[sling-org-apache-sling-xss] 01/01: SLING-7231 - Move to owasp sanitizer library

[ro...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to branch issue/SLING-7231
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git

commit 89398e8a6877a0e46ffef3239c696cb23eb3f8f8
Author: Robert Munteanu <ro...@apache.org>
AuthorDate: Wed May 18 17:43:32 2022 +0200

    SLING-7231 - Move to owasp sanitizer library
    
    Add some extra CSS filtering tests. Since the Java HTML sanitizer does
    not explicitly support filtering CSS declarations wrapped in style tags,
    we need to make sure that we keep the same behaviour, which we will
    validate with these tests.
---
 .../org/apache/sling/xss/impl/XSSAPIImplTest.java  | 24 +++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
index 36d6afa..f93e41c 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
@@ -361,7 +361,29 @@ public class XSSAPIImplTest {
                 // CVE-2017-14735
                 {"<a href=\"javascript&colon;alert(23)\">X</a>", "<a>X</a>"},
                 // CVE-2016-10006
-                {"<style onload=\"alert(23)\">h1 {color:red;}</style>", "<style>h1 {\n\tcolor: red;\n}\n</style>"}
+                {"<style onload=\"alert(23)\">h1 {color:red;}</style>", "<style>h1 {\n\tcolor: red;\n}\n</style>"},
+                // strip out css imports
+                { "<style>@import 'foo.css';\nh1 {color:red;}</style>", "<style>h1 {\n\tcolor: red;\n}\n</style>"},
+                // filter invalid tag names
+                { "<style>ț1 {color:red;}\nh1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"},
+                // keep valid tag names
+                { "<style>h1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"},
+                // filter invalid class names
+                { "<style>.ș1 {color:red;}\nh1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"},
+                // keep valid class names
+                { "<style>*.title {color:green;}</style>", "<style>*.title {\n\tcolor: green;\n}\n</style>"},
+                // filter invalid ids
+                { "<style>#ă1 {color:red;}\nh1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"},
+                // keep valid ids
+                { "<style>#tag-1 {color:green;}</style>", "<style>*#tag-1 {\n\tcolor: green;\n}\n</style>"},
+                // filter invalid pseudo-selectors
+                { "<style>bar:î1 {color:red;}\nh1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"},
+                // keep valid pseudo-selectors
+                { "<style>bar:first-child {color:green;}</style>", "<style>bar:first-child {\n\tcolor: green;\n}\n</style>"},
+                // filter invalid attributes
+                { "<style>h1[data-foo=zât] {color:red;}\nh1 {color:green;}</style>", "<style>h1 {\n\tcolor: green;\n}\n</style>"}
+                // keep valid attributes, unfortunately does not work
+                // { "<style>h1[data-foo=bar] {color:green;}\n</style>", "<style>h1[data-foo=bar] {\n\tcolor: green;\n}\n</style>"}
         };
     }