The xss rules configuration provides details about what tags and attributes are accepted and rejected in the input data.

The xss-rules can be written in multiple files and can be imported to the main configuration file using the <import> tag and the file name as the name of the file in the classpath, and name of the xss-rules section in that imported file. Each imported file has the xss-rules same as those explained in this section.

An example would be:

The above tag imports the xss-rules named as "xss-default-html4" from the above file location in the classpath.

This section explains about common attributes:

The following code explains configuration about which attributes should be accepted for any tag.

Example:

This accepts the align attribute in any tag.

This can be further restricted by using the <except-tag> which restricts the common attribute.

Example:

This indicates that the "id" attribute can be accepted for any tag except the script tag.

The value of the attribute can be restricted with the multiple regular expressions given below. If there are no regular expressions defined, then the attribute is accepted irrespective of its value.

The above configuration indicates that the align attribute should be accepted for any tag, but the value of the attribute must be center, left or right only.

Which tags should be accepted in configuration for input data is defined using <accept-tag>.

For example:

The above rule says that the "b" bold tag can be accepted.

Tag specific attribute: Each accept tag does allow multiple attributes that can be allowed for that tag only is given below.

The above rule indicates that the "b" tag is accepted with the align and style attributes within it.

The attribute configured with the following tag is rejected for all tags.

The tags configured with the following rule is rejected in the input data.

The following snippet rejects the attribute for the given tag.

The default configuration will not allow the following tags: