diff --git a/src/main/java/org/owasp/html/Sanitizers.java b/src/main/java/org/owasp/html/Sanitizers.java index ed6f4d93..cae80e75 100644 --- a/src/main/java/org/owasp/html/Sanitizers.java +++ b/src/main/java/org/owasp/html/Sanitizers.java @@ -27,6 +27,9 @@ // POSSIBILITY OF SUCH DAMAGE. package org.owasp.html; +import java.util.Arrays; +import java.util.List; + /** * Pre-packaged HTML sanitizer policies. @@ -52,6 +55,25 @@ */ public final class Sanitizers { + + /** + * An AttributePolicy to allow only string literals "row", "col", "rowgroup" and "colgroup" as attribute values for "scope" in element th + * Reference : https://developer.mozilla.org/en-US/docs/Web/HTML/Element/th + */ + private static final AttributePolicy TABLE_SCOPE_POLICY = new AttributePolicy() { + + private List thScopeWhitelistValues = Arrays.asList("row","col","rowgroup","colgroup"); + + @Override + public String apply(String elementName, String attributeName, String value) { + if("scope".equals(attributeName)) { + if(thScopeWhitelistValues.contains(value.toLowerCase())) + return value; + } + return null; + } + }; + /** * Allows common formatting elements including {@code }, {@code }, etc. */ @@ -93,6 +115,10 @@ public final class Sanitizers { .onElements("table", "tr", "td", "th", "colgroup", "col", "thead", "tbody", "tfoot") + .allowAttributes("colspan","rowspan","headers") + .onElements("td","th") + .allowAttributes("scope").matching(TABLE_SCOPE_POLICY) + .onElements("th") .allowTextIn("table") // WIDGY .toFactory(); diff --git a/src/test/java/org/owasp/html/SanitizersTest.java b/src/test/java/org/owasp/html/SanitizersTest.java index 4cb7bbca..fe73bd02 100644 --- a/src/test/java/org/owasp/html/SanitizersTest.java +++ b/src/test/java/org/owasp/html/SanitizersTest.java @@ -59,6 +59,18 @@ public static final void testFormatting() { "

Hello, World!

")); } + @Test + public static final void testTableAttributes() { + String input = "" + + "" + + "
MonthTest
TestA
TestB
Test
"; + assertEquals(input, Sanitizers.TABLES.sanitize(input)); + + //Negative test to ensure 'scope' doesn't allow random values + assertEquals("
\n" + ,Sanitizers.TABLES.sanitize("
\n" + + "")); + } @Test public static final void testBlockElements() { assertEquals("", Sanitizers.BLOCKS.sanitize(null));