Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New methods for excluding elements with specific missing or empty attributes #45

Open
wants to merge 30 commits into
base: master
Choose a base branch
from
Open
Changes from 3 commits
Commits
Show all changes
30 commits
Select commit Hold shift + click to select a range
73b68bc
+Added HtmlPolicyBuilder methods for excluding elements with specific…
Oct 9, 2015
e75d980
Reverted changes
Oct 9, 2015
ea02e71
added methods for excluding elements with specific empty or missing a…
Oct 9, 2015
2537933
Added TestCase for disallowWithoutAttribute()
Nov 9, 2015
e6dd2ea
s/master/main/ for default branch
mikesamuel Jun 15, 2020
f3f56d4
Release candidate 20200615.1
mikesamuel Jun 15, 2020
fd6b2dd
Bumped dev version
mikesamuel Jun 15, 2020
eb6ef02
Do not lcase element or attribute names that match SVG or MathML name…
mikesamuel Jul 13, 2020
25c3d64
Release candidate 20200713.1
mikesamuel Jul 13, 2020
ffe5cfa
Bumped dev version
mikesamuel Jul 13, 2020
c7db2d4
we use spotbugs now instead of findbugs
mikesamuel Jul 13, 2020
ca40697
s/master/main/ in doc URLs
mikesamuel Jul 13, 2020
af0ca83
Bump junit from 4.12 to 4.13.1 in /parent (#215)
dependabot[bot] Dec 7, 2020
acaf3f2
hsl and hsla (#216)
aakritisi Dec 9, 2020
33d319f
Fix code formatting lint checks (#217)
mikesamuel Dec 14, 2020
020d5d0
Fixed allowAtributes("style").globally() (#218)
aakritisi Dec 21, 2020
ad287c3
Upgrade to a modern guava dependency
mikesamuel May 13, 2021
be33ec6
Render style tag content more strictly.
mikesamuel Oct 18, 2021
374ea2f
Release candidate 20211018.1
mikesamuel Oct 18, 2021
7d76ba9
Bumped dev version
mikesamuel Oct 18, 2021
e2b29e8
Update vulnerabilities.md
mikesamuel Oct 18, 2021
14f84fd
Recognize that `<style>` is not really workable inside `<select>`
mikesamuel Oct 18, 2021
62a0715
Release candidate 20211018.2
mikesamuel Oct 18, 2021
06b299c
Bumped dev version
mikesamuel Oct 18, 2021
5372c74
Decode attribute content differently from text node content (#255)
mikesamuel Jun 8, 2022
c2c74fc
Fix missing null checks in uses of consumeIdentOrUrlOrFunctions (#266)
mikesamuel Jun 8, 2022
e35ef4f
Release candidate 20220608.1
mikesamuel Jun 8, 2022
3756979
Bumped dev version
mikesamuel Jun 8, 2022
0372f4f
Merge branch 'OWASP:master' into master
forum-is Nov 29, 2022
ccb4c18
Merge remote-tracking branch 'upstream/main'
forum-is Jan 5, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 48 additions & 1 deletion src/main/java/org/owasp/html/HtmlPolicyBuilder.java
Original file line number Diff line number Diff line change
Expand Up @@ -288,7 +288,28 @@ public HtmlPolicyBuilder allowWithoutAttributes(String... elementNames) {
}
return this;
}


/**
* Disallows the given element from appearing without the given attribute.
*/
public HtmlPolicyBuilder disallowWithoutAttribute(String elementName, final String attributeName) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right now, we can say

    myPolicyBuilder.allowAttributes("src", ...).onElements("img")

and if I understand your goal, that is problematic because it allows but does not require src="..." on <img ...>.

I'd prefer

    myPolicyBuilder.withAttributes("src", ...).required().onElements("img")

which allows mixing required() into the existing flow by which elements are associated with attributes instead of creating a new API.

invalidateCompiledState();
elementName = HtmlLexer.canonicalName(elementName);
ElementPolicy policy = new ElementPolicy() {
public @Nullable String apply(String elementName, List<String> attrs) {
for(int i=0; i<attrs.size(); i+=2) {
if(attrs.get(i).equals(attributeName)){
return elementName;
}
}
return null;
}
};
ElementPolicy newPolicy = ElementPolicy.Util.join(elPolicies.get(elementName), policy);
elPolicies.put(elementName, newPolicy);
return this;
}

/**
* Disallows the given elements from appearing without attributes.
*
Expand Down Expand Up @@ -714,6 +735,32 @@ public AttributeBuilder matching(
});
}

/**
* Restrict the values allowed by later {@code allow*} calls to those
* NOT matching the pattern. This is a convenience method, as inverting
* certain patterns can otherwise be quite complex.
*/
public AttributeBuilder notMatching(final Pattern pattern) {
return matching(new AttributePolicy() {
public @Nullable String apply(String elementName, String attributeName, String value) {
return !pattern.matcher(value).matches() ? value : null;
}
});
}

/**
* Restrict the values allowed by later {@code allow*} calls to those
* that are not only whitespace or an empty string. Can be combined
* with calls to {@code matching} or {@code notMatching}.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use {@link #matching} instead of {@code matching}. The latter allows the reader to click through and generates doc warnings should APIs change.

Please fix indentation.

Maybe add a caveat along the lines of

Sometimes empty attributes are different from absent attributes. For example <input checked=""> is not equivalent to <input> and <a href=""> is a link to the current document without a fragment while <a> is not.

*/
public AttributeBuilder notEmptyOrWhitespace() {
return matching(new AttributePolicy() {
public @Nullable String apply(String elementName, String attributeName, String value) {
return value.trim().length() > 0 ? value : null;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe that the definition of whitespace in HTML is not the same as the whitespace matched by String.trim().

http://www.w3.org/html/wg/drafts/html/master/single-page.html#space-character says

The space characters, for the purposes of this specification, are U+0020 SPACE, U+0009 CHARACTER TABULATION (tab), U+000A LINE FEED (LF), U+000C FORM FEED (FF), and U+000D CARRIAGE RETURN (CR).

while javadoc says

character in the string whose code is greater than '\u0020'

}
});
}

/**
* Allows the given attributes on any elements but filters the
* attributes' values based on previous calls to {@code matching(...)}.
Expand Down