if (name.equals("href")) { if (value.startsWith("http: value.startsWith("ftp: value.startsWith("mailto:")) {
if (name.equals("href")) { if (! isRelative(value)) {
    private boolean isThrustedAttribute(Node parent, Attr attribute) {        String name = attribute.getName().toLowerCase();        String value = attribute.getValue();        List<String> eventsAttributes = Arrays.asList(new String[] { "onabort", "onblur", "onchange",                "onclick", "ondblclick", "onerror", "onfocus", "onkeydown", "onkeypress", "onkeyup",                "onload", "onmousedown", "onmousemove", "onmouseout", "onmouseover", "onmouseup",                "onreset", "onresize", "onselect", "onsubmit", "onunload" });        if (eventsAttributes.contains(name)) { // instrinsic events            return false;        }        if (value.toLowerCase().startsWith("javascript:")) { // javascript: doSomething()            return false;        }        if (name.equals("class")) { // don't allow to use application styles            return false;        }        if (name.equals("href")) { // protect links to private places of the application            if (value.startsWith("http://") ||                     value.startsWith("ftp://") ||                    value.startsWith("mailto:")) {                HttpServletRequest currentRequest = RenderersRequestProcessor.getCurrentRequest();                String serverName = currentRequest.getServerName();                                try {                    URL url = new URL(value);                    if (serverName.equals(url.getHost())) {                        if (url.getPath().contains("/publico/")) {                            return true;                        }                        else {                            NodeList list = parent.getChildNodes();                            for (int i = 0; i<list.getLength(); i++) {                                Node node = list.item(i);                                                                parent.removeChild(node);                            }                                                        parent.appendChild(parent.getOwnerDocument().createTextNode(value));                            return false;                        }                    }                                        return true;                } catch (MalformedURLException e) {                    return false;                }            }            else {                return false;            }        }                return true;    }