Comments (3)
GoogleCodeExporter
commented on July 17, 2024
With what policy are you running?
Original comment by [email protected] on 27 Feb 2014 at 7:43
from java-html-sanitizer.
GoogleCodeExporter
commented on July 17, 2024
If your policy accepts URL's then this is not a bug. The act of clicking <a
href="http://demo.testfire.net">CLICK HERE</a> will not cause an XSS it seems,
only visiting the vulnerable page (demo.testfire.net) will cause the XSS. So
the XSS is not in the link itself like a javascript URL such as <a
href="javascript:alert(1);">CLICK HERE</a>. If a JavaScript URL got through the
sanitizer I would consider it a bug, but that does not seem to be the case here.
Original comment by [email protected] on 31 Mar 2014 at 2:24
from java-html-sanitizer.
GoogleCodeExporter
commented on July 17, 2024
Re "It should filter out html tags", some policies should filter out <a> tags
and some policies should not. Without knowing what policy the reporter used,
we cannot take action.
Closing as invalid. Please reopen if you can supply more detail.
Original comment by [email protected] on 31 Mar 2014 at 5:03
- Changed state: Invalid
from java-html-sanitizer.
Related Issues (20)
- xxx-large font-size is discarded when allowStyling() is used HOT 6
- Issue while disallowing attributes matching pattern
- Remove malicious code from svg content HOT 1
- Encoding malicious code instead of removing it HOT 4
- Index out of bound when empty list is passed to `allowAttributes(...).globally()`
- Guava removal breaks compatibility (with JDK9) HOT 13
- Html sanitizer repeatedly adds rel="noopener noreferrer" even if it's pre-exist HOT 1
- SECURITY.MD currently does not contain sensible information
- Sanitizing CSS HOT 3
- ClassNotFoundException: org.owasp.shim.Java8Shim after update to 20240325.1 HOT 5
- Release 20240325 cannot be transpiled HOT 1
- Issue in 2024x version with styles
- Question: What means Recognize foreign content syntactic context: mathml / svg?
- Issues encountered while processing <a> tags
- rel attributes are reordered in 20220608.1
- Possible to enforce having mutliple attributes on tag?
- On Java8Shim class, better to catch Throwable instead of Error
- text-align literals are outdated
- Please build the Java8/10 shim classes into the sanitizer JAR
- Issue with HTML Sanitization: Improper Handling of <div> Tag Inside <table>
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from java-html-sanitizer.