title: XSS Security using AntiSamy in Spring MVC
body: <p>I want to filter the contents of all input tags from my HTML. I am using the AntiSamy filter, as of now my filter is filtering out complete html content (instead of input value only).</p>
  <p>I am using the implementation provided here:</p>
  <p><a href="http://github.com/born2snipe/antisamy-filter" rel="nofollow noreferrer">Github</a></p>
  <p>Inside the doFilter method i am using this piece of code to scan the content</p>
  <pre><code>HttpServletResponseInvocationHandler invocationHandler = httpResponseInvocationHandlerFactory.build((HttpServletResponse) response);
  
  CleanResults cleanResults = antiSamy.scan(invocationHandler.getContents(), policy);
  </code></pre>
  <p>whereas what i want is about:</p>
  <pre><code>CleanResults cleanResults = antiSamy.scan(request.getParameter(&quot;input&quot;), policy);
  </code></pre>
  <p>So that only the content of input field is filtered.</p>
  <p>here is the whole doFilter Method:</p>
  <pre><code>public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
      if (response instanceof HttpServletResponse) {
          HttpServletResponseInvocationHandler invocationHandler = httpResponseInvocationHandlerFactory.build((HttpServletResponse) response);
          HttpServletResponse proxiedResponse = httpResponseProxyFactory.build(invocationHandler);
          chain.doFilter(request, proxiedResponse);
  
          if (&quot;text/html;charset=UTF-8&quot;.equals(proxiedResponse.getContentType())) {
              try {
                  Policy policy = policyFileLoader.load(policyFile);
                  antiSamy.setInputEncoding(inputEncoding);
                  antiSamy.setOutputEncoding(outputEncoding);
                  
                  CleanResults cleanResults = antiSamy.scan(invocationHandler.getContents(), policy);
                  log.info(&quot;Number of Errors: &quot; + cleanResults.getNumberOfErrors());
                  if (log.isDebugEnabled()) {
                      log.debug(&quot;Errors found: &quot;);
                      List errors = cleanResults.getErrorMessages();
                      for (int i = 0; i &lt; errors.size(); i++) {
                          log.debug(&quot;\t&quot; + (i + 1) + &quot;. &quot; + errors.get(i));
                      }
                  }
                  log.info(&quot;Scan time (in seconds): &quot; + cleanResults.getScanTime());
                  response.getOutputStream().write(cleanResults.getCleanHTML().getBytes());
              } catch (ScanException e) {
                  log.error(GENERIC_ERROR, e);
              } catch (PolicyException e) {
                  log.error(GENERIC_ERROR, e);
              }
          } else {
   
              response.getOutputStream().write(invocationHandler.getBytes());
          }
      } else {
          chain.doFilter(request, response);
      }
  }
  </code></pre>
  <p>I have tried it on ALL policy files provided by AntiSamy as default.</p>
  <p>It'd be great if can get some help on this.</p>