You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2022/05/18 15:45:10 UTC
[sling-org-apache-sling-xss] branch issue/SLING-7231 created (now 89398e8)
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a change to branch issue/SLING-7231
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
at 89398e8 SLING-7231 - Move to owasp sanitizer library
This branch includes the following new commits:
new 89398e8 SLING-7231 - Move to owasp sanitizer library
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
[sling-org-apache-sling-xss] 01/01: SLING-7231 - Move to owasp sanitizer library
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch issue/SLING-7231
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
commit 89398e8a6877a0e46ffef3239c696cb23eb3f8f8
Author: Robert Munteanu <ro...@apache.org>
AuthorDate: Wed May 18 17:43:32 2022 +0200
SLING-7231 - Move to owasp sanitizer library
Add some extra CSS filtering tests. Since the Java HTML sanitizer does
not explicitly support filtering CSS declarations wrapped in style tags,
we need to make sure that we keep the same behaviour, which we will
validate with these tests.
---
.../org/apache/sling/xss/impl/XSSAPIImplTest.java | 24 +++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
index 36d6afa..f93e41c 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
@@ -361,7 +361,29 @@ public class XSSAPIImplTest {
// CVE-2017-14735
{"<a href=\"javascript:alert(23)\">X</a>", "<a>X</a>"},
// CVE-2016-10006
- {"<style onload=\"alert(23)\">h1 {color:red;}</style>", "<style>h1 {\n\tcolor: red;\n}\n</style>"}
+ {"<style onload=\"alert(23)\">h1 {color:red;}</style>", "<style>h1 {\n\tcolor: red;\n}\n</style>"},
+ // strip out css imports
+ { "<style>@import 'foo.css';\nh1 {color:red;}</style>", "<style>h1 {\n\tcolor: red;\n}\n</style>"},
+ // filter invalid tag names
+ { "<style>ț1 {color:red;}\nh1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"},
+ // keep valid tag names
+ { "<style>h1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"},
+ // filter invalid class names
+ { "<style>.ș1 {color:red;}\nh1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"},
+ // keep valid class names
+ { "<style>*.title {color:green;}</style>", "<style>*.title {\n\tcolor: green;\n}\n</style>"},
+ // filter invalid ids
+ { "<style>#ă1 {color:red;}\nh1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"},
+ // keep valid ids
+ { "<style>#tag-1 {color:green;}</style>", "<style>*#tag-1 {\n\tcolor: green;\n}\n</style>"},
+ // filter invalid pseudo-selectors
+ { "<style>bar:î1 {color:red;}\nh1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"},
+ // keep valid pseudo-selectors
+ { "<style>bar:first-child {color:green;}</style>", "<style>bar:first-child {\n\tcolor: green;\n}\n</style>"},
+ // filter invalid attributes
+ { "<style>h1[data-foo=zât] {color:red;}\nh1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"}
+ // keep valid attributes, unfortunately does not work
+ // { "<style>h1[data-foo=bar] {color:green;}\n</style>", "<style>h1[data-foo=bar] {\n\tcolor: green;\n}\n</style>"}
};
}