Skip to content

Commit 16693f5

Browse files
committed
Automatic tidy refactor
1 parent 5dbb5da commit 16693f5

File tree

2 files changed

+69
-77
lines changed

2 files changed

+69
-77
lines changed

src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java

+48-58
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
import java.io.IOException;
44
import java.io.Writer;
55
import java.util.Locale;
6-
76
import org.apache.xml.serialize.ElementState;
87
import org.apache.xml.serialize.HTMLdtd;
98
import org.apache.xml.serialize.OutputFormat;
@@ -39,44 +38,38 @@ protected String getEntityRef(int charToPrint) {
3938
}
4039

4140
/**
42-
* Called to serialize a DOM element. Equivalent to calling {@link
43-
* #startElement}, {@link #endElement} and serializing everything
44-
* inbetween, but better optimized.
41+
* Called to serialize a DOM element. Equivalent to calling {@link #startElement}, {@link
42+
* #endElement} and serializing everything inbetween, but better optimized.
4543
*/
4644
@Override
47-
protected void serializeElement(Element elem )
48-
throws IOException
49-
{
45+
protected void serializeElement(Element elem) throws IOException {
5046
Attr attr;
5147
NamedNodeMap attrMap;
52-
int i;
48+
int i;
5349
Node child;
5450
ElementState state;
55-
boolean preserveSpace;
56-
String name;
57-
String value;
58-
String tagName;
51+
boolean preserveSpace;
52+
String name;
53+
String value;
54+
String tagName;
5955

6056
tagName = elem.getTagName();
6157
state = getElementState();
62-
if ( isDocumentState() ) {
58+
if (isDocumentState()) {
6359
// If this is the root element handle it differently.
6460
// If the first root element in the document, serialize
6561
// the document's DOCTYPE. Space preserving defaults
6662
// to that of the output format.
67-
if ( ! _started )
68-
startDocument( tagName );
63+
if (!_started) startDocument(tagName);
6964
} else {
7065
// For any other element, if first in parent, then
7166
// close parent's opening tag and use the parnet's
7267
// space preserving.
73-
if ( state.empty )
74-
_printer.printText( '>' );
68+
if (state.empty) _printer.printText('>');
7569
// Indent this element on a new line if the first
7670
// content of the parent element or immediately
7771
// following an element.
78-
if ( _indenting && ! state.preserveSpace &&
79-
( state.empty || state.afterElement ) )
72+
if (_indenting && !state.preserveSpace && (state.empty || state.afterElement))
8073
_printer.breakLine();
8174
}
8275
preserveSpace = state.preserveSpace;
@@ -85,8 +78,8 @@ protected void serializeElement(Element elem )
8578
// This only happens in endElement().
8679

8780
// XHTML: element names are lower case, DOM will be different
88-
_printer.printText( '<' );
89-
_printer.printText( tagName );
81+
_printer.printText('<');
82+
_printer.printText(tagName);
9083
_printer.indent();
9184

9285
// Lookup the element's attribute, but only print specified
@@ -95,79 +88,74 @@ protected void serializeElement(Element elem )
9588
// separated with a space so the element can be broken on
9689
// multiple lines.
9790
attrMap = elem.getAttributes();
98-
if ( attrMap != null ) {
99-
for ( i = 0 ; i < attrMap.getLength() ; ++i ) {
100-
attr = (Attr) attrMap.item( i );
91+
if (attrMap != null) {
92+
for (i = 0; i < attrMap.getLength(); ++i) {
93+
attr = (Attr) attrMap.item(i);
10194
name = attr.getName().toLowerCase(Locale.ENGLISH);
10295
value = attr.getValue();
103-
if ( attr.getSpecified() ) {
96+
if (attr.getSpecified()) {
10497
_printer.printSpace();
10598
// HTML: Empty values print as attribute name, no value.
10699
// HTML: URI attributes will print unescaped
107-
if ( value == null ) {
100+
if (value == null) {
108101
value = "";
109102
}
110-
if ( !_format.getPreserveEmptyAttributes() && value.length() == 0 )
111-
_printer.printText( name );
112-
else if ( HTMLdtd.isURI( tagName, name ) ) {
113-
_printer.printText( name );
114-
_printer.printText( "=\"" );
115-
_printer.printText( escapeURI( value ) );
116-
_printer.printText( '"' );
117-
} else if ( HTMLdtd.isBoolean( tagName, name ) )
118-
_printer.printText( name );
103+
if (!_format.getPreserveEmptyAttributes() && value.length() == 0)
104+
_printer.printText(name);
105+
else if (HTMLdtd.isURI(tagName, name)) {
106+
_printer.printText(name);
107+
_printer.printText("=\"");
108+
_printer.printText(escapeURI(value));
109+
_printer.printText('"');
110+
} else if (HTMLdtd.isBoolean(tagName, name)) _printer.printText(name);
119111
else {
120-
_printer.printText( name );
121-
_printer.printText( "=\"" );
122-
printEscaped( value );
123-
_printer.printText( '"' );
112+
_printer.printText(name);
113+
_printer.printText("=\"");
114+
printEscaped(value);
115+
_printer.printText('"');
124116
}
125117
}
126118
}
127119
}
128-
if ( HTMLdtd.isPreserveSpace( tagName ) )
129-
preserveSpace = true;
120+
if (HTMLdtd.isPreserveSpace(tagName)) preserveSpace = true;
130121

