Skip to content

Commit 3f446c5

Browse files
davewichersdavewichers
authored
Merge pull request #72 from nahsra/1.6.0
1.6.0
2 parents 31ee6eb + 2f1d2f0 commit 3f446c5

16 files changed

+850
-402
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,4 @@ target/
55
.classpath
66
.java-version
77

8+
antisamy.iml

‎README.md

+19-2
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ Chances are that your site’s use case for AntiSamy is at least roughly compara
2424

2525
Slashdot is a techie news site that allows users to respond anonymously to news posts with very limited HTML markup. Now, Slashdot is not only one of the coolest sites around, it’s also one that’s been subject to many different successful attacks. The rules for Slashdot are fairly strict: users can only submit the following HTML tags and no CSS: `<b>`, `<u>`, `<i>`, `<a>`, `<blockquote>`.
2626

27-
Accordingly, we’ve built a policy file that allows fairly similar functionality. All text-formatting tags that operate directly on the font, color or emphasis have been allowed.
27+
Accordingly, we’ve built a policy file that allows fairly similar functionality. All text-formatting tags that operate directly on the font, color, or emphasis have been allowed.
2828

2929
2) antisamy-ebay.xml
3030

31-
eBay is the most popular online auction site in the universe, as far as I can tell. It is a public site so anyone is allowed to post listings with rich HTML content. It’s not surprising that given the attractiveness of eBay as a target that it has been subject to a few complex XSS attacks. Listings are allowed to contain much more rich content than, say, Slashdot -- so it’s attack surface is considerably larger.
31+
eBay is the most popular online auction site in the universe, as far as I can tell. It is a public site so anyone is allowed to post listings with rich HTML content. It’s not surprising that given the attractiveness of eBay as a target that it has been subject to a few complex XSS attacks. Listings are allowed to contain much more rich content than, say, Slashdot -- so it’s attack surface is considerably larger.
3232

3333
3) antisamy-myspace.xml
3434

@@ -38,6 +38,18 @@ MySpace was, at the time this project was born, the most popular social networki
3838

3939
I don’t know of a possible use case for this policy file. If you wanted to allow every single valid HTML and CSS element (but without JavaScript or blatant CSS-related phishing attacks), you can use this policy file. Not even MySpace was this crazy. However, it does serve as a good reference because it contains base rules for every element, so you can use it as a knowledge base when using tailoring the other policy files.
4040

41+
### NOTE: Schema validation behavior change starting with AntiSamy 1.6.0
42+
43+
While working on some improvements to AntiSamy's XML Schema Definition (XSD) for AntiSamy policy files, we noticed that AntiSamy was NOT actually enforcing the XSD. So, we've CHANGED the default behavior starting with AntiSamy 1.6.0 to enforce the schema, and not continue if the AntiSamy policy is invalid. However ...
44+
45+
we recognize that it might not be possible for developers to fix their AntiSamy policies right away if they are non-compliant, and yet still want to upgrade AntiSamy to pick up any security improvements, feature enhancements, and bug fixes. As such, we've provided two ways to (temporarily!) disable schema validation:
46+
47+
1) Set the Java System property: owasp.validator.validateschema to false. This can be done at the command line (e.g., -Dowasp.validator.validateschema=false) or via the Java System properties file. Neither requires a code change.
48+
49+
2) Change the code using AntiSamy to invoke: Policy.setSchemaValidation(false) before loading the AntiSamy policy. This is a static call so once disabled, it is disabled for all new Policy instances.
50+
51+
To encourage AntiSamy users to only use XSD compliant policies, AntiSamy will always issue some type of warning when schema validation is disabled. It will either WARN that the policy is non-compliant so it can be fixed, or it will WARN that the policy is compliant, but schema validation is OFF, so validation should be turned back on (i.e., stop disabling it).
52+
4153
### 3. Tailoring the policy file
4254
You may want to deploy AntiSamy in a default configuration, but it’s equally likely that a site may want to have strict, business-driven rules for what users can allow. The discussion that decides the tailoring should also consider attack surface - which grows in relative proportion to the policy file.
4355

@@ -86,6 +98,11 @@ __Important Note__: There has been much confusion about the `getErrorMessages()`
8698

