Package com.oorian.html.elements

Class RawHtml<T extends RawHtml<T>>

java.lang.Object
com.oorian.html.Element<T>
com.oorian.html.elements.Text<T>
com.oorian.html.elements.RawHtml<T>
Direct Known Subclasses:
HtmlFragment
public class RawHtml<T extends RawHtml<T>> extends Text<T>
Represents raw, unescaped HTML content within an HTML document structure.

This class extends Text but overrides the HTML escaping behavior to output content exactly as provided, without any HTML entity encoding. This is useful when you need to inject trusted HTML markup directly into the document.

Security Warning:

Only use this class with trusted HTML content. Never use RawHtml with user-provided input, as it bypasses XSS protection and could allow injection attacks. For user-provided text content, use the regular Text class which automatically HTML-escapes all content.

Usage:


 // Safe: Trusted static HTML
 Div div = new Div();
 div.addElement(new RawHtml("<strong>Bold text</strong>"));

 // Safe: Pre-sanitized content from trusted source
 String trustedMarkup = contentManagementSystem.getRenderedContent();
 div.addElement(new RawHtml(trustedMarkup));

 // DANGEROUS - Never do this:
 // String userInput = request.getParameter("comment");
 // div.addElement(new RawHtml(userInput));  // XSS vulnerability!

 // Safe alternative for user input:
 String userInput = request.getParameter("comment");
 div.addElement(new Text(userInput));  // Automatically escaped
Since:
2025
Version:
1.0
Author:
Marvin P. Warble Jr.
See Also:

  • Constructor Details

    • RawHtml

      public RawHtml()
      Constructs an empty RawHtml element.

      Content can be set later using Text.setText(String).

    • RawHtml

      public RawHtml(String html)
      Constructs a RawHtml element with the specified HTML content.

      The provided HTML will be rendered exactly as-is, without any escaping. Only use with trusted content.

      Parameters:
      html - the raw HTML content (must be trusted)

  • Method Details

    • getHtml

      public void getHtml(StringBuilder sb)
      Appends the raw HTML content to the provided StringBuilder without escaping.

      Unlike Text.getHtml(StringBuilder), this method outputs the content exactly as stored, without any HTML entity encoding. This allows trusted HTML markup to be rendered directly.

      Overrides:
      getHtml in class Text<T extends RawHtml<T>>
      Parameters:
      sb - the StringBuilder to append the raw HTML content to
      See Also: