Skip to content

Provide option to explicitly sanitize global style #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
subbudvk wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

Provide option to explicitly sanitize global style #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
958aecc
Fix : Support option to explicitly sanitize Global style attribute
subbudvk Apr 10, 2024
70f0367
Test : Add tests for global style sanitization
subbudvk Apr 10, 2024
79fd786
Test : Add tests for Global style sanitization
subbudvk Apr 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -874,10 +874,21 @@ private HtmlTagSkipType getHtmlTagSkipType(String elementName) {
public final class AttributeBuilder {
private final List<String> attributeNames;
private AttributePolicy policy = AttributePolicy.IDENTITY_ATTRIBUTE_POLICY;
private boolean shouldSanitizeGlobalStyles = false;

AttributeBuilder(List<? extends String> attributeNames) {
this.attributeNames = j8().listCopyOf(attributeNames);
}

/**
* Determines whether allowAttributes("style").globally() should imply allowStyling()
* which sanitizes style attribute values
*/
public AttributeBuilder sanitizeGlobalStyles() {
this.shouldSanitizeGlobalStyles = true;
return this;
}


/**
* Filters and/or transforms the attribute values
Expand Down Expand Up @@ -967,7 +978,7 @@ public AttributeBuilder matching(
*/
@SuppressWarnings("synthetic-access")
public HtmlPolicyBuilder globally() {
if (attributeNames.contains("style")) {
if (attributeNames.contains("style") && shouldSanitizeGlobalStyles) {
allowStyling();
}
return HtmlPolicyBuilder.this.allowAttributesGlobally(
Expand Down
16 changes: 16 additions & 0 deletions owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssSchemaTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,4 +97,20 @@ public static final void testCustom() {
assertTrue("left in float", cssFloat.literals.contains("left"));
}

@Test
public static final void testStyleCasingWithoutAllowStyling() {
String input = "<p><span style=\"font-family:Times New Roman,Times,serif;\">fourth line</span></p>";
PolicyFactory factory = new HtmlPolicyBuilder().allowElements("p","span").allowAttributes("test","style").globally().toFactory();
assertEquals(input, factory.sanitize(input));
}

@Test
public static final void testStyleCasingWithAllowStyling() {
String input = "<p><span style=\"font-family:Times New Roman,Times,serif;\">fourth line</span></p>";
PolicyFactory factory = new HtmlPolicyBuilder().allowElements("p","span").allowAttributes("test","style").sanitizeGlobalStyles().globally().toFactory();
assertEquals("<p><span style=\"font-family:&#39;times new roman&#39; , &#39;times&#39; , serif\">fourth line</span></p>"
, factory.sanitize(input));
}


}
13 changes: 13 additions & 0 deletions owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -663,6 +663,19 @@ public String toString() {
input));
}

@Test
public static final void testGlobalStyleWithoutSanitization() {
PolicyFactory factory = new HtmlPolicyBuilder().allowElements("span").allowAttributes("test","style").globally().toFactory();
String input = "<span style=\"text-decoration-line: line-through;\">Strikethrough</span>";
assertEquals(factory.sanitize(input), input);
}

@Test
public static final void testGlobalStyleWithSanitization() {
PolicyFactory factory = new HtmlPolicyBuilder().allowElements("span").allowAttributes("test","style").sanitizeGlobalStyles().globally().toFactory();
String input = "<span style=\"text-decoration-line: line-through;\">Strikethrough</span>";
assertEquals("Strikethrough", factory.sanitize(input));
}

@Test
public final void testPostprocessors() {
Expand Down