dqw / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
0 stars 0 forks source link

Output changed from 1.4.5 to 1.5.3 losing closing </li> #182

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago
What steps will reproduce the problem?
I'm using antisamy through a plugin in grails:
https://github.com/danieldbower/grails-sanitizer/tree/grails_2_4

This is an unreleased version(0.9) that has updated from antisamy 1.4.5 to 
1.5.3. In my antisamy config, I have

<tag name="li" action="validate"/> 
<allowed-empty-tags>
        <literal-list>
            ...
            <literal value="li"/>
            ...

While running a unit test I found that I was losing </li>

What is the expected output? 
I would expect that I would keep the </li>. This is the same as the input:
<p><span class="font-name-arial font-size-14 underline italic" style="color: 
rgb(198,23,23);">[some text B]</span></p><p><span class="font-name-arial 
font-size-14" style="color: rgb(51,51,51);">some text</span></p><ul><li><span 
class="font-name-arial font-size-14" style="color: rgb(51,51,51);">[some text 
C]</span></li><li><span class="font-name-arial font-size-14" style="color: 
rgb(51,51,51);">[some text C]</span></li></ul>

What do you see instead?
All closing </li> are stripped.
<p><span class="font-name-arial font-size-14 underline italic" style="color: 
rgb(198,23,23);">[some text B]</span></p><p><span class="font-name-arial 
font-size-14" style="color: rgb(51,51,51);">some text</span></p><ul><li><span 
class="font-name-arial font-size-14" style="color: rgb(51,51,51);">[some text 
C]</span><li><span class="font-name-arial font-size-14" style="color: 
rgb(51,51,51);">[some text C]</span></ul>

What version of the product are you using? On what operating system?
1.5.3 Ubuntu Linux 13.10

Please provide any additional information below.
If there is any workaround/config that I could use, I appreciate you letting me 
know what I can do.

Original issue reported on code.google.com by virtuald...@gmail.com on 30 Jul 2014 at 5:36

GoogleCodeExporter commented 8 years ago
[deleted comment]
GoogleCodeExporter commented 8 years ago
Tried 1.5.2, 1.5.1, and 1.5, so this was introduced in 1.5.

Original comment by virtuald...@gmail.com on 12 Aug 2014 at 8:46

GoogleCodeExporter commented 8 years ago
So I took some more time and tracked my issue down to 
fc50f4853af6f149ee839a3f629217eb837a410d
But I'm not sure how that is causing me to lose ending li tags. it seems to be 
dealing with tags that are required to be closed and my configuration, which 
was a copy of the tiny mce sample with some tweaks to allow empty tags, doesn't 
have this configuration.

Original comment by virtuald...@gmail.com on 14 Aug 2014 at 2:19

GoogleCodeExporter commented 8 years ago
Ok the following code seems to be the issue, Although I don't know why it was 
the way it was or why it changed to be the else condition rather than the if 
condition that always ran.

{{{

-       if (true) {
-           if (state.empty && isAllowedEmptyTag(rawName)) {
-               _printer.printText(" />");
-           } else {
-               // Must leave CData section first
-               if (state.inCData)
-                   _printer.printText("]]>");
-               // XHTML: element names are lower case, DOM will be different
-               _printer.printText("</");
-               _printer.printText(state.rawName.toLowerCase(Locale.ENGLISH));
-               _printer.printText('>');
-           }
-       } else {
-           if (state.empty)
-               _printer.printText('>');
-           // This element is not empty and that last content was
-           // another element, so print a line break before that
-           // last element and this element's closing tag.
-           // [keith] Provided this is not an anchor.
-           // HTML: some elements do not print closing tag (e.g. LI)
-           if (htmlName == null || !HTMLdtd.isOnlyOpening(htmlName)) {
-               if (_indenting && !state.preserveSpace && state.afterElement)
-                   _printer.breakLine();
-               // Must leave CData section first (Illegal in HTML, but still)
-               if (state.inCData)
-                   _printer.printText("]]>");
-               _printer.printText("</");
-               _printer.printText(state.rawName);
-               _printer.printText('>');
-           }
+       String htmlName = rawName;
+       
+       if (state.empty)
+           _printer.printText('>');
+       // This element is not empty and that last content was
+       // another element, so print a line break before that
+       // last element and this element's closing tag.
+       // [keith] Provided this is not an anchor.
+       // HTML: some elements do not print closing tag (e.g. LI)
+       if (htmlName == null || !HTMLdtd.isOnlyOpening(htmlName)) {
+           if (_indenting && !state.preserveSpace && state.afterElement)
+               _printer.breakLine();
+           // Must leave CData section first (Illegal in HTML, but still)
+           if (state.inCData)
+               _printer.printText("]]>");
+           _printer.printText("</");
+           _printer.printText(state.rawName);
+           _printer.printText('>');
        }
}}}

Original comment by virtuald...@gmail.com on 14 Aug 2014 at 2:38