\section{cppcms\-:\-:xss\-:\-:rules Class Reference}
\label{classcppcms_1_1xss_1_1rules}\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}}


The class that holds X\-S\-S filter rules.  




{\ttfamily \#include $<$cppcms/xss.\-h$>$}

\subsection*{Public Types}
\begin{DoxyCompactItemize}
\item 
enum {\bf html\-\_\-type} \{ {\bf xhtml\-\_\-input}, 
{\bf html\-\_\-input}
 \}
\item 
enum {\bf tag\-\_\-type} \{ {\bf invalid\-\_\-tag} = 0, 
{\bf opening\-\_\-and\-\_\-closing} = 1, 
{\bf stand\-\_\-alone} = 2, 
{\bf any\-\_\-tag} = 3
 \}
\item 
typedef {\bf booster\-::function}\\*
$<$ bool(char const $\ast$begin, char \\*
const $\ast$end)$>$ {\bf validator\-\_\-type}
\end{DoxyCompactItemize}
\subsection*{Public Member Functions}
\begin{DoxyCompactItemize}
\item 
{\bfseries rules} ({\bf rules} const \&)\label{classcppcms_1_1xss_1_1rules_a47aa2c5d6e9d92ba699cd143ca0f546b}

\item 
{\bf rules} const \& {\bfseries operator=} ({\bf rules} const \&)\label{classcppcms_1_1xss_1_1rules_a936804c2e90e4392866e2992c4e4c338}

\item 
{\bf rules} ({\bf json\-::value} const \&r)
\item 
{\bf rules} (std\-::string const \&file\-\_\-name)
\item 
{\bf html\-\_\-type} {\bf html} () const 
\item 
void {\bf html} ({\bf html\-\_\-type} t)
\item 
void {\bf add\-\_\-tag} (std\-::string const \&name, {\bf tag\-\_\-type}={\bf any\-\_\-tag})
\item 
void {\bf add\-\_\-entity} (std\-::string const \&name)
\item 
bool {\bf numeric\-\_\-entities\-\_\-allowed} () const 
\item 
void {\bf numeric\-\_\-entities\-\_\-allowed} (bool v)
\item 
void {\bf add\-\_\-boolean\-\_\-property} (std\-::string const \&tag\-\_\-name, std\-::string const \&property)
\item 
void {\bf add\-\_\-property} (std\-::string const \&tag\-\_\-name, std\-::string const \&property, {\bf validator\-\_\-type} const \&val)
\item 
void {\bf add\-\_\-property} (std\-::string const \&tag\-\_\-name, std\-::string const \&property, {\bf booster\-::regex} const \&r)
\item 
void {\bf add\-\_\-integer\-\_\-property} (std\-::string const \&tag\-\_\-name, std\-::string const \&property)
\item 
void {\bf add\-\_\-uri\-\_\-property} (std\-::string const \&tag\-\_\-name, std\-::string const \&property)
\item 
void {\bf add\-\_\-uri\-\_\-property} (std\-::string const \&tag\-\_\-name, std\-::string const \&property, std\-::string const \&schema)
\item 
bool {\bf comments\-\_\-allowed} () const 
\item 
void {\bf comments\-\_\-allowed} (bool comments)
\item 
void {\bf encoding} (std\-::string const \&enc)
\end{DoxyCompactItemize}
\subsection*{Static Public Member Functions}
\begin{DoxyCompactItemize}
\item 
static C\-P\-P\-C\-M\-S\-\_\-\-D\-E\-P\-R\-E\-C\-A\-T\-E\-D \\*
{\bf booster\-::regex} {\bf uri\-\_\-matcher} ()
\item 
static C\-P\-P\-C\-M\-S\-\_\-\-D\-E\-P\-R\-E\-C\-A\-T\-E\-D \\*
{\bf booster\-::regex} {\bf uri\-\_\-matcher} (std\-::string const \&schema)
\item 
static {\bf validator\-\_\-type} {\bf uri\-\_\-validator} ()
\item 
static {\bf validator\-\_\-type} {\bf uri\-\_\-validator} (std\-::string const \&scheme, bool absolute\-\_\-only=false)
\item 
static {\bf validator\-\_\-type} {\bf relative\-\_\-uri\-\_\-validator} ()
\end{DoxyCompactItemize}


\subsection{Detailed Description}
The class that holds X\-S\-S filter rules. 

