fmorote / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
0 stars 0 forks source link

Inserting "\n" when characters follow an accepted tag. #61

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
Give any string to AntiSamy.scan() that ends with an accepted tag followed
by additional characters. Example:

Policy policy = Policy.getInstance("antisamy-slashdot-1.3.xml");
AntiSamy as = new AntiSamy();
String dirtyInput = "blah <b>blah</b>.";
CleanResults cr = as.scan(dirtyInput, policy);
System.out.println(cr.getCleanHTML());

What is the expected output? What do you see instead?

The expected output is: "blah <b>blah</b>."

Instead, it prints: "blah <b>blah</b>\n."

What version of the product are you using? On what operating system?

I get the same result with antisamy-bin.1.3.jar, and antisamy-bin.1.4b.jar
compiled from 'current' in the SVN repo revision 137.

Environment:
Mac OS X 10.5.8
java version "1.6.0_15"
Java(TM) SE Runtime Environment (build 1.6.0_15-b03-226)
Java HotSpot(TM) 64-Bit Server VM (build 14.1-b02-92, mixed mode)

Original issue reported on code.google.com by andrew.r...@gmail.com on 18 Dec 2009 at 2:07

GoogleCodeExporter commented 9 years ago
I took your code and added the following test case to AntiSamyTest.java: 

try {
  String dirtyInput = "blah blah.";
  CleanResults cr = as.scan(dirtyInput, policy);
  assertEquals(dirtyInput,cr.getCleanHTML());
} catch(Exception e) {
  fail(e.getMessage());
}

This test case passes in my environment, which is almost a dupe of yours, 
except that
I'm in Vista. Can anyone else verify this?

Original comment by arshan.d...@gmail.com on 8 Mar 2010 at 4:38

GoogleCodeExporter commented 9 years ago
I get the same problem on Linux as well:

Linux arcom 2.6.26-1-xen-amd64 #1 SMP Sat Jan 10 20:39:26 UTC 2009 x86_64 
GNU/Linux
java version "1.6.0_0"
OpenJDK  Runtime Environment (build 1.6.0_0-b11)
OpenJDK 64-Bit Server VM (build 1.6.0_0-b11, mixed mode)

Test code attached.

The output is:

blah blah
.

Expected:

blah blah.

Original comment by andrew.r...@gmail.com on 9 Mar 2010 at 12:16

Attachments: