title: Location of AntiSamy policy file in web project
body: <p>I'm trying to use <em>AntiSamy</em> to prevent XSS attacks on my site. I downloaded the following jars and added them to "/WEB-INF/lib"</p>
  
  <ul>
  <li><p>antisamy-1.5.3.jar</p></li>
  <li><p>nekohtml.jar</p></li>
  <li><p>xercesImpl-2.5.0.jar</p></li>
  </ul>
  
  <p>along with a policy file <strong>antisamy-slashdot-1.4.4.xml</strong> in "/WEB-INF".</p>
  
  <p>I tried to implement a filter through <strong>web.xml</strong>. A snippet of the servlet I'm using is</p>
  
  <pre><code>public class AntiSamyFilter implements Filter {
  
  private static final Logger LOG = Logger.getLogger(AntiSamyFilter.class);
  
  private final AntiSamy antiSamy;
  
  public AntiSamyFilter() {
      try {
          URL url = this.getClass().getClassLoader().getResource("antisamy-slashdot-1.4.4.xml");
          LOG.info("After getResource");
          Policy policy = Policy.getInstance(url.getFile()); //Deployment fails
          LOG.info("After Policy");
          antiSamy = new AntiSamy(policy);
          LOG.info("After antiSamy");
      } catch (PolicyException e) {
          throw new IllegalStateException(e.getMessage(), e);
      }
  }
  }
  </code></pre>
  
  <p>The deployment fails after <strong>Policy policy = Policy.getInstance(url.getFile());</strong>. It's probably because of the path of the policy file.</p>
  
  <p>Can someone please tell me where the policy file should be kept?</p>