Page History

// String s may be user controllable
// \uFE64 is normalized to <&lt; and \uFE64 is normalized to >&gt; using KFKC
String s = "&quot;\uFE64"&quot; + "script"&quot;script&quot; + "&quot;\uFE65"&quot;; 

//validate
Pattern pattern = Pattern.compile("[<>]"&quot;[&lt;&gt;]&quot;); // check for angle brackets
Matcher matcher = pattern.matcher(s);
if(matcher.find()) {
  System.out.println("&quot;found black listed tag"&quot;);
} else {
  // ... 
}

// normalize
s = Normalizer.normalize(s, Form.NFKC); 

String s = ""\uFE64"" + "script""script" + ""\uFE65"";

// normalize
s = Normalizer.normalize(s, Form.NFKC); 

//validate
Pattern pattern = Pattern.compile("[<>]"&quot;[&lt;&gt;]&quot;); 
Matcher matcher = pattern.matcher(s);
if(matcher.find()) {
  System.out.println("&quot;found black listed tag"&quot;); 
  throw new IllegalStateException();
} else {
  // ... 
}