This is the major class the defines the white list rules to handle the Correct H\-T\-M\-L input.

When using these rules you should be very strict about what you need and what you allow.

Basically you need to specify\-:


\begin{DoxyEnumerate}
\item The X\-H\-T\-M\-L or H\-T\-M\-L parsing rules -\/ should be done first
\item The encoding of the text. If you do not specify the encoding it would be assumed that it is A\-S\-C\-I\-I compatible. You may not specify encoding only if you know that it was validated for example by using \doxyref{widgets\-::text}{p.}{classcppcms_1_1widgets_1_1text}, otherwise {\bfseries always} specify encoding
\item Provide the list of tags that should be used. Specify only thous you need. Never allow tags like style, object, embed or of course script as they can be easily used for X\-S\-S attacks
\item Provide essential H\-T\-M\-L attributes -\/ properties for tags you need. Use add\-\_\-uri\-\_\-property for links like src for img or href for a. It would check correctness of U\-R\-I syntax and ensure that only white-\/listed schemas are allowed (i.\-e. no javascript would be allowed). Never allow style tags unless you specify very strict white list of really used styles. Styles can be easily exploited for both X\-S\-S and click-\/jacking. For example 
\begin{DoxyCode}
<p style=\textcolor{stringliteral}{"width: expression(alert('XSS'));"}></p>
\end{DoxyCode}
 If you want to use styles specify very strict list of things you need like\-: 
\begin{DoxyCode}
add_property(\textcolor{stringliteral}{"p"},\textcolor{stringliteral}{"style"},booster::regex(\textcolor{stringliteral}{"text-align:(left|right|center)"}));
\end{DoxyCode}

\item Do not allow comments unless you need them. Note not all comments are allowed. Comments containing \char`\"{}$<$\char`\"{}, \char`\"{}$>$\char`\"{} or \char`\"{}\&\char`\"{} would be considered invalid as some exploits use them.
\end{DoxyEnumerate}

Remember more strict you are it is harder to make attack. Read about X\-S\-S, see existing attacks to understand how they work and then decide what you allow.

rules class can be treated as value for thread safe access, i.\-e. you can safely use const reference and const member functions as long as you don't change the rules under the hood.

The simplest way\-: define at application startup some global rules object configure it and use it for filtering and validation -\/ and make your attackers cry \-:-\/). 

\subsection{Member Typedef Documentation}
\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!validator\-\_\-type@{validator\-\_\-type}}
\index{validator\-\_\-type@{validator\-\_\-type}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{validator\-\_\-type}]{\setlength{\rightskip}{0pt plus 5cm}typedef {\bf booster\-::function}$<$bool(char const $\ast$begin,char const $\ast$end)$>$ {\bf cppcms\-::xss\-::rules\-::validator\-\_\-type}}\label{classcppcms_1_1xss_1_1rules_a69c89d2a52756c854f8aa550b2ddb448}
Functor that allows to provide custom validations for different properties 

