org.springframework.web.servlet.tags

Class UrlTag

java.lang.Object

TagSupport

org.springframework.web.servlet.tags.RequestContextAwareTag

org.springframework.web.servlet.tags.HtmlEscapingAwareTag

org.springframework.web.servlet.tags.UrlTag

All Implemented Interfaces:

ParamAware

public class UrlTag
extends HtmlEscapingAwareTag
implements ParamAware

JSP tag for creating URLs. Modeled after the JSTL c:url tag with backwards compatibility in mind.

Enhancements to the JSTL functionality include:

• URL encoded template URI variables
• HTML/XML escaping of URLs
• JavaScript escaping of URLs

Template URI variables are indicated in the 'value' attribute and marked by braces '{variableName}'. The braces and attribute name are replaced by the URL encoded value of a parameter defined with the spring:param tag in the body of the url tag. If no parameter is available the literal value is passed through. Params matched to template variables will not be added to the query string.

Use of the spring:param tag for URI template variables is strongly recommended over direct EL substitution as the values are URL encoded. Failure to properly encode URL can leave an application vulnerable to XSS and other injection attacks.

URLs can be HTML/XML escaped by setting the 'htmlEscape' attribute to 'true'. Detects an HTML escaping setting, either on this tag instance, the page level, or the web.xml level. The default is 'false'. When setting the URL value into a variable, escaping is not recommended.

Example usage:

<spring:url value="/url/path/{variableName}">
   <spring:param name="variableName" value="more than JSTL c:url" />
 </spring:url>

Results in: /currentApplicationContext/url/path/more%20than%20JSTL%20c%3Aurl

Since:

3.0

Author:

Scott Andrews

See Also:

ParamTag

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
private static class	UrlTag.UrlType Internal enum that classifies URLs by type.

Field Summary

Fields

Modifier and Type	Field and Description
private java.lang.String	context
private boolean	javaScriptEscape
private java.util.List<Param>	params
private int	scope
private java.util.Set<java.lang.String>	templateParams
private UrlTag.UrlType	type
private static java.lang.String	URL_TEMPLATE_DELIMITER_PREFIX
private static java.lang.String	URL_TEMPLATE_DELIMITER_SUFFIX
private static java.lang.String	URL_TYPE_ABSOLUTE
private java.lang.String	value
private java.lang.String	var

Fields inherited from class org.springframework.web.servlet.tags.RequestContextAwareTag

logger, REQUEST_CONTEXT_PAGE_ATTRIBUTE

Constructor Summary

Constructors

Constructor and Description
UrlTag()

Method Summary

Modifier and Type	Method and Description
void	addParam(Param param) Callback hook for nested spring:param tags to pass their value to the parent tag.
protected java.lang.String	createQueryString(java.util.List<Param> params, java.util.Set<java.lang.String> usedParams, boolean includeQueryStringDelimiter) Build the query string from available parameters that have not already been applied as template params.
private java.lang.String	createUrl() Build the URL for the tag from the tag attributes and parameters.
int	doEndTag()
int	doStartTagInternal() Called by doStartTag to perform the actual work.
protected java.lang.String	replaceUriTemplateParams(java.lang.String uri, java.util.List<Param> params, java.util.Set<java.lang.String> usedParams) Replace template markers in the URL matching available parameters.
void	setContext(java.lang.String context) Set the context path for the URL.
void	setJavaScriptEscape(boolean javaScriptEscape) Set JavaScript escaping for this tag, as boolean value.
void	setScope(java.lang.String scope) Set the scope to export the URL variable to.
void	setValue(java.lang.String value) Sets the value of the URL
void	setVar(java.lang.String var) Set the variable name to expose the URL under.

Methods inherited from class org.springframework.web.servlet.tags.HtmlEscapingAwareTag

htmlEscape, isDefaultHtmlEscape, isHtmlEscape, isResponseEncodedHtmlEscape, setHtmlEscape

Methods inherited from class org.springframework.web.servlet.tags.RequestContextAwareTag

doCatch, doFinally, doStartTag, getRequestContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

URL_TEMPLATE_DELIMITER_PREFIX

private static final java.lang.String URL_TEMPLATE_DELIMITER_PREFIX

See Also:

Constant Field Values

URL_TEMPLATE_DELIMITER_SUFFIX

private static final java.lang.String URL_TEMPLATE_DELIMITER_SUFFIX

See Also:

Constant Field Values

URL_TYPE_ABSOLUTE

private static final java.lang.String URL_TYPE_ABSOLUTE

See Also:

Constant Field Values

params

private java.util.List<Param> params

templateParams

private java.util.Set<java.lang.String> templateParams

type

private UrlTag.UrlType type

value

private java.lang.String value

context

private java.lang.String context

var

private java.lang.String var

scope

private int scope

javaScriptEscape

private boolean javaScriptEscape

Constructor Detail

UrlTag

public UrlTag()

Method Detail

setValue

public void setValue(java.lang.String value)

Sets the value of the URL

setContext

public void setContext(java.lang.String context)

Set the context path for the URL. Defaults to the current context

setVar

public void setVar(java.lang.String var)

Set the variable name to expose the URL under. Defaults to rendering the URL to the current JspWriter

setScope

public void setScope(java.lang.String scope)

Set the scope to export the URL variable to. This attribute has no meaning unless var is also defined.

setJavaScriptEscape

public void setJavaScriptEscape(boolean javaScriptEscape)
                         throws JspException

Set JavaScript escaping for this tag, as boolean value. Default is "false".

Throws:

JspException

addParam

public void addParam(Param param)

Description copied from interface: ParamAware

Callback hook for nested spring:param tags to pass their value to the parent tag.

Specified by:

addParam in interface ParamAware

Parameters:

param - the result of the nested spring:param tag

doStartTagInternal

public int doStartTagInternal()
                       throws JspException

Description copied from class: RequestContextAwareTag

Called by doStartTag to perform the actual work.

Specified by:

doStartTagInternal in class RequestContextAwareTag

Returns:

same as TagSupport.doStartTag

Throws:

JspException

See Also:

javax.servlet.jsp.tagext.TagSupport#doStartTag

doEndTag

public int doEndTag()
             throws JspException

Throws:

JspException

createUrl

private java.lang.String createUrl()
                            throws JspException

Build the URL for the tag from the tag attributes and parameters.

Returns:

the URL value as a String

Throws:

JspException

createQueryString

protected java.lang.String createQueryString(java.util.List<Param> params,
                                             java.util.Set<java.lang.String> usedParams,
                                             boolean includeQueryStringDelimiter)
                                      throws JspException

Build the query string from available parameters that have not already been applied as template params.

The names and values of parameters are URL encoded.

Parameters:

params - the parameters to build the query string from

usedParams - set of parameter names that have been applied as template params

includeQueryStringDelimiter - true if the query string should start with a '?' instead of '&'

Returns:

the query string

Throws:

JspException

replaceUriTemplateParams

protected java.lang.String replaceUriTemplateParams(java.lang.String uri,
                                                    java.util.List<Param> params,
                                                    java.util.Set<java.lang.String> usedParams)
                                             throws JspException

Replace template markers in the URL matching available parameters. The name of matched parameters are added to the used parameters set.

Parameter values are URL encoded.

Parameters:

uri - the URL with template parameters to replace

params - parameters used to replace template markers

usedParams - set of template parameter names that have been replaced

Returns:

the URL with template parameters replaced

Throws:

JspException