rjatkins / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
0 stars 0 forks source link

antisamy-slashdot-1.2.xml handles invalid tags oddly #20

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
Using version 1.2 and antisamy-slashdot-1.2.xml

Example test string: "<b>bold<b><i>italic</i><title>title</title>"
Note the wrong second <b> tag (on purpose).
What I would expect would be "<b>bold<b><i>italic</i>title</b></b>".
However, what is returned is:

"<b>bold<b>\n" +
"    <i>italic</i></b></b>\n" +
"<b>\n" +
"  <b>title</b></b>"

Note the newlines, blanks and the duplication of the <b> tag before title.

Another example using nested tags:
Example test 
string: "<title>title</title><b>bold</b><i>italic</i><b><i>boldanditalic</b
>"
Note the missing </i> tag after boldanditalic (on purpose).
What I would expect would 
be "title<b>bold</b><i>italic</i><b><i>boldanditalic</i></b>".
However, what is returned is:
title<b>bold</b>
<i>italic</i>
<b>
  <i>boldanditalic</i></b>
<i />
Note again the newlines, blanks and the duplication of the (empty) <i /> 
tag at the end.

Although the result isn't "wrong", the irregular blanks and newlines make 
it harder to test, as do duplication of invalid tags.

Original issue reported on code.google.com by phlogist...@gmail.com on 29 Jul 2008 at 2:49

GoogleCodeExporter commented 9 years ago
I am also having this issue.  Any ideas for a fix?  The added <i /> is causing 
the rest of the site to be in italics.

Original comment by jeffbol...@gmail.com on 16 Sep 2008 at 4:33

GoogleCodeExporter commented 9 years ago
By the way, here is an example that causes this issue:

<i>Some Text</i>

Original comment by jeffbol...@gmail.com on 16 Sep 2008 at 11:19

GoogleCodeExporter commented 9 years ago

Original comment by arshan.d...@gmail.com on 19 Nov 2008 at 7:13

GoogleCodeExporter commented 9 years ago
There's a few problems at play here:

1. NekoHTML outputs an empty italicized tag (it actually works with b and some
others, too).
2. Browsers see <i/> and for some bizarre reason apply the formatting to the 
rest of
the page content.
3. AntiSamy can't tell that a tag is empty.

Anybody got any ideas how to deal with this?

Original comment by arshan.d...@gmail.com on 26 Nov 2008 at 12:14

GoogleCodeExporter commented 9 years ago
I fixed the issue with a special case for the tags that browser insanely 
handles this
way, including i, b and u. If anybody discovers another, please let me know and 
I'll
add it to the list.

Original comment by arshan.d...@gmail.com on 26 Nov 2008 at 5:43

GoogleCodeExporter commented 9 years ago
Issue 36 has been merged into this issue.

Original comment by arshan.d...@gmail.com on 4 Mar 2009 at 4:13

GoogleCodeExporter commented 9 years ago
I have the same problem with <textarea />, please include this tag in your fix. 
What
can I do to make it work right now?

Original comment by le.xi...@gmail.com on 16 Mar 2009 at 9:41

GoogleCodeExporter commented 9 years ago
[deleted comment]
GoogleCodeExporter commented 9 years ago
Version: Current

Some elements missing when it is empty.

Example input: <p>g34g34g43g</p><p> </p><a name="testanchor"></a><p></p>

Output:
<p>g34g34g43g</p>
<p> </p>

Original comment by aa123n...@gmail.com on 19 Mar 2009 at 9:13

GoogleCodeExporter commented 9 years ago
ond...@svetlik: it's been added to the latest branch.

aa123ntcn: This is intended behavior. Is there a reason to keep around the 
empty tags?

Original comment by arshan.d...@gmail.com on 3 Aug 2009 at 2:40

GoogleCodeExporter commented 9 years ago
arshan.dabirsiaghi: I just want to create an empty <a> as an anchor.
If I insert any space in the tag, the tag won't be remove first time, but it 
trim the 
spaces and the tag become an empty tag, then the tag will be removed when it 
submit 
again. 

asdf<a name="asdf">   </a>asdf     >> first time input

asdf<a name="asdf"></a>asdf        >> first time output, and submit it again

asdfasdf                           >> second time output

Original comment by aa123n...@gmail.com on 12 Aug 2009 at 9:47