\subsection{Member Enumeration Documentation}
\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!html\-\_\-type@{html\-\_\-type}}
\index{html\-\_\-type@{html\-\_\-type}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{html\-\_\-type}]{\setlength{\rightskip}{0pt plus 5cm}enum {\bf cppcms\-::xss\-::rules\-::html\-\_\-type}}\label{classcppcms_1_1xss_1_1rules_a1644c56e2a4307b685dbcfe196203989}
How to treat in input \begin{Desc}
\item[Enumerator]\par
\begin{description}
\index{xhtml\-\_\-input@{xhtml\-\_\-input}!cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}}\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!xhtml\-\_\-input@{xhtml\-\_\-input}}\item[{\em 
xhtml\-\_\-input\label{classcppcms_1_1xss_1_1rules_a1644c56e2a4307b685dbcfe196203989a119fb84ab9d8cfa6faca1251ef49049a}
}]Assume that the input is X\-H\-T\-M\-L. \index{html\-\_\-input@{html\-\_\-input}!cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}}\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!html\-\_\-input@{html\-\_\-input}}\item[{\em 
html\-\_\-input\label{classcppcms_1_1xss_1_1rules_a1644c56e2a4307b685dbcfe196203989a1e1f75cb056dedf154b9fb511f69a1fa}
}]Assume that the input is H\-T\-M\-L. \end{description}
\end{Desc}
\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!tag\-\_\-type@{tag\-\_\-type}}
\index{tag\-\_\-type@{tag\-\_\-type}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{tag\-\_\-type}]{\setlength{\rightskip}{0pt plus 5cm}enum {\bf cppcms\-::xss\-::rules\-::tag\-\_\-type}}\label{classcppcms_1_1xss_1_1rules_a69863596dbd7b396531cba9459210837}
The type of tag \begin{Desc}
\item[Enumerator]\par
\begin{description}
\index{invalid\-\_\-tag@{invalid\-\_\-tag}!cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}}\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!invalid\-\_\-tag@{invalid\-\_\-tag}}\item[{\em 
invalid\-\_\-tag\label{classcppcms_1_1xss_1_1rules_a69863596dbd7b396531cba9459210837a8df492852dfe684990ba826d906f8385}
}]This tag is invalid (returned by validate) \index{opening\-\_\-and\-\_\-closing@{opening\-\_\-and\-\_\-closing}!cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}}\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!opening\-\_\-and\-\_\-closing@{opening\-\_\-and\-\_\-closing}}\item[{\em 
opening\-\_\-and\-\_\-closing\label{classcppcms_1_1xss_1_1rules_a69863596dbd7b396531cba9459210837a445b77dc48475dbffe83772a61c42f4e}
}]This tag should be opened and closed like em , or strong. \index{stand\-\_\-alone@{stand\-\_\-alone}!cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}}\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!stand\-\_\-alone@{stand\-\_\-alone}}\item[{\em 
stand\-\_\-alone\label{classcppcms_1_1xss_1_1rules_a69863596dbd7b396531cba9459210837ad8e043650cd754041ec67adbda0fe155}
}]This tag should stand alone (like hr or br) \index{any\-\_\-tag@{any\-\_\-tag}!cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}}\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!any\-\_\-tag@{any\-\_\-tag}}\item[{\em 
any\-\_\-tag\label{classcppcms_1_1xss_1_1rules_a69863596dbd7b396531cba9459210837a7b09dc31a417c5321682c0b5a99b92bb}
}]This tag can be used in both roles (like input) \end{description}
\end{Desc}


\subsection{Constructor \& Destructor Documentation}
\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!rules@{rules}}
\index{rules@{rules}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{rules}]{\setlength{\rightskip}{0pt plus 5cm}cppcms\-::xss\-::rules\-::rules (
\begin{DoxyParamCaption}
\item[{{\bf json\-::value} const \&}]{r}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a2c1828768ddd48381a78cb3b14be5190}
Create rules from J\-S\-O\-N object {\itshape r} 

The json object the defines the X\-S\-S prevention rules. This object has following properties\-:


\begin{DoxyItemize}
\item \char`\"{}xhtml\char`\"{} -\/ boolean; default true -\/ use X\-H\-T\-M\-L (true) or H\-T\-M\-L input
\item \char`\"{}comments\char`\"{} -\/ boolean; setting it to true allows comments, default false
\item \char`\"{}numeric\-\_\-entities\char`\"{} -\/ boolean; setting it to true allows numeric\-\_\-entities, default false
\item \char`\"{}entities\char`\"{} -\/ array of strings\-: list of allowed H\-T\-M\-L entities besides lt, gt and amp
\item \char`\"{}encoding\char`\"{} -\/ string; the encoding of the text to validate, by default not checked and the input is assumed to be A\-S\-C\-I\-I compatible. Always specifiy it for multibyte encodings like Shift-\/\-J\-I\-S or G\-B\-K as they are not A\-S\-C\-I\-I compatible.
\item \char`\"{}tags\char`\"{} -\/ object with 3 properties of type array of string\-:
\begin{DoxyItemize}
\item \char`\"{}opening\-\_\-and\-\_\-closing\char`\"{} -\/ the tags that should come in pair like \char`\"{}$<$b$>$$<$/b$>$\char`\"{}
\item \char`\"{}stand\-\_\-alone\char`\"{} -\/ the tags that should appear stand alone like \char`\"{}$<$br/$>$\char`\"{}
\item \char`\"{}any\-\_\-tag\char`\"{} -\/ the tags that can be both like \char`\"{}$<$input$>$\char`\"{}
\end{DoxyItemize}
\item \char`\"{}attributes\char`\"{} -\/ array of objects that define H\-T\-M\-L attributes. Each object consists of following properties\-:
\begin{DoxyItemize}
\item \char`\"{}type\char`\"{} -\/ string -\/ the type of the attribute one of\-: \char`\"{}boolean\char`\"{}, \char`\"{}uri\char`\"{}, \char`\"{}relative\-\_\-uri\char`\"{}, \char`\"{}absolute\-\_\-uri\char`\"{}, \char`\"{}integer\char`\"{}, \char`\"{}regex\char`\"{}.
\item \char`\"{}scheme\char`\"{} -\/ string the allowed U\-R\-I scheme -\/ regular expression like \char`\"{}(http$\vert$ftp)\char`\"{}. Used with \char`\"{}uri\char`\"{} and \char`\"{}absolute\-\_\-uri\char`\"{} type
\item \char`\"{}expression\char`\"{} -\/ string the regular expression that defines the value that the attribute should match.
\item \char`\"{}tags\char`\"{} -\/ array of strings -\/ list of tags that this attribute is allowed for.
\item \char`\"{}attributes\char`\"{} -\/ array of strings -\/ lisf of names of the attribute
\end{DoxyItemize}
\end{DoxyItemize}

