Integrate url classifier #126
Open
+793
−197
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
to make it easier to vet URLs without resorting to error-prone
regexs.
This is experimental.
This change deprecates the old way of white-listing protocols
in the scope of the whole sanitizer and makes available an
AttributePolicyBuilder match method that takes a classifier
so it is easy to scope a URL policy to a particular attribute.
Converting an attribute value to a UrlValue requires a UrlContext.
A UrlContext can encapsulate the base URL of the embedding document,
so should not be scoped to a policy, but rather to a sanitize call.
Therading the context through to Attribute and Element policies
requires an API change to {Attribute,Element}Policy.
This change deprecates those in favor of {Attribute,Element}Policy.V2
which are subinterfaces that take an extra Context object.
Per travis-ci/travis-ci#7884 Travis no longer supports Java6 and for Java7 you have to use openjdk7, not oraclejdk7.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Integrated URL classifiers from github/OWASP/url-classifier
to make it easier to vet URLs without resorting to error-prone
regexs.
This is experimental.
This change deprecates the old way of white-listing protocols
in the scope of the whole sanitizer and makes available an
AttributePolicyBuilder match method that takes a classifier
so it is easy to scope a URL policy to a particular attribute.
Converting an attribute value to a UrlValue requires a UrlContext.
A UrlContext can encapsulate the base URL of the embedding document,
so should not be scoped to a policy, but rather to a sanitize call.
Therading the context through to Attribute and Element policies
requires an API change to {Attribute,Element}Policy.
This change deprecates those in favor of {Attribute,Element}Policy.V2
which are subinterfaces that take an extra Context object.