Fix allowAttributes().globally() (OWASP#247) (OWASP#248)

* Fix allowAttributes().globally() (OWASP#247) Add guard to .globally() method of HtmlPolicyBuilder to prevent ArrayOutOfBoundsException when checking to see if the zeroth element of the attributeNames list contains 'style'. This restores behaviour present in version 202180219.1 which allowed for an empty allowed attributes names list to be specified globally through the builder. * Allow styling when any attribute name matches "style" globally --------- Co-authored-by: Mike Samuel <mikesamuel@gmail.com>

Author: mymhealthltd-joshengland

src/main/java/org/owasp/html/HtmlPolicyBuilder.java

@@ -964,12 +964,11 @@ public AttributeBuilder matching(
  */
  @SuppressWarnings("synthetic-access")
  public HtmlPolicyBuilder globally() {
- if(attributeNames.get(0).equals("style")) {
- return allowStyling();
- } else {
- return HtmlPolicyBuilder.this.allowAttributesGlobally(
- policy, attributeNames);
+ if (attributeNames.contains("style")) {
+ allowStyling();
  }
+ return HtmlPolicyBuilder.this.allowAttributesGlobally(
+ policy, attributeNames);
  }
 
  /**

src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java

@@ -1007,6 +1007,12 @@ public static final void testTextareaIsNotTextArea() {
  assertEquals("x<textArea>y</textArea>", textAreaPolicy.sanitize(input));
  }
 
+ @Test
+ public static final void testHtmlPolicyBuilderDefinitionWithNoAttributesDefinedGlobally() {
+ // Does not crash with a runtime exception
+ new HtmlPolicyBuilder().allowElements().allowAttributes().globally().toFactory();
+ }
+
  @Test
  public static final void testCSSFontSize() {
  HtmlPolicyBuilder builder = new HtmlPolicyBuilder();