search

andresriancho / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
12 stars 15 forks source link

Antisamy doesn't allow vendor-specific attributes #150

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
Add vendor specific CSS attribute to allowed CSS properties in policy file. 
AntiSamy seems to strip out CSS property regardless.

What is the expected output? What do you see instead?
AntiSamy should preserve the vendor specific attribute if configured in the 
policy file.

What version of the product are you using? On what operating system?
1.4.5 on Linux

Please provide any additional information below.
I think this may be because of bug in Batik CSS parser that AntiSamy uses.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47800

Example of vendor specific attribute.

                <property name="-moz-border-radius">
                        <regexp-list>
                                <regexp name="anything"/>
                        </regexp-list>
                </property>

Original issue reported on code.google.com by wvinc...@gmail.com on 31 Jan 2013 at 2:23