javamail - OWASP HTML Sanitizer allow colon in HTML -


how can allow : sign in sanitized html? using sanitize html code in generating java mail. code has inline image content id <img src=\"cid:image\" height=\"70\" width=\"70\" />. upon sanitizing, src attribute not included in sanitized html.

    policyfactory images = new htmlpolicybuilder().allowurlprotocols("http", "https")             .allowelements("img")             .allowattributes("src").matching(pattern.compile("^cid[:][\\w]+$"))             .onelements("img")             .allowattributes("border", "height", "width").onelements("img")             .tofactory();      string html = "<img src=\"cid:image\"  height=\"70\" width=\"70\" />";     final string sanitized = images.sanitize(html);      system.out.println(sanitized);

the output of above code is:

<img height="70" width="70" />

why isn't working

or rather, why it's working "too well"

by default, htmlpolicybuilder disallows url protocols in src elements. prevents injections such 

<img src="javascript:alert('xss')"/>

which potentially lead execution of script after javascript: (in case, alert('xss'))

there other protocols (on other elements) can lead similar issues:

even though doesn't use javascript protocol, it's still possible inject base64-encoded xss injection:

<object src="data:text/html;base64,phnjcmlwdd5hbgvydcgnehnzjyk8l3njcmlwdd4="/>

or

<a href="data:text/html;base64,phnjcmlwdd5hbgvydcgnehnzjyk8l3njcmlwdd4=">click me</a>

because of this, htmlpolicybuilder assumes any attribute value containing colon (in attributes) should treated dangerous.

how fix it:

you have explicitly tell htmlpolicybuilder allow cid "protocol", using allowurlprotocols method:

    policyfactory images = new htmlpolicybuilder().allowurlprotocols("http", "https")             .allowelements("img")             .allowurlprotocols("cid") // allow "cid"             .allowattributes("src").matching(pattern.compile("^cid[:][\\w]+$"))             .onelements("img")             .allowattributes("border", "height", "width").onelements("img")             .tofactory();      string html = "<img src=\"cid:image\"  height=\"70\" width=\"70\" />";     final string sanitized = images.sanitize(html);      system.out.println(sanitized);

output:

<img src="cid:image" height="70" width="70" />

Comments

Post a Comment

Popular posts from this blog

html - Outlook 2010 Anchor (url/address/link) -

i'm trying link specific pdf page msoutlook'10 or msword'10, #page=... anchor particularly useful , works fine elsewhere. unfortunately when click [ctr-k] in outlook or winword, links re-formatted assuming unc path. pdf file located on shared drive. using "file:" prefix links open pdf in adobe reader (outside of browser), , "http:" open inside browser. issue seem need open in browser "file:" prefix in order anchor work. know anchors work inside browser. outlook uses windows/explorer default program (based on file extension) seems open in adobe reader neglecting anchor. is aware of solution, link specific page or bookmark of shared-pdf ms outlook and/or winword link? common references: mailermailer.com/...anchor-tags-html-emails campaignmonitor.com/...anchor-links-in-email-newsletters/ stackoverflow.com/...anchor-in-pdf-document
Read more

javascript - Why does running this loop 9 times take 100x longer than running it 8 times? -

consider code: test = function() { } t = new test(); (var = 0; < 8; i++) { result = t instanceof test; } if change number of iterations 8 9 , loop take 100 times longer complete in latest version of firefox (41.0.1). tested on 2 different pcs , magic limit 8. here jsperf test used: http://jsperf.com/instanceof-8-times-vs-9-times does have idea why might happen? seems specific instanceof . not happen if else object, example check property. note: filed bugzilla bug this. jan de mooij mozilla team has posted details in bugzilla thread . here's simplistic interpretation of highly technical answers: in i < 8 case, firefox smart enough hoist result = t instanceof test; statement out of loop (according tests, doesn't seem omit altogether). in i < 9 case, apparently doesn't optimization . why? reason not clear, related fact 9 iterations threshold above function considered "hot" enough run through jit compiler. i < 8 cas...
Read more

Getting gateway time-out Rails app with Nginx + Puma running on Digital Ocean -

following this guide setup app on digital ocean droplet, not working. site not loading , it's throwing: "gateway time-out". the puma server works, since ps aux | grep puma prints: root 15878 0.0 0.4 376832 2168 ? sl 12:50 0:00 puma 2.13.4 (unix:///var/www/myapp/shared/tmp/sockets/myapp-puma.sock) [20150930164940] root 15881 0.0 0.7 903676 3692 ? sl 12:50 0:06 puma: cluster worker 0: 15878 [20150930164940] root 24654 0.0 0.1 11748 916 pts/2 s+ 18:00 0:00 grep --color=auto puma my nginx config: user root; worker_processes 1; events { worker_connections 1024; } http { upstream puma { server unix:///var/www/myapp/shared/tmp/sockets/myapp-puma.sock; } server { listen 80; server_name myapp.com; root /var/www/myapp/current/public; access_log /var/www/myapp/current/log/access.log; error_log /...
Read more