rjatkins / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
0 stars 0 forks source link

Non empty elements are converted to a minimized form in xhtml. #36

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
Attempt to sanitize a string like the following with the directive
"useXHTML" set to true:
<strong></strong><a>hello world</a>

AntiSamy outputs the following:
<strong /><a>hello world</a>

If you render that in an html page (in ie/ff using xhtml doctype) the link
will be in bold. It shouldn't be bold.

It turns out not to be an issue of AntiSamy per se, the problem is when
using the "XHTMLSerializer" of xerces 2.9.1.

If the tag is empty, it is using the minimized version of it
(HTMLSerializer.java line 411).

The XHTML spec mentions that only tags that are allowed to be empty (i.e.
b, img) are allowed to be minimized:
http://www.w3.org/TR/xhtml1/#guidelines

Original issue reported on code.google.com by carlos.a...@gmail.com on 11 Feb 2009 at 6:38

GoogleCodeExporter commented 9 years ago
Expected output using xhtml:
input: <strong></strong><a>hello world</a>
output: <strong></strong><a>hello world</a>

input: <hr><a>hello world</a>
output: <hr /><a>hello world</a>

Original comment by carlos.a...@gmail.com on 16 Feb 2009 at 12:23

GoogleCodeExporter commented 9 years ago

Original comment by arshan.d...@gmail.com on 4 Mar 2009 at 4:13