UrlStripHtmlSanitizer implements Sanitizer<String> { @Override public String execute(String content) { if (StringUtils.isBlank(content)) { return content; } URI uri; try { uri = new URI(content); } catch (URISyntaxException e) { throw new RuntimeException(e); } List<NameValuePair> cleanedPairs = parse(uri); String queryString = cleanedPairs.isEmpty() ? null : URLEncodedUtils.format(cleanedPairs, ENCODING); try { return URIUtils.createURI(uri.getScheme(), uri.getHost(), uri.getPort(), uri.getPath(), queryString, uri.getFragment()).toString(); } catch (URISyntaxException e) { throw new RuntimeException(e); } }  @Override String execute(String content); static List<NameValuePair> parse(URI uri); static List<NameValuePair> parse(String queryString);  }
@Test public void testExecute() throws Exception { assertEquals("http: assertEquals("http: assertEquals("http: _sanitizer.execute("http: assertEquals("/path/page.cfm?a=1&num_rooms=1&children=0&int=VA&b=2", _sanitizer.execute("/path/page.cfm?a=1&num_rooms=1&children=0&int=VA&b=2")); assertEquals("/?a=1&num_rooms=1&children=0&int=VA&b=2", _sanitizer.execute("?a=1&num_rooms=1&children=0&int=VA&b=2")); assertEquals("/foo", _sanitizer.execute("foo")); assertEquals( "https: _sanitizer .execute("https: try { _sanitizer.execute("<script>alert('hacked!');</script>"); fail("Should throw URISyntaxException"); } catch (Exception e) { assertEquals("java.net.URISyntaxException: Illegal character in path at index 0: <script>alert('hacked!');</script>", e.getMessage()); } }
@Test public void testExecuteWithXSS() throws Exception { assertEquals("http: "http: }