2008 at 7:28 PM, Gabriel Reis <bi...@gmail.com> wrote:
> Hi,
>
> Is there any tool to verify if a String is escaped? Something like this:
>
> assertFalse( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>
> assertTrue( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
Perhaps one way to do this is to use the StringEscapeUtils's
unescapeHtml() method and compare if the result equals the original.
something like...
if (value.equals(StringEscapeUtils.unescapeHtml(value))) {
...
}
http://commons.apache.org/lang/api-release/org/apache/commons/lang/StringEscapeUtils.html#unescapeHtml(java.lang.String)
Niall
> []s
> Gabriel
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@commons.apache.org
For additional commands, e-mail: user-help@commons.apache.org
Re: isEscaped
Posted by Tim <ch...@gmail.com>.
What is the end goal? It seems you might end up taking more time trying to
find out if it's HTML escaped then just coding for it on a usage basis.
On Tue, Sep 2, 2008 at 1:28 PM, Gabriel Reis <bi...@gmail.com> wrote:
> Hi,
>
> Is there any tool to verify if a String is escaped? Something like this:
>
> assertFalse( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>
> assertTrue( StringEscapeUtils.isHtmlEscaped("<b>text</b>") );
>
>
> []s
> Gabriel
>