ofbiz-notifications mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jacques Le Roux (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (OFBIZ-10187) OWASP sanitizer breaks proper rendering of HTML code
Date Tue, 30 Jan 2018 14:50:00 GMT

    [ https://issues.apache.org/jira/browse/OFBIZ-10187?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16345141#comment-16345141
] 

Jacques Le Roux commented on OFBIZ-10187:
-----------------------------------------

To summarize, it's a delicate matter. All depend on your context. If people allowed to edit
your content template can be trusted it's of course easier (like allow all). If you open your
templates to the Internet that's another problem...

> OWASP sanitizer breaks proper rendering of HTML code
> ----------------------------------------------------
>
>                 Key: OFBIZ-10187
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-10187
>             Project: OFBiz
>          Issue Type: Bug
>          Components: ALL COMPONENTS
>    Affects Versions: 16.11.04
>            Reporter: Michael Brohl
>            Assignee: Jacques Le Roux
>            Priority: Critical
>
> The current implementation of the sanitizer breaks the proper rendering of html code.
In our case, class attributes are stripped from the html content.
> Example:
> {code:java}
>             <div class="item">
>                  <img src="<@ofbizContentUrl>/webcontent/img/slider/1.jpg</@ofbizContentUrl>"
alt="" />
>                  <div class="container">
>                      <div class="slider-overlay">
>                          <h2>Lorem ipsum dolor sit amet</h2>
>                          <h3>At vero eos et accusam et justo</h3>
>                          <p>
>                              Lorem ipsum dolor sit amet, consetetur
sadipscing elitr, dolores et ea rebum. Stet clita kasd gubergren, no sea
>                              takimata sanctus est Lorem ipsum dolor
sit amet.
>                          </p>
>                          <a class="btn btn-grey" href="<@ofbizUrl>cms/~webpage_id=100</@ofbizUrl>">weitere
Informationen</a>
>                      </div>
>                  </div>
>              </div>{code}
> will be rendered to
> {code:java}
>             <div>
>                  <img src="<@ofbizContentUrl>/webcontent/img/slider/1.jpg</@ofbizContentUrl>"
alt="" />
>                  <div>
>                      <div>
>                          <h2>Lorem ipsum dolor sit amet</h2>
>                          <h3>At vero eos et accusam et justo</h3>
>                          <p>
>                              Lorem ipsum dolor sit amet, consetetur
sadipscing elitr, dolores et ea rebum. Stet clita kasd gubergren, no sea
>                              takimata sanctus est Lorem ipsum dolor
sit amet.
>                          </p>
>                          <a href="<@ofbizUrl>cms/~webpage_id=100</@ofbizUrl>">weitere
Informationen</a>
>                      </div>
>                  </div>
>              </div>{code}
> I do not see any reason to not allow class attributes in html code. There might be other
problems with these rules but this is a showstopper.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message