131122
// If element has children, or if element is not an empty tag,
132123
// serialize an opening tag.
133-
if ( elem.hasChildNodes() || ! HTMLdtd.isEmptyTag( tagName ) ) {
124+
if (elem.hasChildNodes() || !HTMLdtd.isEmptyTag(tagName)) {
134125
// Enter an element state, and serialize the children
135126
// one by one. Finally, end the element.
136-
state = enterElementState( null, null, tagName, preserveSpace );
127+
state = enterElementState(null, null, tagName, preserveSpace);
137128

138129
// Prevents line breaks inside A/TD
139-
if ( tagName.equalsIgnoreCase( "A" ) || tagName.equalsIgnoreCase( "TD" ) ) {
130+
if (tagName.equalsIgnoreCase("A") || tagName.equalsIgnoreCase("TD")) {
140131
state.empty = false;
141-
_printer.printText( '>' );
132+
_printer.printText('>');
142133
}
143134

144135
// Handle SCRIPT and STYLE specifically by changing the
145136
// state of the current element to CDATA (XHTML) or
146137
// unescaped (HTML).
147-
if ( tagName.equalsIgnoreCase( "SCRIPT" ) ||
148-
tagName.equalsIgnoreCase( "STYLE" ) ) {
138+
if (tagName.equalsIgnoreCase("SCRIPT") || tagName.equalsIgnoreCase("STYLE")) {
149139
// HTML: Print contents unescaped
150140
state.unescaped = true;
151141
}
152142
child = elem.getFirstChild();
153-
while ( child != null ) {
154-
serializeNode( child );
143+
while (child != null) {
144+
serializeNode(child);
155145
child = child.getNextSibling();
156146
}
157-
endElementIO( null, null, tagName );
147+
endElementIO(null, null, tagName);
158148
} else {
159149
_printer.unindent();
160150
// XHTML: Close empty tag with ' />' so it's XML and HTML compatible.
161151
// HTML: Empty tags are defined as such in DTD no in document.
162152
if (!elem.hasChildNodes() && isAllowedEmptyTag(tagName) && !requiresClosingTag(tagName))
163-
_printer.printText( "/>" );
164-
else
165-
_printer.printText( '>' );
153+
_printer.printText("/>");
154+
else _printer.printText('>');
166155
// After element but parent element is no longer empty.
167156
state.afterElement = true;
168157
state.empty = false;
169-
if ( isDocumentState() )
170-
_printer.flush();
158+
if (isDocumentState()) _printer.flush();
171159
}
172160
}
173161

@@ -185,11 +173,13 @@ public void endElementIO(String namespaceURI, String localName, String rawName)
185173
if (state.empty && isAllowedEmptyTag(rawName) && !requiresClosingTag(rawName)) { //
186174
_printer.printText("/>");
187175
} else {
188-
if(state.empty) _printer.printText('>');
176+
if (state.empty) _printer.printText('>');
189177
// This element is not empty and that last content was another element, so print a line break
190178
// before that last element and this element's closing tag. [keith] Provided this is not an
191179
// anchor. HTML: some elements do not print closing tag (e.g. LI)
192-
if (rawName == null || !HTMLdtd.isOnlyOpening(rawName) || HTMLdtd.isOptionalClosing(rawName)) {
180+
if (rawName == null
181+
|| !HTMLdtd.isOnlyOpening(rawName)
182+
|| HTMLdtd.isOptionalClosing(rawName)) {
193183
if (_indenting && !state.preserveSpace && state.afterElement) _printer.breakLine();
194184
// Must leave CData section first (Illegal in HTML, but still)
195185
if (state.inCData) _printer.printText("]]>");
@@ -230,6 +220,6 @@ private boolean requiresClosingTag(String tagName) {
230220
}
231221

