dqw / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
0 stars 0 forks source link

Empty tag becomes self closing #112

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
I think  this is the same as issue 98 
http://code.google.com/p/owaspantisamy/issues/detail?id=98&can=1

Steps to reproduce:

1. AntiSamy 1.4.4

2. Text to parse:
"text <strong></strong> text <strong><em></em></strong> text"

3. XML Policy includes:

<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:noNamespaceSchemaLocation="antisamy.xsd">

    <directives>
        <directive name="omitXmlDeclaration" value="true" />
        <directive name="omitDoctypeDeclaration" value="true" />
        <directive name="maxInputSize" value="100000" />
        <directive name="embedStyleSheets" value="false" />
        <directive name="useXHTML" value="true" />
        <directive name="formatOutput" value="false" />
    </directives>

...

    <tag-rules>
        <tag name="strong" action="validate" />
        <tag name="em" action="validate" />
    </tag-rules>
...

Expected:

<strong></strong> and <strong><em></em></strong> should both be removed.

Problem:

The first one is removed, but the second one is replaced with a self closed 
<strong/> tag. This makes everything after it bold (in chrome).

Please provide any additional information below.

I don't know how this works internally, but is there a way for me to fix it 
without changing the html? Is there a setting in the Policy file? <strong /> 
doesn't even make sense, so there must be a way to avoid inserting things like 
that into the HTML.

Original issue reported on code.google.com by vikstr...@gmail.com on 30 Jun 2011 at 4:21

GoogleCodeExporter commented 8 years ago
Confirmed. That particular snippet causes problems in SAX and DOM parsers.

Original comment by arshan.d...@gmail.com on 14 Sep 2011 at 9:03

GoogleCodeExporter commented 8 years ago
Fixed in HEAD.

Original comment by arshan.d...@gmail.com on 15 Sep 2011 at 8:10