OWASP / java-html-sanitizer

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.
Other
833 stars 210 forks source link

Issue with HTML Sanitization: Improper Handling of <div> Tag Inside <table> #342

Open sumitkumar1110 opened 2 weeks ago

sumitkumar1110 commented 2 weeks ago

Hi, We are using the this library in Zimbra to sanitize customer-generated HTML content in emails. During this process, we encountered an issue where a

tag inside a tag causes improper sanitization. Specifically:

  1. The sanitizer closes the
tag before the
tag and reopens it after the
.
  • The
    tag does not close where it originally should; instead, it closes just before the end of the HTML document. It seems that the sanitizer uses a stack to manage tags and the
    tag remains in the stack until all other tags are processed, causing it to close at the end of the document.
  • Before Sanitization `

    </table>

    `

    After sanitization

    `