Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

when i call the api 'ESAPI.validator().getValidSafeHTML' with mixed encoding input, the mixed input willed be filtered. #645

Open
wangyun2018 opened this issue Dec 3, 2021 · 9 comments
Open

when i call the api 'ESAPI.validator().getValidSafeHTML' with mixed encoding input, the mixed input willed be filtered. #645

wangyun2018 opened this issue Dec 3, 2021 · 9 comments

Comments

@wangyun2018
Copy link

wangyun2018 commented Dec 3, 2021 •
edited
Loading

1.when i call the api "ESAPI.validator().getValidSafeHTML" with input is

"<html>
<table>
    <tbody>
    <tr>
        <td><p>\n This administrative email\n is being sent to you from Rockstar Games, 622 Broadway, NY, NY 10012. If
            you\n want the early word on all Rockstar game announcements, official launches,\n contests, special events,
            and more <a href=\"https://socialclub.rockstargames.com/settings/email?utm_source=Social%20Club&amp;utm_medium=Email&amp;utm_campaign=Administrative%20Emails&amp;utm_content=en\">subscribe\n
                to the Rockstar Games Mailing List</a>.<p>
        </td>
    </tr>
    </tbody>
</table>
</html>"

the result is
"<table> <tbody> <tr> <td><p> This administrative email is being sent to you from Rockstar Games, 622 Broadway, NY, NY 10012. If you want the early word on all Rockstar game announcements, official launches, contests, special events, and more subscribe to the Rockstar Games Mailing List.</p><p> </p></td> </tr> </tbody> </table>"

and the 'a' tag is missing.
2. i have set the 'a' tag in whiteList in antisamy.xml and set Encoder.AllowMixedEncoding=true
3. i want to know how to make the result contains 'a' tag
@xeno6696
Copy link
Collaborator

xeno6696 commented Dec 3, 2021 via email

@wangyun2018
Copy link
Author

the input file is below

input.txt
and the result is below after calling ESAPI.validator().getValidSafeHTML

result.txt

and the 'a' tag is missing

@xeno6696
Copy link
Collaborator

xeno6696 commented Dec 8, 2021

oh wow... for some reason when this came in I completely missed this was github and thought it was hitting the main mailing list. My apologies. I'll try and reproduce.

@kwwall
Copy link
Contributor

kwwall commented Dec 8, 2021 via email

@simon0117
Copy link
Contributor

@wangyun2018 did this get resolved? Can you provide the AntiSamy XML you are using? It does seem like an AntiSamy issue, not an ESAPI one. What is the reason to enable the strongly discouraged mixed encoding?

@xeno6696
Copy link
Collaborator

@wangyun2018 I'm in a mode where I can debug this, but I need the relevant antisamy configs to minimize the time it takes to match your config. I would understand that you wouldn't want to publish the entire whitelist, but at minimum I need those href tag configs.

By default ESAPI is configured like this:

		<tag name="a" action="validate">

			<attribute name="href" onInvalid="filterTag"/>
			<attribute name="nohref">
				<literal-list>
					<literal value="nohref"/>
					<literal value=""/>
				</literal-list>
			</attribute>
			<attribute name="rel">
				<literal-list>
					<literal value="nofollow"/>
				</literal-list>
			</attribute>
		</tag>

@kwwall
Copy link
Contributor

kwwall commented Dec 24, 2021

@xeno6696 - Note: to test this in JUnit, you will have to create a custom AntiSamy XML policy file and drop it under 'src/test/resources' and load it with HTMLValidationRule.loadAntisamyPolicy("Name_of_your_policy_file") from your JUnit test. We already do that in 1 or 2 tests so you can follow them as an example.

@xeno6696
Copy link
Collaborator

Yeah I'm good: It's ready to go, I just need the proper inputs to see whether or not this is something I can help with.

I suspect it's AntiSamy as well but stranger things have happened.

@kwwall
Copy link
Contributor

kwwall commented Dec 24, 2021

@xeno6696 - My guess, if it's not AntiSamy, it's one of the parsers that they are using. If the latter, it will not be fixed.

@wangyun2018 - Can you attach the AntiSamy XML policy file fragment that Matt asked for so we can try to get this wrapped up? Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@kwwall @simon0117 @xeno6696 @wangyun2018