org.apache.catalina.filters

Class AddDefaultCharsetFilter

java.lang.Object

org.apache.catalina.filters.AddDefaultCharsetFilter

All Implemented Interfaces:

javax.servlet.Filter

public class AddDefaultCharsetFilter
extends Object
implements javax.servlet.Filter

Filter that explicitly sets the default character set for media subtypes of the "text" type to ISO-8859-1. RFC2616 explicitly states that browsers must use ISO-8859-1 in these circumstances. However, browsers may attempt to auto-detect the character set. This may be exploited by an attacker to perform an XSS attack. Internet Explorer has this behaviour by default. Other browsers have an option to enable it. This filter prevents the attack by explicitly setting a character set. Unless the provided character set is explicitly overridden by the user - in which case they deserve everything they get - the browser will adhere to an explicitly set character set, thus preventing the XSS attack.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
class	AddDefaultCharsetFilter.ResponseWrapper Wrapper that adds the default character set for text media types if no character set is specified.

Constructor Summary

Constructors

Constructor and Description
AddDefaultCharsetFilter()

Method Summary

Methods

Modifier and Type	Method and Description
void	destroy()
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
void	init(javax.servlet.FilterConfig filterConfig)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AddDefaultCharsetFilter

public AddDefaultCharsetFilter()

Method Detail

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter

doFilter

public void doFilter(javax.servlet.ServletRequest request,
            javax.servlet.ServletResponse response,
            javax.servlet.FilterChain chain)
              throws IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

IOException

javax.servlet.ServletException

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException