search

OWASP / java-html-sanitizer

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.
Other
834 stars 209 forks source link

Fix missing null checks in uses of consumeIdentOrUrlOrFunctions #266

Closed mikesamuel closed 2 years ago

mikesamuel commented 2 years ago

CssTokens code assumed that consumeIdentOrUrlOrFunctions always returned a token type and consumed characters.

This commit audits all uses of that function and checks that they make progress.