\char`\"{}pairs\char`\"{} -\/ array of objects that consists of two properities \char`\"{}tag\char`\"{} and \char`\"{}attr\char`\"{} of type string that define tag and attributed that such type of property should be allowed for.

The extra properties that are not defined by this scheme are ingored

For example\-: 
\begin{DoxyCode}
\{
        \textcolor{stringliteral}{"xhtml"} : \textcolor{keyword}{true},
        \textcolor{stringliteral}{"encoding"} : \textcolor{stringliteral}{"UTF-8"},
        \textcolor{stringliteral}{"entities"} : [ \textcolor{stringliteral}{"nbsp"} , \textcolor{stringliteral}{"copy"} ],
        \textcolor{stringliteral}{"comments"} : \textcolor{keyword}{false},
        \textcolor{stringliteral}{"numeric\_entities"} : \textcolor{keyword}{false},
        \textcolor{stringliteral}{"tags"} : \{
                \textcolor{stringliteral}{"opening\_and\_closing"} : [
                        \textcolor{stringliteral}{"p"}, \textcolor{stringliteral}{"b"}, \textcolor{stringliteral}{"i"}, \textcolor{stringliteral}{"tt"},
                        \textcolor{stringliteral}{"a"},
                        \textcolor{stringliteral}{"strong"}, \textcolor{stringliteral}{"em"},
                        \textcolor{stringliteral}{"sub"}, \textcolor{stringliteral}{"sup"},
                        \textcolor{stringliteral}{"ol"}, \textcolor{stringliteral}{"ul"}, \textcolor{stringliteral}{"li"},
                        \textcolor{stringliteral}{"dd"}, \textcolor{stringliteral}{"dt"}, \textcolor{stringliteral}{"dl"},
                        \textcolor{stringliteral}{"blockquote"},\textcolor{stringliteral}{"code"}, \textcolor{stringliteral}{"pre"},
                \textcolor{stringliteral}{"span"}, \textcolor{stringliteral}{"div"}
                ],
                \textcolor{stringliteral}{"stand\_alone"} : [ \textcolor{stringliteral}{"br"}, \textcolor{stringliteral}{"hr"}, \textcolor{stringliteral}{"img"} ]
        ],
        \textcolor{stringliteral}{"attributes"}: [
                \{
                        \textcolor{stringliteral}{"tags"} : [ \textcolor{stringliteral}{"p"}, \textcolor{stringliteral}{"li"}, \textcolor{stringliteral}{"ul"} ]
                        \textcolor{stringliteral}{"attr"} : [ \textcolor{stringliteral}{"style"} ],
                        \textcolor{stringliteral}{"type"} : \textcolor{stringliteral}{"regex"},
                        \textcolor{stringliteral}{"expression"} : \textcolor{stringliteral}{"\(\backslash\)\(\backslash\)s*text-algin:\(\backslash\)\(\backslash\)s*(center|left|right|justify);?\(\backslash\)\(\backslash\)s*"}
                \},
                \{
                        \textcolor{stringliteral}{"tags"} : [ \textcolor{stringliteral}{"span"}, \textcolor{stringliteral}{"div"} ]
                        \textcolor{stringliteral}{"attr"} : [ \textcolor{stringliteral}{"class"}, \textcolor{stringliteral}{"id"} ],
                        \textcolor{stringliteral}{"type"} : \textcolor{stringliteral}{"regex"},
                        \textcolor{stringliteral}{"expression"} : \textcolor{stringliteral}{"[a-zA-Z\_0-9]+"}
                \},
                \{
                \textcolor{stringliteral}{"pairs"} : [ 
                        \{ \textcolor{stringliteral}{"tag"} : \textcolor{stringliteral}{"a"},   \textcolor{stringliteral}{"attr"} : \textcolor{stringliteral}{"href"} \},
                        \{ \textcolor{stringliteral}{"tag"} : \textcolor{stringliteral}{"img"}, \textcolor{stringliteral}{"attr"} : \textcolor{stringliteral}{"src"}  \}
                ],
                        \textcolor{stringliteral}{"type"} : \textcolor{stringliteral}{"absolute\_uri"},
                        \textcolor{stringliteral}{"scheme"} : \textcolor{stringliteral}{"(http|https|ftp)"}
                \},
        \{
                \textcolor{stringliteral}{"tags"} : [ \textcolor{stringliteral}{"img"} ],
                \textcolor{stringliteral}{"attr"} : [ \textcolor{stringliteral}{"alt"} ],
                \textcolor{stringliteral}{"type"} : \textcolor{stringliteral}{"regex"},
                \textcolor{stringliteral}{"expression"} : \textcolor{stringliteral}{".*"}
        \}
        ]
\}
\end{DoxyCode}
 \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!rules@{rules}}
\index{rules@{rules}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{rules}]{\setlength{\rightskip}{0pt plus 5cm}cppcms\-::xss\-::rules\-::rules (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{file\-\_\-name}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a59b47313ec2382e2cc5e21f62432063e}
Create rules from the J\-S\-O\-N object stored in the file {\itshape file\-\_\-name} 

