Skip to content

Commit 2f3d7f6

Browse files
rytisjuknarytisjukna
committed
added feature for ignoring certain html char replacements
1 parent c638258 commit 2f3d7f6

File tree

12 files changed

+627
-572
lines changed

12 files changed

+627
-572
lines changed

‎aggregate/pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
22
<modelVersion>4.0.0</modelVersion>
3-
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
3+
<groupId>lt.hrm.owasp-java-html-sanitizer</groupId>
44
<artifactId>aggregate</artifactId>
55
<packaging>pom</packaging>
66
<version>20180219.2-SNAPSHOT</version>
77
<parent>
88
<relativePath>../parent</relativePath>
9-
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
9+
<groupId>lt.hrm.owasp-java-html-sanitizer</groupId>
1010
<artifactId>parent</artifactId>
11-
<version>20180219.2-SNAPSHOT</version>
11+
<version>20180407.2-SNAPSHOT</version>
1212
</parent>
1313

1414
<modules>

‎empiricism/pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
22
<modelVersion>4.0.0</modelVersion>
3-
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
3+
<groupId>lt.hrm.owasp-java-html-sanitizer</groupId>
44
<artifactId>html-types</artifactId>
55
<version>20180219.2-SNAPSHOT</version>
66
<packaging>jar</packaging>
77
<parent>
88
<relativePath>../parent</relativePath>
9-
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
9+
<groupId>lt.hrm.owasp-java-html-sanitizer</groupId>
1010
<artifactId>parent</artifactId>
11-
<version>20180219.2-SNAPSHOT</version>
11+
<version>20180407.2-SNAPSHOT</version>
1212
</parent>
1313

1414
<name>empiricism</name>

‎html-types/pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
22
<modelVersion>4.0.0</modelVersion>
3-
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
3+
<groupId>lt.hrm.owasp-java-html-sanitizer</groupId>
44
<artifactId>html-types</artifactId>
55
<version>20180219.2-SNAPSHOT</version>
66
<packaging>jar</packaging>
77
<parent>
88
<relativePath>../parent</relativePath>
9-
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
9+
<groupId>lt.hrm.owasp-java-html-sanitizer</groupId>
1010
<artifactId>parent</artifactId>
11-
<version>20180219.2-SNAPSHOT</version>
11+
<version>20180407.2-SNAPSHOT</version>
1212
</parent>
1313

1414
<name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>

‎parent/pom.xml‎

Lines changed: 7 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
22
<modelVersion>4.0.0</modelVersion>
3-
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
3+
<groupId>lt.hrm.owasp-java-html-sanitizer</groupId>
44
<artifactId>parent</artifactId>
5-
<version>20180219.2-SNAPSHOT</version>
5+
<version>20180407.2-SNAPSHOT</version>
66

77
<packaging>pom</packaging>
88

@@ -12,7 +12,7 @@ A fast and easy to configure HTML Sanitizer written in Java which
1212
lets you include HTML authored by third-parties in your web
1313
application while protecting against XSS.
1414
</description>
15-
<url>https://github.com/OWASP/java-html-sanitizer</url>
15+
<url>https://github.com/danasjukna/java-html-sanitizer</url>
1616
<licenses>
1717
<license>
1818
<name>Apache License, Version 2.0</name>
@@ -22,71 +22,11 @@ application while protecting against XSS.
2222
</licenses>
2323

2424
<scm>
25-
<connection>scm:git:git://github.com/OWASP/java-html-sanitizer.git</connection>
26-
<developerConnection>scm:git:git://github.com/OWASP/java-html-sanitizer.git</developerConnection>
27-
<url>https://github.com/OWASP/java-html-sanitizer</url>
25+
<connection>scm:git:git://github.com/danasjukna/java-html-sanitizer.git</connection>
26+
<developerConnection>scm:git:git://github.com/danasjukna/java-html-sanitizer.git</developerConnection>
27+
<url>https://github.com/danasjukna/java-html-sanitizer</url>
2828
</scm>
2929

