* information using that API and returns a single enum representing the current state.
*
* @return AutoEscapeState enum representing the current state.
*/
public AutoEscapeState getCurrentState() {
ExternalState state = htmlParser.getState();
String tag = htmlParser.getTag();
// Currently we do not do any escaping inside CSS blocks, so ignore them.
if (state.equals(HtmlParser.STATE_CSS_FILE) || tag.equals("style")) {
return AutoEscapeState.STYLE;
}
// Handle variables inside <script> tags.
if (htmlParser.inJavascript() && !state.equals(HtmlParser.STATE_VALUE)) {
if (htmlParser.isJavascriptQuoted()) {
// <script> var a = "<?cs var: Blah ?>"; </script>
return AutoEscapeState.JS;
} else {
// <script> var a = <?cs var: Blah ?>; </script>
// No quotes around the variable, hence it can inject arbitrary javascript.
// So severely restrict the values it may contain.
return AutoEscapeState.JS_UNQUOTED;
}
}
// Inside an HTML tag or attribute name
if (state.equals(HtmlParser.STATE_ATTR) || state.equals(HtmlParser.STATE_TAG)) {
return AutoEscapeState.ATTR;
// TODO: Need a strict validation function for tag and attribute names.
} else if (state.equals(HtmlParser.STATE_VALUE)) {
// Inside an HTML attribute value
return getCurrentAttributeState();
} else if (state.equals(HtmlParser.STATE_COMMENT) || state.equals(HtmlParser.STATE_TEXT)) {
// Default is assumed to be HTML body
// <b>Hello <?cs var: UserName ?></b> :
return AutoEscapeState.HTML;
}
throw new JSilverAutoEscapingException("Invalid state received from HtmlParser: "
+ state.toString(), resourceName, htmlParser.getLineNumber(), htmlParser.getColumnNumber());
}