\begin{DoxySeeAlso}{See Also}
\doxyref{rules(json\-::value const\&)}{p.}{classcppcms_1_1xss_1_1rules_a2c1828768ddd48381a78cb3b14be5190} 
\end{DoxySeeAlso}


\subsection{Member Function Documentation}
\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!add\-\_\-boolean\-\_\-property@{add\-\_\-boolean\-\_\-property}}
\index{add\-\_\-boolean\-\_\-property@{add\-\_\-boolean\-\_\-property}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{add\-\_\-boolean\-\_\-property}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::add\-\_\-boolean\-\_\-property (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{tag\-\_\-name, }
\item[{std\-::string const \&}]{property}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a8f5cae3c58d3b2d2e3a17bc283276664}
Add the property that should be allowed to appear for specific tag as boolean property like checked=\char`\"{}checked\char`\"{}, when the type is H\-T\-M\-L it is case insensitive.

The {\itshape property} should be A\-S\-C\-I\-I only \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!add\-\_\-entity@{add\-\_\-entity}}
\index{add\-\_\-entity@{add\-\_\-entity}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{add\-\_\-entity}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::add\-\_\-entity (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{name}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a1c4041a5c4af1fd920e253bce1af3fdf}
Add allowed H\-T\-M\-L entity, by default only \char`\"{}lt\char`\"{}, \char`\"{}gt\char`\"{}, \char`\"{}quot\char`\"{} and \char`\"{}amp\char`\"{} are allowed \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!add\-\_\-integer\-\_\-property@{add\-\_\-integer\-\_\-property}}
\index{add\-\_\-integer\-\_\-property@{add\-\_\-integer\-\_\-property}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{add\-\_\-integer\-\_\-property}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::add\-\_\-integer\-\_\-property (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{tag\-\_\-name, }
\item[{std\-::string const \&}]{property}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a86cfeab9bc1b7fe3e54d7dd0247cc652}
Add numeric property, same as add\-\_\-property(tag\-\_\-name,property,\doxyref{booster\-::regex}{p.}{classbooster_1_1regex}(\char`\"{}-\/?[0-\/9]+\char`\"{}) but little bit more efficient \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!add\-\_\-property@{add\-\_\-property}}
\index{add\-\_\-property@{add\-\_\-property}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{add\-\_\-property}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::add\-\_\-property (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{tag\-\_\-name, }
\item[{std\-::string const \&}]{property, }
\item[{{\bf validator\-\_\-type} const \&}]{val}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a2099cb2d0c6f838048050f8d1243024b}
Add the property that should be checked using custom functor \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!add\-\_\-property@{add\-\_\-property}}
\index{add\-\_\-property@{add\-\_\-property}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{add\-\_\-property}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::add\-\_\-property (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{tag\-\_\-name, }
\item[{std\-::string const \&}]{property, }
\item[{{\bf booster\-::regex} const \&}]{r}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a1e4d681f68f5c80b4b2f9b7239c1d243}
Add the property that should be checked using regular expression. \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!add\-\_\-tag@{add\-\_\-tag}}
\index{add\-\_\-tag@{add\-\_\-tag}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{add\-\_\-tag}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::add\-\_\-tag (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{name, }
\item[{{\bf tag\-\_\-type}}]{ = {\ttfamily {\bf any\-\_\-tag}}}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a2774aa4922de5710747fa13ce459c812}
Add the tag that should be allowed to appear in the text, for H\-T\-M\-L the name is case insensitive, i.\-e. \char`\"{}br\char`\"{}, \char`\"{}\-Br\char`\"{}, \char`\"{}b\-R\char`\"{} and \char`\"{}\-B\-R\char`\"{} are valid tags for name \char`\"{}br\char`\"{}.