30-
<distributionManagement>
31-
<snapshotRepository>
32-
<id>ossrh</id>
33-
<url>https://oss.sonatype.org/content/repositories/snapshots</url>
34-
</snapshotRepository>
35-
<repository>
36-
<id>ossrh</id>
37-
<url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
38-
</repository>
39-
</distributionManagement>
40-
41-
<issueManagement>
42-
<system>GitHub</system>
43-
<url>https://github.com/OWASP/java-html-sanitizer/issues</url>
44-
</issueManagement>
45-
46-
<organization>
47-
<name>OWASP</name>
48-
<url>https://owasp.org</url>
49-
</organization>
50-
51-
<developers>
52-
<developer>
53-
<id>mikesamuel</id>
54-
<name>Mike Samuel</name>
55-
<email>mikesamuel@gmail.com</email>
56-
</developer>
57-
</developers>
58-
59-
<mailingLists>
60-
<mailingList>
61-
<name>User Support List</name>
62-
<subscribe>owasp-java-html-sanitizer-support+subscribe@googlegroups.com</subscribe>
63-
<unsubscribe>owasp-java-html-sanitizer-support+unsubscribe@googlegroups.com</unsubscribe>
64-
<archive>https://groups.google.com/forum/#!forum/owasp-java-html-sanitizer-support</archive>
65-
</mailingList>
66-
</mailingLists>
67-
68-
<reporting>
69-
<plugins>
70-
<!-- `mvn compile site` will generate target/site/findbugs.html -->
71-
<!-- http://gleclaire.github.io/findbugs-maven-plugin/dependency-info.html -->
72-
<plugin>
73-
<groupId>org.codehaus.mojo</groupId>
74-
<artifactId>findbugs-maven-plugin</artifactId>
75-
<version>3.0.2</version>
76-
<configuration>
77-
<!--
78-
Enables analysis which takes more memory but finds more bugs.
79-
If you run out of memory, changes the value of the effort element
80-
to 'Low'.
81-
-->
82-
<effort>Max</effort>
83-
<!-- Reports all bugs (other values are medium and max) -->
84-
<threshold>Low</threshold>
85-
</configuration>
86-
</plugin>
87-
</plugins>
88-
</reporting>
89-
9030
<properties>
9131
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
9232
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
@@ -95,45 +35,7 @@ application while protecting against XSS.
9535
<build>
9636
<pluginManagement>
9737
<plugins>
98-
<plugin>
99-
<groupId>external.atlassian.jgitflow</groupId>
100-
<artifactId>jgitflow-maven-plugin</artifactId>
101-
<version>1.0-m5.1</version>
102-
<configuration>
103-
<pushReleases>true</pushReleases>
104-
<enableSshAgent>true</enableSshAgent>
105-
<autoVersionSubmodules>true</autoVersionSubmodules>
106-
<updateDependencies>true</updateDependencies>
107-
</configuration>
108-
</plugin>
109-
<plugin>
110-
<groupId>org.sonatype.plugins</groupId>
111-
<artifactId>nexus-staging-maven-plugin</artifactId>
112-
<version>1.6.3</version>
113-
<extensions>true</extensions>
114-
<configuration>
115-
<serverId>ossrh</serverId>
116-
<nexusUrl>https://oss.sonatype.org/</nexusUrl>
117-
<autoReleaseAfterClose>true</autoReleaseAfterClose>
118-
<!-- This staging profile ID gleaned by logging in to
119-
oss.sonatype.org, clicking "Staging Profiles" on the left,
120-
selecting "com.googlecode.owasp-java-html-sanitizer",
121-
and extracting the most hexy looking bit from the URL which
122-
looks like
123-
https://oss.sonatype.org/#stagingProfiles;5fd62edf6679f6
124-
-->
125-
<stagingProfileId>199eb0ec1ec380</stagingProfileId>
126-
<executions>
127-
<execution>
128-
<id>default-deploy</id>
129-
<phase>deploy</phase>
130-
<goals>
131-
<goal>deploy</goal>
132-
</goals>
133-
</execution>
134-
</executions>
135-
</configuration>
136-
</plugin>
38+
13739
<!-- For building the source jar. -->
13840
<plugin>
13941
<groupId>org.apache.maven.plugins</groupId>

‎pom.xml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
22
<modelVersion>4.0.0</modelVersion>
3+
<groupId>lt.hrm.owasp-java-html-sanitizer</groupId>
34
<artifactId>owasp-java-html-sanitizer</artifactId>
45
<packaging>jar</packaging>
56
<parent>
67
<relativePath>parent</relativePath>
7-
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
8+
<groupId>lt.hrm.owasp-java-html-sanitizer</groupId>
89
<artifactId>parent</artifactId>
9-
<version>20180219.2-SNAPSHOT</version>
10+
<version>20180407.2-SNAPSHOT</version>
1011
</parent>
1112

