You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "Michael Brohl (JIRA)" <ji...@apache.org> on 2018/01/30 11:35:00 UTC
[jira] [Commented] (OFBIZ-10187) OWASP sanitizer breaks proper
rendering of HTML code
[ https://issues.apache.org/jira/browse/OFBIZ-10187?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16344909#comment-16344909 ]
Michael Brohl commented on OFBIZ-10187:
---------------------------------------
[~jacques.le.roux],
can you explain the idea behind the current PERMISSIVE_POLICY?
I do not understand why rendering is restricted to only html elements "html", "body", "div", "center", "span", "table", "td" and why no attributes are allowed.
What about "ul", "li" etc., I don't expect these elements to be harmful.
> OWASP sanitizer breaks proper rendering of HTML code
> ----------------------------------------------------
>
> Key: OFBIZ-10187
> URL: https://issues.apache.org/jira/browse/OFBIZ-10187
> Project: OFBiz
> Issue Type: Bug
> Components: ALL COMPONENTS
> Affects Versions: 16.11.04
> Reporter: Michael Brohl
> Priority: Critical
>
> The current implementation of the PERMISSIVE_POLICY breaks the proper rendering of html code. In our case, class attributes are stripped from the html content.
> Example:
> {code:java}
> <div class="item">
> <img src="<@o...@ofbizContentUrl>" alt="" />
> <div class="container">
> <div class="slider-overlay">
> <h2>Lorem ipsum dolor sit amet</h2>
> <h3>At vero eos et accusam et justo</h3>
> <p>
> Lorem ipsum dolor sit amet, consetetur sadipscing elitr, dolores et ea rebum. Stet clita kasd gubergren, no sea
> takimata sanctus est Lorem ipsum dolor sit amet.
> </p>
> <a class="btn btn-grey" href="<@o...@ofbizUrl>">weitere Informationen</a>
> </div>
> </div>
> </div>{code}
> will be rendered to
> {code:java}
> <div>
> <img src="<@o...@ofbizContentUrl>" alt="" />
> <div>
> <div>
> <h2>Lorem ipsum dolor sit amet</h2>
> <h3>At vero eos et accusam et justo</h3>
> <p>
> Lorem ipsum dolor sit amet, consetetur sadipscing elitr, dolores et ea rebum. Stet clita kasd gubergren, no sea
> takimata sanctus est Lorem ipsum dolor sit amet.
> </p>
> <a href="<@o...@ofbizUrl>">weitere Informationen</a>
> </div>
> </div>
> </div>{code}
> I do not see any reason to not allow class attributes in html code. There might be other problems with these rules but this is a showstopper.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)