The {\itshape name} should be A\-S\-C\-I\-I only \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!add\-\_\-uri\-\_\-property@{add\-\_\-uri\-\_\-property}}
\index{add\-\_\-uri\-\_\-property@{add\-\_\-uri\-\_\-property}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{add\-\_\-uri\-\_\-property}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::add\-\_\-uri\-\_\-property (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{tag\-\_\-name, }
\item[{std\-::string const \&}]{property}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_ab54d7410dc682b3418c0d2f1ffc27bee}
Add U\-R\-I property. It should be used for properties like like \char`\"{}href\char`\"{} or \char`\"{}src\char`\"{}. It is very good idea to use it in order to prevent urls like javascript\-:alert('X\-S\-S')

It's behavior is same as add\-\_\-property(tag\-\_\-name,property,rules\-::uri\-\_\-validator()); \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!add\-\_\-uri\-\_\-property@{add\-\_\-uri\-\_\-property}}
\index{add\-\_\-uri\-\_\-property@{add\-\_\-uri\-\_\-property}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{add\-\_\-uri\-\_\-property}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::add\-\_\-uri\-\_\-property (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{tag\-\_\-name, }
\item[{std\-::string const \&}]{property, }
\item[{std\-::string const \&}]{schema}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a9a8f18331c36bb7b1fde736ca88d398b}
Add U\-R\-I property, using regular expression that matches allowed schemas. It should be used for properties like like \char`\"{}href\char`\"{} or \char`\"{}src\char`\"{}. It is very good idea to use it in order to prevent urls like javascript\-:alert('X\-S\-S')

It's behavior is same as add\-\_\-property(tag\-\_\-name,property,rules\-::uri\-\_\-validator(schema)); \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!comments\-\_\-allowed@{comments\-\_\-allowed}}
\index{comments\-\_\-allowed@{comments\-\_\-allowed}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{comments\-\_\-allowed}]{\setlength{\rightskip}{0pt plus 5cm}bool cppcms\-::xss\-::rules\-::comments\-\_\-allowed (
\begin{DoxyParamCaption}
{}
\end{DoxyParamCaption}
) const}\label{classcppcms_1_1xss_1_1rules_af9057cced4353ff9aab2e4b736e397fd}
Check if the comments are allowed in the text \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!comments\-\_\-allowed@{comments\-\_\-allowed}}
\index{comments\-\_\-allowed@{comments\-\_\-allowed}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{comments\-\_\-allowed}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::comments\-\_\-allowed (
\begin{DoxyParamCaption}
\item[{bool}]{comments}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a2aa42cb719631e8e7f26984b4baa3171}
Set to true if the comments are allowed in the text \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!encoding@{encoding}}
\index{encoding@{encoding}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{encoding}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::encoding (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{enc}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a499564d0a55b0e336fd2e4bc4ec9ef69}
Set the character encoding of the source, otherwise encoding is not checked and assumed valid all invalid characters are removed from the text or replaced with default character

It is very important to specify this option. You may skip it if you are sure that the the input encoding was already validated using cppcms\-::form\-::text widget that handles character encoding validation by default.