1213
<name>OWASP Java HTML Sanitizer</name>

‎src/main/java/org/owasp/html/CharReplacements.java‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
package org.owasp.html;
2+
3+
public class CharReplacements {
4+
5+
public static final CharReplacements DEFAULT = new CharReplacements();
6+
7+
public static final String PLAINTEXT_BRACE_REPLACEMENT = "{<!-- -->";
8+
public static final String TAG_BRACE_REPLACEMENT = "{\u200B";
9+
10+
private String plaintextBraceReplacement = PLAINTEXT_BRACE_REPLACEMENT;
11+
private String tagBraceReplacement = TAG_BRACE_REPLACEMENT;
12+
13+
/**
14+
* Maps ASCII chars that need to be encoded to an equivalent HTML entity.
15+
*/
16+
String[] replacementTable;
17+
18+
public CharReplacements(){
19+
this.replacementTable = initDefaultReplacementsTable();
20+
}
21+
22+
public CharReplacements(CharReplacements oth){
23+
this.replacementTable = new String[oth.replacementTable.length];
24+
System.arraycopy(oth.replacementTable, 0, this.replacementTable, 0, oth.replacementTable.length);
25+
}
26+
27+
public CharReplacements clone(){
28+
return new CharReplacements(this);
29+
}
30+
31+
public CharReplacements setPlaintextBraceReplacement(String braceReplacement) {
32+
this.plaintextBraceReplacement = braceReplacement;
33+
return this;
34+
}
35+
36+
public CharReplacements setTagBraceReplacement(String braceReplacement) {
37+
this.tagBraceReplacement = braceReplacement;
38+
return this;
39+
}
40+
41+
public CharReplacements dontReplace(char ... chars){
42+
for (char ch: chars)
43+
if (ch < replacementTable.length)
44+
replacementTable[ch] = null;
45+
46+
return this;
47+
}
48+
49+
public boolean hasReplacementForChar(char ch) {
50+
return ch < replacementTable.length;
51+
}
52+
53+
public String getReplacementForChar(char ch, String text, int pos, int textLen, boolean isInPlaintextMode) {
54+
String repl = replacementTable[ch];
55+
56+
if (repl != null)
57+
return repl;
58+
59+
if (isDoubleBrace(ch, text, pos, textLen))
60+
repl = isInPlaintextMode ? plaintextBraceReplacement : tagBraceReplacement;
61+
62+
return repl;
63+
}
64+
65+
private boolean isDoubleBrace(char ch, String text, int pos, int textLen) {
66+
return ch == '{' &&
67+
(pos + 1 == textLen || text.charAt(pos + 1) == '{');
68+
}
69+
70+
private String[] initDefaultReplacementsTable() {
71+
String[] replTbl = new String[0x80];
72+
73+
for (int i = 0; i < ' '; ++i) {
74+
// We elide control characters so that we can ensure that our output
75+
// is
76+
// in the intersection of valid HTML5 and XML. According to
77+
// http://www.w3.org/TR/2008/REC-xml-20081126/#charsets
78+
// Char ::= #x9 | #xA | #xD | [#x20-#xD7FF]
79+
// | [#xE000-#xFFFD] | [#x10000-#x10FFFF]
80+
if (i != '\t' && i != '\n' && i != '\r') {
81+
replTbl[i] = ""; // Elide
82+
}
83+
}
84+
// "&#34;" is shorter than "&quot;"
85+
replTbl['"'] = "&#" + ((int) '"') + ";"; // Attribute delimiter.
86+
replTbl['&'] = "&amp;"; // HTML special.
87+
// We don't use &apos; since that is not in the intersection of
88+
// HTML&XML.
89+
replTbl['\''] = "&#" + ((int) '\'') + ";"; // Attribute delimiter.
90+
replTbl['+'] = "&#" + ((int) '+') + ";"; // UTF-7 special.
91+
replTbl['<'] = "&lt;"; // HTML special.
92+
replTbl['='] = "&#" + ((int) '=') + ";"; // Special in attributes.
93+
replTbl['>'] = "&gt;"; // HTML special.
94+
replTbl['@'] = "&#" + ((int) '@') + ";"; // Conditional
95+
// compilation.
96+
replTbl['`'] = "&#" + ((int) '`') + ";"; // Attribute delimiter.
97+
98+
return replTbl;
99+
}
100+
}

0 commit comments

Comments
 (0)