如何使用 Jsoup 将不允许的 html 标记分隔符转换为存在不允许标记的实体

Question

使用 Jsoup clean 是否可以转换此字符串：

Here is some <b>important</b> stuff that can't have 
<script>javascript</script> or the following embed tag 
<embed src="helloworld.swf" type="application/vnd.adobe.flash-movie"> movie 
in the output

到这里：

Here is some <b>important</b> stuff that can't have 
&lt;script&gt;javascript&lt;/script&gt; or the following embed tag 
&lt;embed src="helloworld.swf" type="application/vnd.adobe.flash-movie"&gt;
movie in the output

所以它呈现

这里有一些重要不能有的东西 或以下嵌入标签 输出中的电影

粗体标签是允许的，但脚本和嵌入标签的分隔符从 < > 更改为 < and >，因此它们被视为文本而不是真正的 html 元素。

完成此操作需要哪些设置？我有：

    private static String limitHtml(String value) {
    String result = value;
    if (value != null && !value.isEmpty()) {
        Document.OutputSettings settings = new Document.OutputSettings();
        settings.prettyPrint(false);

        // what other settings ???

        Whitelist whitelist = Whitelist.none().addTags(ALLOWED_HTML_TAGS);
        whitelist.addAttributes(":all", ALLOWED_HTML_ATTRIBUTES);
        result = Jsoup.clean(value, "", whitelist, settings);
    }
    return result;
}

如果 Jsoup 没有，是否有类似的 Java 库可以完成此任务。

Answer 1

Jsoup 绝对可以让您回到这里。诀窍是使用一个虚拟文档（代码中的transitional 变量），其中包含一个pre 元素。

我们将简单地添加在此pre 元素中找到的每个不允许的元素。 稍后，我们将初始值中不允许的元素替换为其转义的 html 代码。

代码

// Comma separated list of allowed tags.
private static String ALLOWED_HTML_TAGS_CSS_QUERY = "b,span";

private static String limitHtml(String value) {
    String result = value;
    if (value != null && !value.isEmpty()) {
        // Build a sided document. It will help us escape unallowed tags. 
        Document transitional = Jsoup.parse("<pre></pre>");
        
        // Parse the actual value for finding unallowed tags
        Document doc = Jsoup.parseBodyFragment(value, "");
        Elements unallowedElements = doc.select("*:not("+ALLOWED_HTML_TAGS_CSS_QUERY+")");

        for (Element e : unallowedElements) {
            switch (e.tagName()) {
            case "#root": case "html": case "head": case "body":
                // Those tags are added automatically by Jsoup. Nothing to do...
                break;

            default:
                // Load the unallowed element to escape its html code in the transitional document
                Element pre = transitional.select("pre").first().text(e.outerHtml());
                
                // Replace unallowed element with its escape html code
                e.replaceWith(new TextNode(pre.text(), ""));
            }
        }

        // Get the final sanitized value
        Document.OutputSettings settings = new Document.OutputSettings();
        settings.prettyPrint(false);

        Whitelist whitelist = Whitelist.none().addTags(ALLOWED_HTML_TAGS);
        whitelist.addAttributes(":all", ALLOWED_HTML_ATTRIBUTES);
        result = Jsoup.clean(doc.body().html(), "", whitelist, settings);
    }

    return result;
}

示例用法

String unsanitizedHtml = "Here is some <b>important</b> stuff that can't have " + //
        "<script>javascript</script> or the following embed tag " + //
        "<embed src=\"helloworld.swf\" type=\"application/vnd.adobe.flash-movie\"> movie" + //
        "in the output";

System.out.println("BEFORE:\n" + unsanitizedHtml);
System.out.println();
System.out.println("AFTER:\n" + limitHtml(unsanitizedHtml));

输出

BEFORE:
Here is some <b>important</b> stuff that can't have <script>javascript</script> or the following embed tag <embed src="helloworld.swf" type="application/vnd.adobe.flash-movie"> moviein the output

AFTER:
Here is some <b>important</b> stuff that can't have &lt;script&gt;javascript&lt;/script&gt; or the following embed tag &lt;embed src="helloworld.swf" type="application/vnd.adobe.flash-movie"&gt; moviein the output