javax.servlet.jsp.jstl.tlv

TLVs allow translation-time validation of the XML view of a JSP page. The TLVs provided by JSTL allow tag library authors to enforce restrictions regarding the use of scripting elements and permitted tag libraries in JSP pages.

For example, any JSP page that imports the tag library with the following Tag Library Descriptor (TLD) file will be restricted to using JSTL tags:

<?xml version="1.0" encoding="UTF-8" ?>

<taglib xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-jsptaglibrary_2_1.xsd"
    version="2.1">
  <description>
    Restricts JSP pages to the JSTL tag libraries
  </description>
  <display-name>permittedTaglibs</display-name>
  <tlib-version>1.1</tlib-version>
  <short-name>permittedTaglibs</short-name>
  <uri>http://java.sun.com/jstl/permittedTaglibs</uri>

  <validator>
    <validator-class>
        javax.servlet.jsp.jstl.tlv.PermittedTaglibsTLV
    </validator-class>
    <init-param>
      <description>
        Whitespace-separated list of taglib URIs to permit.
      </description>
      <param-name>permittedTaglibs</param-name>
      <param-value>
        http://java.sun.com/jsp/jstl/core
        http://java.sun.com/jsp/jstl/fmt
        http://java.sun.com/jsp/jstl/sql
        http://java.sun.com/jsp/jstl/xml
      </param-value>
    </init-param>
  </validator>
</taglib>

A TagLibraryValidator class to allow a TLD to restrict what taglibs (in addition to itself) may be imported on a page where it's used.

This TLV supports the following initialization parameter:

• permittedTaglibs: A whitespace-separated list of URIs corresponding to tag libraries permitted to be imported on the page in addition to the tag library that references PermittedTaglibsTLV (which is allowed implicitly).

A TagLibraryValidator for enforcing restrictions against the use of JSP scripting elements.

This TLV supports four initialization parameters, for controlling which of the four types of scripting elements are allowed or prohibited:

• allowDeclarations: if true, indicates that declaration elements are not prohibited.
• allowScriptlets: if true, indicates that scriptlets are not prohibited
• allowExpressions: if true, indicates that top-level expression elements (i.e., expressions not associated with request-time attribute values) are not prohibited.
• allowRTExpressions: if true, indicates that expression elements associated with request-time attribute values are not prohibited.

The default value for all for initialization parameters is false, indicating all forms of scripting elements are to be prohibited.