Is it possible to "sandbox" html content within a JSP?

I am trying to create a tool within my Spring MVC webapp where the JSP page takes in text from a user from a textbox, then displays the user text below the textbox with every non-UTF8 decode-able character highlighted in yellow (by taking in the user text as a string, and wrapping every non-UTF8 character with <span style='background:yellow'>(character)</span> and saving the result as form.userDataHighlighted), then display it in the webpage as such:

<TABLE...>
........
                                          <TR>
                                                <TD valign="top">
                                                      <div>${form.userDataHighlighted}</div>
                                                </TD>
                                          </TR>
</TABLE>

The problem is that the user may enter html content with CSS styling as such:

<html>
<head>
<meta http-equiv=Content-Type content="text/plain; charset=utf-8">
<title></title>

<style>
(some user defined styling)
......
</style>
</head>
<body>
....
</body>
</html>

and this can affect the styling of the main webpage (for example, change the background color of the main webpage).

Is there a way I can "sandbox" the user text within the JSP so that it cannot affect the main JSP styling (such as display it in some kind of frame)? I have tried something like:

<table border="1">
<tr>
<td style="width:500px;height:400px">
<iframe srcdoc=${form.userDataHighlighted} frameborder="0" style="width:100%;height:100%"></iframe>
</td>
</tr>
</table>

and also:

<jsp:include.......>

but in both cases, the background color of the main page is still affected. Is there a way I can display the user's text with the non-UTF8 characters highlighted without allowing the user content to affect the styling of the main page?

// Replace any < and > with their HTML entities, this should stop the browser from interpretting them as HTML but they should still output correctly String userDataEscaped = form.userData.replaceAll("<", "<").replaceAll(">", ">"); // THEN, you can add in your <span style.. to highlight whatever you need form.userDataHighlighted = highlightData(userDataEscaped);

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

LVL 37

mccarlIT Business Systems Analyst / Software DeveloperCommented: 2016-01-13

Have you tried just escaping the user's input, something like this...

// Replace any < and > with their HTML entities, this should stop the browser from interpretting them as HTML but they should still output correctly
String userDataEscaped = form.userData.replaceAll("<", "&lt;").replaceAll(">", "&gt;");

// THEN, you can add in your <span style.. to highlight whatever you need
form.userDataHighlighted = highlightData(userDataEscaped);

Open in new window

As an aside, since most (all?) browsers will encode the users input AS UTF-8, how do you ever receive any NON UTF-8 characters?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial

LVL 87

CEHJCommented: 2016-01-14

Escaping the user input (if they enter html, styled or otherwise) will leave you with tags on the page of course. Why not just strip out the tags? That will remove any styling too

jksungAuthor Commented: 2016-01-14

Thank you! This works perfectly for me.

To get the non-UTF characters (or the original string before the browser encodes it in utf8), we manually re-decode the string in the controller.
(String originalString = StringManipulation.decodeUTF8String(inputString);)

mccarlIT Business Systems Analyst / Software DeveloperCommented: 2016-01-14

You're welcome!

I was just thinking though, it would probably be beneficial to escape the & character as well. Like this...

String userDataEscaped = form.userData.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");

(Note the order of the above 'replace' operations are important, the '&' must be escaped first, otherwise it would break what the other two 'replace' are doing)

Is it possible to "sandbox" html content within a JSP?

Who is Participating?