WARNING: this is not as thorough as the HTML filter - we do not enumerate all possible attributes etc. New versions of the spec could conceivably lead to new risks How this would happen: a) Another way to include URLs, apart from @import and url() (we are safe from new @ directives though) b) A way to specify the MIME type of includes, IF those includes could be a risky type (HTML, CSS, etc) This is still FAR more rigorous than the old filter though.
If you want extra paranoia, turn on paranoidStringCheck, which will throw an exception when it encounters strings with colons in; then the only risk is something that includes, and specifies the type of, HTML, XML or XSL.
All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.