org.apache.struts2.jasper.security

## Class SecurityUtil

- java.lang.Object
- - org.apache.struts2.jasper.security.SecurityUtil

-     public final class SecurityUtil
      extends Object

  Util class for Security related operations.
  Author:
    Jean-Francois Arcand

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `SecurityUtil()`

  - ### Method Summary

    All Methods Static Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static String` | `filter(String message)` Filter the specified message string for characters that are sensitive in HTML.
    `static boolean` | `isPackageProtectionEnabled()`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### SecurityUtil

          public SecurityUtil()

  - ### Method Detail

    - #### isPackageProtectionEnabled

          public static boolean isPackageProtectionEnabled()

      Returns:
        the `SecurityManager` only if Security is enabled AND package protection mechanism is enabled.

    - #### filter

          public static String filter(String message)

      Filter the specified message string for characters that are sensitive in HTML. This avoids potential attacks caused by including JavaScript codes in the request URL that is often reported in error messages.
      Parameters:
        `message` - The message string to be filtered
      Returns:
        filtered message

Copyright © 2000–2026 Apache Software Foundation. All rights reserved.