search

dqw / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
0 stars 0 forks source link

CSS Parsing in AntiSasmy.net #53

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
What steps will reproduce the problem?
1. Try to validate inline styles like style="text-decoration:underline;" 
on a <span>

What is the expected output? What do you see instead?
Provided the policy is correctly defined it should allow it

What version of the product are you using? On what operating system?
.net 2.0, Vista SP1, vs.net web server

Please provide any additional information below.

In CssScanner.cs line 163, should the code actually be calling:
 parser.parseStyleDeclaration(source);
otherwise I just get flute parse exceptions that are being caught and 
handled meaning no error/debugging info available to .net and all styles 
are stripped even if they're valid in the policy file.

Also should the following be commented out [or put into a conditional for 
(isInline==true)] in CssHandler.cs "property" method:
  //  styleSheet.Append('\t'); (line 509)
  //  styleSheet.Append('\n'); (line 521)
as inline styles do not need formatting?

Original issue reported on code.google.com by mark.lea...@gmail.com on 15 Sep 2009 at 3:50

GoogleCodeExporter commented 8 years ago 
just noticed issue 22 ... guess the second issue I mentioned about formatting 
inline 
styles wasn't rolled into the .net version of AntiSami?

Original comment by mark.lea...@gmail.com on 15 Sep 2009 at 4:16

GoogleCodeExporter commented 8 years ago

Original comment by arshan.d...@gmail.com on 15 Oct 2009 at 10:56

GoogleCodeExporter commented 8 years ago 
[deleted comment]
GoogleCodeExporter commented 8 years ago 
[deleted comment]
GoogleCodeExporter commented 8 years ago 
All <span> return an empty style value.  Does anyone have a working copy of the 
code
for CSS handling in .net?  I am using the ebay xml file.

Original comment by r...@smartcashglobal.net on 6 Nov 2009 at 11:33

GoogleCodeExporter commented 8 years ago 
We don't officially maintain the .NET port anymore and it should be considered 
"as is" until developers come along that want to take ownership.

Original comment by arshan.d...@gmail.com on 15 Nov 2010 at 10:04