search

andresriancho / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
12 stars 15 forks source link

Antisamy Removes carriage returns and line feeds #143

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. Create a file with carriage returns/line feeds
2. Run this.getAntiSamyPolicy()).getCleanHTML();
3. Result all carriage returns/line feeds are removed

What is the expected output? What do you see instead?

I would like to see carriage feeds/carriage returns remain in output.

What version of the product are you using? On what operating system?
1.4.4 Mac Os X, Version 10.7.5, also happens on windows 7

Please provide any additional information below.

I work for NASA, and we really need a solution to this problem. Is this 
happening in the policy file, or the java source code??

I have toggled a couple of fields in the policy files, and none have resulted 
in any changes.

Original issue reported on code.google.com by mbharri...@gmail.com on 1 Nov 2012 at 3:06

Attachments:

GoogleCodeExporter commented 9 years ago 
Can you please attach you policy directives?  The only way I could reproduce 
was using "preserveSpace=false".

Original comment by tad...@gmail.com on 5 Nov 2012 at 10:52

GoogleCodeExporter commented 9 years ago 
What OS are you using? I'm on a MAC running lion, and nothing works for me.

Original comment by mbharri...@gmail.com on 5 Nov 2012 at 11:16

Attachments:

GoogleCodeExporter commented 9 years ago 
Also below are two links, that also are having the same issue. One article 
states that he used "preserveSpace="true", which I'm using and antisamy still 
removes the carriage returns.

https://lists.owasp.org/pipermail/owasp-antisamy/2008-July/000073.html
https://lists.owasp.org/pipermail/owasp-antisamy/2010-June/000321.html

Original comment by mbharri...@gmail.com on 5 Nov 2012 at 11:24

GoogleCodeExporter commented 9 years ago 
Sorry, I should have clarified.  You mentioned you were able to reproduce on 
Windows, and I was not able to reproduce on Windows.  I don't have access to a 
Mac to test/verify on that.

Original comment by tad...@gmail.com on 6 Nov 2012 at 2:52

GoogleCodeExporter commented 9 years ago 
Can you please try to use the antisamy-anythinggoes-1.4.4.xml file I have 
attached, and verify if it works in windows for me?

Original comment by mbharri...@gmail.com on 6 Nov 2012 at 3:16

vadooss1 commented 4 years ago

I have the same issue. When this issue will be fixed?

davewichers commented 4 years ago

This is a really old issue, obviously, and I've just started to help Arshan with maintenance of Antisamy. Just to confirm, does your Antisamy policy have: preserveSpace=true, and this still happens? And if it still happens, does it always happen regardless of content, or only if AntiSamy identifies something that needs to be removed?

vadooss1 commented 4 years ago

preserveSpace=true, formatOutput=false are set. The issue happens always when multi lines text contains characters & < > " . The issue doesn't happen with any other special symbols.

vadooss1 commented 4 years ago

I really ask you to help and fix this issue. Because user text input often has characters & < > " and antisamy changes text formatting removing new lines and carriages return when these characters are into the text. Saving text formatting is very significant for our system. Thanks a lot.

nahsra commented 4 years ago

Can you provide a failing test case? I am not sure we have enough context to reproduce. I also don't know if the behavior you don't want is being caused parts of serialization that we don't control, so I want to temper your expectations.

vadooss1 commented 4 years ago

Refer attachment.

  1. The image "after_submit.png" has lost formatting (screenshot was made after page was submitted)
  2. The image "before_submit.png" has formatting (screenshot was made before page submitting)

after_submit before_submit

Note: for issue reproducing use characters "" & < in the input text

davewichers commented 4 years ago

@vadooss1 - Are you going to create a failing test case in the base AntiSamy project in github.com/nahsra so we know exactly what is going on/failing?