OWASP / java-html-sanitizer

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.
Other
851 stars 214 forks source link

add tag in safeName method in HtmlStreamRenderer #203

Open yangbongsoo opened 4 years ago

yangbongsoo commented 4 years ago

I organized the guide to use a different tag(reference is MDN)

<frame> -> <iframe> https://developer.mozilla.org/en-US/docs/Web/HTML/Element/frame

<applet> -> <object> https://developer.mozilla.org/en-US/docs/Web/HTML/Element/applet

<basefont> -> <font> (but font is obsolete too) https://developer.mozilla.org/en-US/docs/Web/HTML/Element/basefont

<acronym> -> <abbr> https://developer.mozilla.org/en-US/docs/Web/HTML/Element/acronym

<strike> -> <del> or <s> https://developer.mozilla.org/en-US/docs/Web/HTML/Element/strike

<tt> -> <code>, <kbd>, <samp>, <var> or <pre> https://developer.mozilla.org/en-US/docs/Web/HTML/Element/tt

<command> -> <menuitem> https://developer.mozilla.org/en-US/docs/Web/HTML/Element/command

<dir> -> <ul> https://developer.mozilla.org/en-US/docs/Web/HTML/Element/dir

@mikesamuel

  1. sub compatibility will be broken. The tags that were well expressed before are changed. But I think it is right to change because HTML is updated. How about you?

  2. basefont and strike and tt tags are difficult to decide.

  static String safeName(String unsafeElementName) {
    String elementName = HtmlLexer.canonicalName(unsafeElementName);

    // Substitute a reliably non-raw-text element for raw-text and
    // plain-text elements.
    switch (elementName.length()) {
      case 3:
        if ("xmp".equals(elementName)) { return "pre"; }
        if ("dir".equals(elementName)) { return "ul"; }
        break;
      case 5:
        if ("frame".equals(elementName)) { return "iframe"; }
        break;
      case 6:
        if ("applet".equals(elementName)) { return "object"; }
        break;
      case 7:
        if ("listing".equals(elementName)) { return "pre"; }
        if ("acronym".equals(elementName)) { return "abbr"; }
        if ("command".equals(elementName)) { return "menuitem"; }
        break;
      case 9:
        if ("plaintext".equals(elementName)) { return "pre"; }
        break;
    }
    return elementName;
  }
jmanico commented 4 years ago

You are one of the first volunteers to dig so deeply into Mikes parser code. You should be proud. Thank you!

-- Jim Manico @Manicode

On Jun 4, 2020, at 3:54 AM, yangbongsoo notifications@github.com wrote:

 I organized the guide to use a different tag(reference is MDN)

->