I managed to locate the code for preventing XSS attacks.
private String cleanXSS(String value) {
value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");
value = value.replaceAll("\\(","& #40;").replaceAll("\\)","& #41;");
value = value.replaceAll("'","& #39;");
value = value.replaceAll("eval\\((.*)\\)","");
value = value.replaceAll("[\"']\\s*javascript:(.*)[\"']", "\"\"");
value = value.replaceAll("script", "");
return value;
}
Are these correct: & lt, & gt, & #40, & #41, & #39? Let me know if there's any mistake.
I believe it should be <, > ... with no space between & and lt.