com.liferay.faces.util.render

Class RendererUtil

java.lang.Object

com.liferay.faces.util.render.RendererUtil

public class RendererUtil
extends Object

Author:

Neil Griffin

Constructor Summary

Constructors

Constructor and Description
RendererUtil()

Method Summary

Methods

Modifier and Type	Method and Description
static void	addDefaultAjaxBehavior(javax.faces.component.behavior.ClientBehaviorHolder clientBehaviorHolder, String execute, String process, String defaultExecute, String render, String update, String defaultRender)
static void	decodeClientBehaviors(javax.faces.context.FacesContext facesContext, javax.faces.component.UIComponent uiComponent)
static void	encodeStyleable(javax.faces.context.ResponseWriter responseWriter, Styleable styleable, String... classNames)
static String	escapeJavaScript(String javaScript) Escapes JavaScript so that it can safely be rendered as string in the browser.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

RendererUtil

public RendererUtil()

Method Detail

addDefaultAjaxBehavior

public static void addDefaultAjaxBehavior(javax.faces.component.behavior.ClientBehaviorHolder clientBehaviorHolder,
                          String execute,
                          String process,
                          String defaultExecute,
                          String render,
                          String update,
                          String defaultRender)

decodeClientBehaviors

public static void decodeClientBehaviors(javax.faces.context.FacesContext facesContext,
                         javax.faces.component.UIComponent uiComponent)

encodeStyleable

public static void encodeStyleable(javax.faces.context.ResponseWriter responseWriter,
                   Styleable styleable,
                   String... classNames)
                            throws IOException

Throws:

IOException

escapeJavaScript

public static String escapeJavaScript(String javaScript)

Escapes JavaScript so that it can safely be rendered as string in the browser. This method escapes JS according to the recommendations provided in OWASP's Cross Site Scripting (XSS) Prevention Cheat Sheet. Note: escaped JS can only be rendered into certain JS strings. If it is rendered anywhere else, the site will still be vulnerable to XSS. See the link for more details.

Parameters:

javaScript - a JavaScript string which has not been escaped to prevent XSS.

Returns:

an escaped JavaScript string.