Skip to content

Instantly share code, notes, and snippets.

@stevewithington
Last active August 29, 2015 14:05
Show Gist options
  • Save stevewithington/f1f50bacc01a86402059 to your computer and use it in GitHub Desktop.
Save stevewithington/f1f50bacc01a86402059 to your computer and use it in GitHub Desktop.
Mura CMS : esapiEncode() for Adobe ColdFusion
<cfif Not StructKeyExists(server, 'railo')>
<cffunction name="esapiEncode" output="false" returntype="string">
<cfargument name="encodeFor" type="string" default="html" hint="encode for what, valid values are: - css: for output inside Cascading Style Sheets (CSS) - dn: for output in LDAP Distinguished Names - html: for output inside HTML - html_attr: for output inside HTML Attributes - javascript: for output inside Javascript - ldap: for output in LDAP queries - url: for output in URL - vbscript: for output inside vbscript - xml: for output inside XML - xml_attr: for output inside XML Attributes - xpath: for output in XPath">
<cfargument name="inputString" type="string" required="true" hint="Required. String to encode">
<cfscript>
var lc = {};
var encodedString = '';
lc.encoder = CreateObject("java", "org.owasp.esapi.ESAPI").encoder();
switch(arguments.encodeFor) {
case 'css' :
encodedString = lc.encoder.encodeForCSS(JavaCast("string", arguments.inputString));
break;
case 'dn' :
encodedString = lc.encoder.encodeForDN(JavaCast("string", arguments.inputString));
break;
case 'html' :
encodedString = lc.encoder.encodeForHTML(JavaCast("string", arguments.inputString));
break;
case 'html_attr' :
encodedString = lc.encoder.encodeForHTMLAttribute(JavaCast("string", arguments.inputString));
break;
case 'javascript' :
encodedString = lc.encoder.encodeForJavaScript(JavaCast("string", arguments.inputString));
break;
case 'ldap' :
encodedString = lc.encoder.encodeForLDAP(JavaCast("string", arguments.inputString));
break;
case 'url' :
encodedString = lc.encoder.encodeForURL(JavaCast("string", arguments.inputString));
break;
case 'vbscript' :
encodedString = lc.encoder.encodeForHTML(JavaCast("string", arguments.inputString));
break;
case 'xml' :
encodedString = lc.encoder.encodeForXML(JavaCast("string", arguments.inputString));
break;
case 'xml_attr' :
encodedString = lc.encoder.encodeForXMLAttribute(JavaCast("string", arguments.inputString));
break;
case 'xpath' :
encodedString = lc.encoder.encodeForXPath(JavaCast("string", arguments.inputString));
break;
default :
throw(
type = 'Invalid data'
, message = "The encodeFor value ["& arguments.encodeFor & "] is invalid, valid values are [css,dn,html,html_attr,javascript,ldap,vbscript,xml,xml_attr,xpath]"
);
}
return encodedString;
</cfscript>
</cffunction>
</cfif>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment