Skip to content

New methods for excluding elements with specific missing or empty attributes #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 30 commits into
base: master
Choose a base branch
from
Open

New methods for excluding elements with specific missing or empty attributes #45

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
30 commits
Select commit Hold shift + click to select a range
73b68bc
+Added HtmlPolicyBuilder methods for excluding elements with specific…
Oct 9, 2015
e75d980
Reverted changes
Oct 9, 2015
ea02e71
added methods for excluding elements with specific empty or missing a…
Oct 9, 2015
2537933
Added TestCase for disallowWithoutAttribute()
Nov 9, 2015
e6dd2ea
s/master/main/ for default branch
mikesamuel Jun 15, 2020
f3f56d4
Release candidate 20200615.1
mikesamuel Jun 15, 2020
fd6b2dd
Bumped dev version
mikesamuel Jun 15, 2020
eb6ef02
Do not lcase element or attribute names that match SVG or MathML name…
mikesamuel Jul 13, 2020
25c3d64
Release candidate 20200713.1
mikesamuel Jul 13, 2020
ffe5cfa
Bumped dev version
mikesamuel Jul 13, 2020
c7db2d4
we use spotbugs now instead of findbugs
mikesamuel Jul 13, 2020
ca40697
s/master/main/ in doc URLs
mikesamuel Jul 13, 2020
af0ca83
Bump junit from 4.12 to 4.13.1 in /parent (#215)
dependabot[bot] Dec 7, 2020
acaf3f2
hsl and hsla (#216)
aakritisi Dec 9, 2020
33d319f
Fix code formatting lint checks (#217)
mikesamuel Dec 14, 2020
020d5d0
Fixed allowAtributes("style").globally() (#218)
aakritisi Dec 21, 2020
ad287c3
Upgrade to a modern guava dependency
mikesamuel May 13, 2021
be33ec6
Render style tag content more strictly.
mikesamuel Oct 18, 2021
374ea2f
Release candidate 20211018.1
mikesamuel Oct 18, 2021
7d76ba9
Bumped dev version
mikesamuel Oct 18, 2021
e2b29e8
Update vulnerabilities.md
mikesamuel Oct 18, 2021
14f84fd
Recognize that `<style>` is not really workable inside `<select>`
mikesamuel Oct 18, 2021
62a0715
Release candidate 20211018.2
mikesamuel Oct 18, 2021
06b299c
Bumped dev version
mikesamuel Oct 18, 2021
5372c74
Decode attribute content differently from text node content (#255)
mikesamuel Jun 8, 2022
c2c74fc
Fix missing null checks in uses of consumeIdentOrUrlOrFunctions (#266)
mikesamuel Jun 8, 2022
e35ef4f
Release candidate 20220608.1
mikesamuel Jun 8, 2022
3756979
Bumped dev version
mikesamuel Jun 8, 2022
0372f4f
Merge branch 'OWASP:master' into master
forum-is Nov 29, 2022
ccb4c18
Merge remote-tracking branch 'upstream/main'
forum-is Jan 5, 2023
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Release candidate 20200713.1
  • Loading branch information
@mikesamuel
mikesamuel committed Jul 13, 2020
commit 25c3d64c4c0764d86792a2e23b8f5498a449b9de
10 changes: 5 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ how to get started with or without Maven.
## Prepackaged Policies

You can use
[prepackaged policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/Sanitizers.html):
[prepackaged policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/Sanitizers.html):

```Java
PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
Expand All @@ -47,7 +47,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
The
[tests](https://github.com/OWASP/java-html-sanitizer/blob/master/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java)
show how to configure your own
[policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlPolicyBuilder.html):
[policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlPolicyBuilder.html):

```Java
PolicyFactory policy = new HtmlPolicyBuilder()
Expand All @@ -62,7 +62,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
## Custom Policies

You can write
[custom policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/ElementPolicy.html)
[custom policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/ElementPolicy.html)
to do things like changing `h1`s to `div`s with a certain class:

```Java
Expand All @@ -85,7 +85,7 @@ need to be explicitly whitelisted using the `allowWithoutAttributes()`
method if you want them to be allowed through the filter when these
elements do not include any attributes.

[Attribute policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/AttributePolicy.html) allow running custom code too. Adding an attribute policy will not water down any default policy like `style` or URL attribute checks.
[Attribute policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/AttributePolicy.html) allow running custom code too. Adding an attribute policy will not water down any default policy like `style` or URL attribute checks.