232222
private boolean isAllowedEmptyTag(String tagName) {
233-
return "head".equals(tagName) || allowedEmptyTags.matches( tagName);
223+
return "head".equals(tagName) || allowedEmptyTags.matches(tagName);
234224
}
235225
}

src/test/java/org/owasp/validator/html/test/AntiSamyTest.java

+21-19
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,6 @@
6767
import org.owasp.validator.html.model.Property;
6868
import org.owasp.validator.html.model.Tag;
6969
import org.owasp.validator.html.scan.Constants;
70-
import org.owasp.validator.html.util.ErrorMessageUtil;
7170

7271
/**
7372
* This class tests AntiSamy functionality and the basic policy file which should be immune to XSS
@@ -1582,20 +1581,26 @@ public void validateParamAsEmbed() throws ScanException, PolicyException {
15821581
.cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
15831582

15841583
// let's start with a YouTube embed
1585-
String input = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
1586-
String expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"/><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\"/></object>";
1584+
String input =
1585+
"<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
1586+
String expectedOutput =
1587+
"<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"/><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\"/></object>";
15871588
CleanResults cr = as.scan(input, revised, AntiSamy.DOM);
15881589
assertThat(cr.getCleanHTML(), containsString(expectedOutput));
15891590

1590-
String saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"/><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"/></object>";
1591+
String saxExpectedOutput =
1592+
"<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"/><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"/></object>";
15911593
cr = as.scan(input, revised, AntiSamy.SAX);
15921594
assertThat(cr.getCleanHTML(), equalTo(saxExpectedOutput));
15931595

15941596
// now what if someone sticks malicious URL in the value of the
15951597
// value attribute in the param tag? remove that param tag
1596-
input = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://supermaliciouscode.com/badstuff.swf\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
1597-
expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\"/></object>";
1598-
saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"/></object>";
1598+
input =
1599+
"<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://supermaliciouscode.com/badstuff.swf\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
1600+
expectedOutput =
1601+
"<object height=\"340\" width=\"560\"><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\"/></object>";
1602+
saxExpectedOutput =
1603+
"<object width=\"560\" height=\"340\"><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"/></object>";
15991604
cr = as.scan(input, revised, AntiSamy.DOM);
16001605
assertThat(cr.getCleanHTML(), containsString(expectedOutput));
16011606

@@ -1604,9 +1609,12 @@ public void validateParamAsEmbed() throws ScanException, PolicyException {
16041609

16051610
// now what if someone sticks malicious URL in the value of the src
16061611
// attribute in the embed tag? remove that embed tag
1607-
input = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://hereswhereikeepbadcode.com/ohnoscary.swf\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
1608-
expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"/><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/></object>";
1609-
saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"/><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/></object>";
1612+
input =
1613+
"<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://hereswhereikeepbadcode.com/ohnoscary.swf\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
1614+
expectedOutput =
1615+
"<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"/><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/></object>";
1616+
saxExpectedOutput =
1617+
"<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"/><param name=\"allowFullScreen\" value=\"true\"/><param name=\"allowscriptaccess\" value=\"always\"/></object>";
16101618

16111619
cr = as.scan(input, revised, AntiSamy.DOM);
16121620
assertThat(cr.getCleanHTML(), containsString(expectedOutput));
@@ -1806,9 +1814,7 @@ public void testXSSInAntiSamy151() throws ScanException, PolicyException {
18061814
assertEquals(
18071815
"whatever<img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\"/>",
18081816
results_sax.getCleanHTML());
1809-
assertEquals(
1810-
results_sax.getCleanHTML(),
1811-
results_dom.getCleanHTML());
1817+
assertEquals(results_sax.getCleanHTML(), results_dom.getCleanHTML());
18121818
}
18131819

18141820
@Test
@@ -2716,11 +2722,7 @@ public void testGithubIssue484() throws ScanException, PolicyException {
27162722
CleanResults crSax = as.scan(s, policy, AntiSamy.SAX);
27172723
String domValue = crDom.getCleanHTML();
27182724
String saxValue = crSax.getCleanHTML();
2719-
assertEquals("<p>this is para data</p>\n"
2720-
+ "<br/>\n"
2721-
+ "<p>this is para data 2</p>", domValue);
2722-
assertEquals("<p>this is para data</p>\n"
2723-
+ "<br/>\n"
2724-
+ "<p>this is para data 2</p>", saxValue);
2725+
assertEquals("<p>this is para data</p>\n" + "<br/>\n" + "<p>this is para data 2</p>", domValue);
2726+
assertEquals("<p>this is para data</p>\n" + "<br/>\n" + "<p>this is para data 2</p>", saxValue);
27252727
}
27262728
}

0 commit comments

Comments
 (0)