Package org.apache.catalina.filters

Class AddDefaultCharsetFilter

java.lang.Object

org.apache.catalina.filters.FilterBase

org.apache.catalina.filters.AddDefaultCharsetFilter

public class AddDefaultCharsetFilter
extends FilterBase

Filter that explicitly sets the default character set for media subtypes of the "text" type to ISO-8859-1, or another user defined character set. RFC2616 explicitly states that browsers must use ISO-8859-1 if no character set is defined for media with subtype "text". However, browsers may attempt to auto-detect the character set. This may be exploited by an attacker to perform an XSS attack. Internet Explorer has this behaviour by default. Other browsers have an option to enable it.
This filter prevents the attack by explicitly setting a character set. Unless the provided character set is explicitly overridden by the user - in which case they deserve everything they get - the browser will adhere to an explicitly set character set, thus preventing the XSS attack.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	AddDefaultCharsetFilter.ResponseWrapper	Wrapper that adds a character set for text media types if no character set is specified.

Field Summary

Fields inherited from class org.apache.catalina.filters.FilterBase

sm

Constructor Summary

Constructors

Constructor	Description
AddDefaultCharsetFilter()

Method Summary

Modifier and Type	Method	Description
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
protected Log	getLogger()
void	init(javax.servlet.FilterConfig filterConfig)	Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.
void	setEncoding(java.lang.String encoding)

Methods inherited from interface javax.servlet.Filter

destroy

Methods inherited from class org.apache.catalina.filters.FilterBase

isConfigProblemFatal

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AddDefaultCharsetFilter

public AddDefaultCharsetFilter()

Method Detail

setEncoding

public void setEncoding(java.lang.String encoding)

getLogger

protected Log getLogger()

Specified by:

getLogger in class FilterBase

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Description copied from class: FilterBase

Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.

Overrides:

init in class FilterBase

Parameters:

filterConfig - The configuration information associated with the filter instance being initialised

Throws:

javax.servlet.ServletException - if FilterBase.isConfigProblemFatal() returns true and a configured parameter does not have a matching setter

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws java.io.IOException,
                     javax.servlet.ServletException

Throws:

java.io.IOException

javax.servlet.ServletException