```Java
new HtmlPolicyBuilder = new HtmlPolicyBuilder()
Expand Down Expand Up @@ -153,7 +153,7 @@ of the output.

## Telemetry

When a policy rejects an element or attribute it notifies an [HtmlChangeListener](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlChangeListener.html).
When a policy rejects an element or attribute it notifies an [HtmlChangeListener](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlChangeListener.html).

You can use this to keep track of policy violation trends and find out when someone
is making an effort to breach your security.
Expand Down
4 changes: 2 additions & 2 deletions aggregate/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,12 @@
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>aggregate</artifactId>
<packaging>pom</packaging>
<version>20200615.2-SNAPSHOT</version>
<version>20200713.1</version>
<parent>
<relativePath>../parent</relativePath>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>parent</artifactId>
<version>20200615.2-SNAPSHOT</version>
<version>20200713.1</version>
</parent>

<modules>
Expand Down
4 changes: 4 additions & 0 deletions change_log.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
# OWASP Java HTML Sanitizer Change Log

Most recent at top.
* Release 20200713.1
* Do not lower-case SVG/MathML names.
This shouldn't cause problems since it was hard to write policies for
SBG, but be aware that SVG's `<textArea>` is now distinct from HTML's `<textarea>`.
* Release 20200615.1
* Change `.and` when combining two policies to respect explicit `skipIfEmpty` decisions.
* HTML entity decoding now follows HTML standard rules about when a semicolon is optional.
Expand Down
10 changes: 5 additions & 5 deletions docs/getting_started.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,16 +30,16 @@ it to HTML.
The
[javadoc](http://javadoc.io/doc/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/)
covers more detailed topics, including
[customization](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlPolicyBuilder.html).
[customization](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlPolicyBuilder.html).

Important classes are:

* [Sanitizers](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
* [HtmlPolicyBuilder](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
* [Sanitizers](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
* [HtmlPolicyBuilder](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.

For advanced use, see:
* [AttributePolicy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20180219.1/org/owasp/html/ElementPolicy.html) allow complex customization.
* [HtmlStreamEventReceiver](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
* [AttributePolicy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20180219.1/org/owasp/html/ElementPolicy.html) allow complex customization.
* [HtmlStreamEventReceiver](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.

## Asking Questions

Expand Down
2 changes: 1 addition & 1 deletion docs/maven.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ Bigger numbers are more recent and the [change log](../change_log.md)
can shed light on the salient differences.

You should be able to build with the HTML sanitizer. You can read the
[javadoc](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/index.html),
[javadoc](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/index.html),
and if you have questions that aren't answered by these wiki pages,
you can ask on the
[mailing list](http://groups.google.com/group/owasp-java-html-sanitizer-support).
Expand Down
4 changes: 2 additions & 2 deletions empiricism/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,13 @@
<modelVersion>4.0.0</modelVersion>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>html-types</artifactId>
<version>20200615.2-SNAPSHOT</version>
<version>20200713.1</version>
<packaging>jar</packaging>
<parent>
<relativePath>../parent</relativePath>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>parent</artifactId>
<version>20200615.2-SNAPSHOT</version>
<version>20200713.1</version>
</parent>

<name>empiricism</name>
Expand Down
4 changes: 2 additions & 2 deletions html-types/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,13 @@
<modelVersion>4.0.0</modelVersion>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>html-types</artifactId>
<version>20200615.2-SNAPSHOT</version>
<version>20200713.1</version>
<packaging>bundle</packaging>
<parent>
<relativePath>../parent</relativePath>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>parent</artifactId>
<version>20200615.2-SNAPSHOT</version>
<version>20200713.1</version>
</parent>

<name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
Expand Down
2 changes: 1 addition & 1 deletion parent/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
<modelVersion>4.0.0</modelVersion>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>parent</artifactId>
<version>20200615.2-SNAPSHOT</version>
<version>20200713.1</version>

<packaging>pom</packaging>

Expand Down
2 changes: 1 addition & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<relativePath>parent</relativePath>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>parent</artifactId>
<version>20200615.2-SNAPSHOT</version>
<version>20200713.1</version>
</parent>

<name>OWASP Java HTML Sanitizer</name>
Expand Down