tomshearer / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
0 stars 0 forks source link

DOM scanner removes dl, dt, dd nodes (SAX does not) #160

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Go to http://canyouxssthis.com/AntiSamy/reflect
2. Enter this HTML:
<h2>Releases</h2><dl><dt>Version 1</dt><dd>Fixed All Bugs</dd></dl>

What is the expected output? What do you see instead?
I expected:
Releases
Version 1
Fixed All Bugs

I actually see just:
Releases

In other words, the DL/DT/DD nodes are removed from the output.

What version of the product are you using? On what operating system?
This was observed on http://canyouxssthis.com/. My own testing with AntiSamy 
1.5.1 shows the same behavior with the DOM parser, but with SAX the DL/DT/DD 
nodes appear in the output. I am using the same policy file for both DOM and 
SAX. The relevant portion of the policy file is:
<tag name="dd" action="truncate"/>
<tag name="dl" action="truncate"/>
<tag name="dt" action="truncate"/>

Please provide any additional information below.
My understanding is that "truncate" should remove all attributes, but preserve 
the element. As such, I believe the SAX output is correct, and the DOM output 
is incorrect.

Original issue reported on code.google.com by danr...@gmail.com on 4 Apr 2013 at 8:29

GoogleCodeExporter commented 9 years ago
[deleted comment]
GoogleCodeExporter commented 9 years ago
[deleted comment]
GoogleCodeExporter commented 9 years ago
@danr...@gmail.com in antisamy truncate means removes any attributes and nested 
tags.. So here dt and dd tag has been nested inside dl. As per truncate meaning 
all the nested tags are removed. Can you please change action as filter. This 
will do desired result. 

As far as my understanding I told that suggestion. If wrong please correct me.

But I don't know why there is difference between DOM and SAX parser. Both uses 
the same policy file. Developer from antisamy team can you please explain why?

Original comment by kmanimekalai on 26 Feb 2014 at 9:01