java-html-sanitizer

java-html-sanitizer copied to clipboard

Attributes allowed globally together with "style" are lost

2

Since the commit 020d5d0d7b8e985be32d3608612a9889135ef060 all attributes that are allowed globally are ignored, if "style" is given as the first attribute. Problematic code: ``` public HtmlPolicyBuilder globally() { if(attributeNames.get(0).equals("style")) { return...

corebonts

Comments don't get removed if inside curly brackets

1

I noticed that comments are not removed if they are placed inside curly brackets. ## Example ``` PolicyFactory policy = new HtmlPolicyBuilder().allowElements("p").toFactory(); String unsanitized = "{}"; String sanitized = policy.sanitize(unsanitized);...

matthiasunt

Use HTML5 comment syntax instead of HTML4

7

Hello I would like to submit you a problem in function **HtmlInputSplitter.parseToken() .** When you sanitize HTML text like : " MY CODE" the parser detect end comment just before...

alelievre44

font-family sanitization issue

1

Hi, looks like there's issue with CSS font-family sanitization, when the input is first sanitized it adds quotes to font-families. When the sanitized content is sanitized again it removes some...

jurajvalkucak

HTML Comment Sanitization Issue

1

Hi, We are using this library in [Zimbra](https://github.com/Zimbra/java-html-sanitizer-release-20190610.1) for sanitization of the e-mail body and during sanitization of the customer-generated HTML, we came across the following situation when we have...

log2akshat

The sanitizer is removing HTML when the tag depth is more than 256 sanitizer removes the tags which actually has the content

5

`I` have a HTML which is surrounded by a big list of empty `` tags, sanitizer is removing a portion of a HTML. When removed the empty list of ``...

rasmitam

Add a prepackaged policy for client-side templates.

6

It would make some sense to be able to easily control (disable completely) the sanitization of client-side templates. Maybe this can be a prepackaged policy. Even if there is a...

joankaradimov

Commented vulnerability is sanitized without being notified in HtmlChangeListener

2

The following string: `-->` is being cleaned up by the sanitizer, the comment is just being removed, but this does not go through the htmlChangeListener object. Eventually, a malicious code...

GalitTugi

PolicyFactory / fast copy constructor or method

2

Would it be possible to add a fast copy-method or copy-constructor to the PolicyFactory class. The method `public PolicyFactory and(PolicyFactory f)` seems to be relatively slow and we have to...

JohannesLichtenberger

Proposed fix for issue #223: forbidden character references in sanitized html

4

simon-greatrix