In any case it is generally better to always specify this option.

\begin{DoxyNote}{Note}
the replace functionality is not supported for all encoding, only U\-T\-F-\/8, I\-S\-O-\/8859-\/$\ast$ and single byte windows-\/12\-X\-X encodings support such replacement with default character, for all other encodings like Shift-\/\-J\-I\-S, the invalid characters or characters that are invalid for use in H\-T\-M\-L are removed. 
\end{DoxyNote}
\index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!html@{html}}
\index{html@{html}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{html}]{\setlength{\rightskip}{0pt plus 5cm}{\bf html\-\_\-type} cppcms\-::xss\-::rules\-::html (
\begin{DoxyParamCaption}
{}
\end{DoxyParamCaption}
) const}\label{classcppcms_1_1xss_1_1rules_acd852c3ebfd25bc46e9b367583ae75d5}
Get how to treat input -\/ H\-T\-M\-L or X\-H\-T\-M\-L \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!html@{html}}
\index{html@{html}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{html}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::html (
\begin{DoxyParamCaption}
\item[{{\bf html\-\_\-type}}]{t}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_afcada4a56063c90ccc83b637c4bc3fa3}
Set how to treat input -\/ H\-T\-M\-L or X\-H\-T\-M\-L, it should be called first before you add any other rules \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!numeric\-\_\-entities\-\_\-allowed@{numeric\-\_\-entities\-\_\-allowed}}
\index{numeric\-\_\-entities\-\_\-allowed@{numeric\-\_\-entities\-\_\-allowed}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{numeric\-\_\-entities\-\_\-allowed}]{\setlength{\rightskip}{0pt plus 5cm}bool cppcms\-::xss\-::rules\-::numeric\-\_\-entities\-\_\-allowed (
\begin{DoxyParamCaption}
{}
\end{DoxyParamCaption}
) const}\label{classcppcms_1_1xss_1_1rules_ab3860b7d6158aaec81a808a664066d18}
Get if numeric entities are allowed, default is false \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!numeric\-\_\-entities\-\_\-allowed@{numeric\-\_\-entities\-\_\-allowed}}
\index{numeric\-\_\-entities\-\_\-allowed@{numeric\-\_\-entities\-\_\-allowed}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{numeric\-\_\-entities\-\_\-allowed}]{\setlength{\rightskip}{0pt plus 5cm}void cppcms\-::xss\-::rules\-::numeric\-\_\-entities\-\_\-allowed (
\begin{DoxyParamCaption}
\item[{bool}]{v}
\end{DoxyParamCaption}
)}\label{classcppcms_1_1xss_1_1rules_a460042f0b115b0e5831e4ac12dfd0211}
Set if numeric entities are allowed \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!relative\-\_\-uri\-\_\-validator@{relative\-\_\-uri\-\_\-validator}}
\index{relative\-\_\-uri\-\_\-validator@{relative\-\_\-uri\-\_\-validator}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{relative\-\_\-uri\-\_\-validator}]{\setlength{\rightskip}{0pt plus 5cm}static {\bf validator\-\_\-type} cppcms\-::xss\-::rules\-::relative\-\_\-uri\-\_\-validator (
\begin{DoxyParamCaption}
{}
\end{DoxyParamCaption}
)\hspace{0.3cm}{\ttfamily [static]}}\label{classcppcms_1_1xss_1_1rules_a7b9a67c8379b6c143eae60e363ae7ef1}
Create a validator that checks that this U\-R\-I is relative and it is safe for inclusion in U\-R\-I property like href or src \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!uri\-\_\-matcher@{uri\-\_\-matcher}}
\index{uri\-\_\-matcher@{uri\-\_\-matcher}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{uri\-\_\-matcher}]{\setlength{\rightskip}{0pt plus 5cm}static C\-P\-P\-C\-M\-S\-\_\-\-D\-E\-P\-R\-E\-C\-A\-T\-E\-D {\bf booster\-::regex} cppcms\-::xss\-::rules\-::uri\-\_\-matcher (
\begin{DoxyParamCaption}
{}
\end{DoxyParamCaption}
)\hspace{0.3cm}{\ttfamily [static]}}\label{classcppcms_1_1xss_1_1rules_a9ea6960d1aebfbfa6f8f10d6e3544158}
\begin{DoxyRefDesc}{Deprecated}
\item[{\bf Deprecated}]use uri\-\_\-validator \end{DoxyRefDesc}


Create a regular expression that checks U\-R\-I for safe inclusion in the property. By default it allows only\-: http, https, ftp, mailto, news, nntp.

