java-html-sanitizer

java-html-sanitizer copied to clipboard

Vulnerable dependency guava:30.1.jre

3

There is a dependency to com.google.guava:guava:30.1-jre which is known as vulnerable [CVE-2023-2976](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2976)

aschufft

Discrepancies of results when sanitizing allowed tags

2

While trying to use `.allowElements()`, I noticed some surprising results: different tags yield different kind of output. For example: 1. A policy with `HtmlPolicyBuilder().allowElements("a").toFactory().sanitize("")` returns nothing; 2. A policy with...

Pamplemousse

Remove URL length constraint

3

Fix #187 The length of the input should not really be validated in sanitizer, rather the whole HTTP request body should be constrained. This PR removes the troublesome constraint.

ioleo

Do not ignore attributes allowed globally together with 'style' (#237)

2

Also, allowStyling() internally allows the 'style' attribute, so it is not necessary to ignore it.

corebonts

Issue when using < as a the comparaison string

2

Hi, Is there a way to sanitize something like `If b is 0 and a is 1 then b

adelebendayan

Sanitizing `<image src=...>` results in misnested tag output.

7

wynne.jg reports Consider the following whitelist • tag and it's attribute src is allowed • tags are getting converted to tags if I then try to sanitize ```html ``` I...

mikesamuel

CSS grids not supported

4

Even with `allowStyling()`, this: ```html ``` becomes ```html ``` It seems that "display: grid" and all the other CSS grid properties are not part of the list of valid properties....

CGjupoulton

word-break in style is discarded because it is not considered a valid value in CSSSchema

3

input: ```html ``` policy: `Sanitizers.BLOCKS .and(Sanitizers.FORMATTING) .and(Sanitizers.LINKS) .and(Sanitizers.TABLES) .and(Sanitizers.IMAGES) .and(Sanitizers.STYLES) .and(.and(new HtmlPolicyBuilder() .allowElements("style") .allowAttributes("style").onElements("td", "table","div") .allowAttributes("type", "word-break").onElements("style") .toFactory());` Expected output (should contain word-break). ```html ```

mrabhishek

Overflow is sanitized

8

Hello, the codingame game engine which allow people to create games for its platform use your sanitizer on the game documentation. When I tried to implement some overflow on tables,...

Butanium

Examples should not be part of the final jar

2

Currently `EbayPolicyExample`, `SlashdotPolicyExample` and `UrlTextExample` are part of the final package, so currently `owasp-java-html-sanitizer-20190610.1.jar`. Theses examples are great to understand the capabilities of the project. But they should not be...

amanteaux