[
https://issues.apache.org/jira/browse/OFBIZ-10187?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16345118#comment-16345118
]
Jacques Le Roux commented on OFBIZ-10187:
-----------------------------------------
I don't remember all about prepackaged policies from the top of my head and
when looking for references from https://github.com/OWASP/java-html-sanitizer
I got this
{code}
<Error><Code>AccessDenied</Code><Message>Access
Denied</Message><RequestId>899F32622D073078</RequestId><HostId>j/5bP+ZPinxYl8Fn79QCX7fggMciqgs5d0mcwo19FG593dAZmayAAZY3qOAZ6LxJszlqi/sG5Tw=</HostId></Error>
{code}
Not sure why I'd need an access, I guess it's an error on their side.
Anyway your problem, as you show it so far, is not related with ul and li but
only div:
{code}
@@ -1,14 +1,14 @@
- <div class="item">
+ <div>
<img
src="<@ofbizContentUrl>/webcontent/img/slider/1.jpg</@ofbizContentUrl>" alt=""
/>
- <div class="container">
- <div class="slider-overlay">
+ <div>
+ <div>
<h2>Lorem ipsum dolor sit amet</h2>
<h3>At vero eos et accusam et justo</h3>
<p>
Lorem ipsum dolor sit amet, consetetur sadipscing
elitr, dolores et ea rebum. Stet clita kasd gubergren, no sea
takimata sanctus est Lorem ipsum dolor sit amet.
</p>
- <a class="btn btn-grey"
href="<@ofbizUrl>cms/~webpage_id=100</@ofbizUrl>">weitere Informationen</a>
+ <a
href="<@ofbizUrl>cms/~webpage_id=100</@ofbizUrl>">weitere Informationen</a>
</div>
</div>
</div>
{code}
And there is a reason for that, see the "XSS Prevention Rules Summary" section
here:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#Bonus_Rule_.234:_Use_the_X-XSS-Protection_Response_Header
So, as far as I can remember, OOTB I used the simplest recommended way to
protect things. You may want to bypass it all, if you are sure about the usage,
or create your on policy. Did you try the PERMISSIVE_POLICY ?
> OWASP sanitizer breaks proper rendering of HTML code
> ----------------------------------------------------
>
> Key: OFBIZ-10187
> URL: https://issues.apache.org/jira/browse/OFBIZ-10187
> Project: OFBiz
> Issue Type: Bug
> Components: ALL COMPONENTS
> Affects Versions: 16.11.04
> Reporter: Michael Brohl
> Assignee: Jacques Le Roux
> Priority: Critical
>
> The current implementation of the sanitizer breaks the proper rendering of
> html code. In our case, class attributes are stripped from the html content.
> Example:
> {code:java}
> <div class="item">
> <img
> src="<@ofbizContentUrl>/webcontent/img/slider/1.jpg</@ofbizContentUrl>"
> alt="" />
> <div class="container">
> <div class="slider-overlay">
> <h2>Lorem ipsum dolor sit amet</h2>
> <h3>At vero eos et accusam et justo</h3>
> <p>
> Lorem ipsum dolor sit amet, consetetur
> sadipscing elitr, dolores et ea rebum. Stet clita kasd gubergren, no sea
> takimata sanctus est Lorem ipsum dolor sit amet.
> </p>
> <a class="btn btn-grey"
> href="<@ofbizUrl>cms/~webpage_id=100</@ofbizUrl>">weitere Informationen</a>
> </div>
> </div>
> </div>{code}
> will be rendered to
> {code:java}
> <div>
> <img
> src="<@ofbizContentUrl>/webcontent/img/slider/1.jpg</@ofbizContentUrl>"
> alt="" />
> <div>
> <div>
> <h2>Lorem ipsum dolor sit amet</h2>
> <h3>At vero eos et accusam et justo</h3>
> <p>
> Lorem ipsum dolor sit amet, consetetur
> sadipscing elitr, dolores et ea rebum. Stet clita kasd gubergren, no sea
> takimata sanctus est Lorem ipsum dolor sit amet.
> </p>
> <a
> href="<@ofbizUrl>cms/~webpage_id=100</@ofbizUrl>">weitere Informationen</a>
> </div>
> </div>
> </div>{code}
> I do not see any reason to not allow class attributes in html code. There
> might be other problems with these rules but this is a showstopper.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