If you need finer control over allowed schemas, use \doxyref{uri\-\_\-matcher(std\-::string const\&)}{p.}{classcppcms_1_1xss_1_1rules_a5e3d3c3e1f01e7e7025853ca92fd7bb3}. \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!uri\-\_\-matcher@{uri\-\_\-matcher}}
\index{uri\-\_\-matcher@{uri\-\_\-matcher}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{uri\-\_\-matcher}]{\setlength{\rightskip}{0pt plus 5cm}static C\-P\-P\-C\-M\-S\-\_\-\-D\-E\-P\-R\-E\-C\-A\-T\-E\-D {\bf booster\-::regex} cppcms\-::xss\-::rules\-::uri\-\_\-matcher (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{schema}
\end{DoxyParamCaption}
)\hspace{0.3cm}{\ttfamily [static]}}\label{classcppcms_1_1xss_1_1rules_a5e3d3c3e1f01e7e7025853ca92fd7bb3}
\begin{DoxyRefDesc}{Deprecated}
\item[{\bf Deprecated}]use uri\-\_\-validator \end{DoxyRefDesc}


Create a regular expression that checks U\-R\-I for safe inclusion in the text, where schema is a regular expression that matches specific protocols that can be used.

\begin{DoxyNote}{Note}
Don't add \char`\"{}$^\wedge$\char`\"{} or \char`\"{}\$\char`\"{} tags as this expression would be used in construction of regular other expression.
\end{DoxyNote}
For example\-: 
\begin{DoxyCode}
booster::regex uri = uri_matcher(\textcolor{stringliteral}{"(http|https)"});
\end{DoxyCode}
 \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!uri\-\_\-validator@{uri\-\_\-validator}}
\index{uri\-\_\-validator@{uri\-\_\-validator}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{uri\-\_\-validator}]{\setlength{\rightskip}{0pt plus 5cm}static {\bf validator\-\_\-type} cppcms\-::xss\-::rules\-::uri\-\_\-validator (
\begin{DoxyParamCaption}
{}
\end{DoxyParamCaption}
)\hspace{0.3cm}{\ttfamily [static]}}\label{classcppcms_1_1xss_1_1rules_a3471f62800f650ac9a4a972e466073fe}
Create a validator that checks U\-R\-I for safe inclusion in the property. By default it allows only\-: http, https, ftp, mailto, news, nntp.

If you need finer control over allowed schemas, use uri\-\_\-validator(std\-::string const\&). \index{cppcms\-::xss\-::rules@{cppcms\-::xss\-::rules}!uri\-\_\-validator@{uri\-\_\-validator}}
\index{uri\-\_\-validator@{uri\-\_\-validator}!cppcms::xss::rules@{cppcms\-::xss\-::rules}}
\subsubsection[{uri\-\_\-validator}]{\setlength{\rightskip}{0pt plus 5cm}static {\bf validator\-\_\-type} cppcms\-::xss\-::rules\-::uri\-\_\-validator (
\begin{DoxyParamCaption}
\item[{std\-::string const \&}]{scheme, }
\item[{bool}]{absolute\-\_\-only = {\ttfamily false}}
\end{DoxyParamCaption}
)\hspace{0.3cm}{\ttfamily [static]}}\label{classcppcms_1_1xss_1_1rules_a47581b9c18b9f5ea53de478dd9240590}
Create a validator that checks U\-R\-I for safe inclusion in the property.
\begin{DoxyItemize}
\item schema is a regular expression that matches specific protocols that can be used.
\item absolute\-\_\-only -\/ set to true to prevent accepting relative U\-R\-Is like \char`\"{}/files/img.\-png\char`\"{} or \char`\"{}test.\-html\char`\"{}
\end{DoxyItemize}

\begin{DoxyNote}{Note}
You don't need to add \char`\"{}$^\wedge$\char`\"{} or \char`\"{}\$\char`\"{} tags to {\itshape scheme} 
\end{DoxyNote}
For example\-: 
\begin{DoxyCode}
uri_validator(\textcolor{stringliteral}{"(http|https)"});
\end{DoxyCode}


If you need finer control over allowed schemas, use uri\-\_\-validator(std\-::string const\&). 

The documentation for this class was generated from the following file\-:\begin{DoxyCompactItemize}
\item 
cppcms/xss.\-h\end{DoxyCompactItemize}