8799
The serialization and deserialization process that is critical to the effectiveness of the sanitizer is purposefully lossy and will filter out attacks via a number of attack vectors. Unfortunately, one of the tradeoffs of this strategy is that we don't always know in retrospect that an attack was seen. Thus, the `getErrorMessages()` API is there to help users understand their well-intentioned input meet the requirements of the system, not help a developer detect if an attack was present.
88100

101+
## Other Documentation
102+
103+
Additional documentation is available on this Github project's wiki page: https://github.com/nahsra/antisamy/wiki
104+
and the OWASP AntiSamy Project Page: https://owasp.org/www-project-antisamy/
105+
89106
## Contributing to AntiSamy
90107

91108
### Find an Issue?

‎SECURITY.md

+2-3
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ to dropping a 0-day on all applications using AntiSamy. Instead, we encourage
1313
responsible disclosure.
1414

1515
If you wish to be acknowledged for finding the vulnerability, then please follow
16-
this process. One of the project leaders will try to contact you within
17-
at least 5 business days.
16+
this process. One of the project leaders will try to contact you within 1-2 business days.
17+
1818
If you eventually wish to have it published as a CVE, we will also work with you
1919
to ensure that you are given proper credit with MITRE and NIST. Even if you do
2020
not wish to report the vulnerability as a CVE, we will acknowledge you when we
@@ -30,4 +30,3 @@ These are the known CVEs reported for AntiSamy:
3030

3131
* AntiSamy CVE #1 - CVE-2016-10006: XSS Bypass in AntiSamy before v1.5.5 - https://www.cvedetails.com/cve/CVE-2016-10006
3232
* AntiSamy CVE #2 - CVE-2017-14735: XSS via HTML5 Entities in AntiSamy before v1.5.7 - https://www.cvedetails.com/cve/CVE-2017-14735
33-

‎pom.xml

+64-24
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@
33
<groupId>org.owasp.antisamy</groupId>
44
<artifactId>antisamy</artifactId>
55
<packaging>jar</packaging>
6-
<version>1.5.13</version>
7-
6+
<version>1.6.0</version>
87
<distributionManagement>
98
<snapshotRepository>
109
<id>ossrh</id>
@@ -43,9 +42,10 @@
4342

4443
<properties>
4544
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
45+
<project.build.outputTimestamp>2021-05-03T17:04:00Z</project.build.outputTimestamp>
4646
<gpg.skip>true</gpg.skip><!-- by default skip gpg -->
4747
<version.spotbugs.maven>4.2.0</version.spotbugs.maven>
48-
<version.spotbugs>4.2.0</version.spotbugs>
48+
<version.spotbugs>4.2.2</version.spotbugs>
4949
</properties>
5050

5151
<profiles>
@@ -59,22 +59,9 @@
5959

6060
<dependencies>
6161
<dependency>
62-
<groupId>xml-apis</groupId>
63-
<artifactId>xml-apis</artifactId>
64-
<!-- Note that there is a 2.0.2 version of this, but it is actually much older than 1.4.01. -->
65-
<version>1.4.01</version>
66-
</dependency>
67-
<dependency>
68-
<groupId>org.apache.xmlgraphics</groupId>
69-
<artifactId>batik-css</artifactId>
70-
<version>1.13</version>
71-
<exclusions>
72-
<!-- exclude this as batik-css has a dependency that uses an older commons-logging and we want to eliminate the convergence mismatch -->
73-
<exclusion>
74-
<groupId>commons-logging</groupId>
75-
<artifactId>commons-logging</artifactId>
76-
</exclusion>
77-
</exclusions>
62+
<groupId>commons-codec</groupId>
63+
<artifactId>commons-codec</artifactId>
64+
<version>1.15</version>
7865
</dependency>
7966
<dependency>
8067
<groupId>net.sourceforge.nekohtml</groupId>
@@ -100,15 +87,48 @@
10087
</exclusion>
10188
</exclusions>
10289
</dependency>
90+
<dependency>
91+
<groupId>org.apache.logging.log4j</groupId>
92+
<artifactId>log4j-slf4j-impl</artifactId>
93+
<!-- 2.12.1 is the last release that supports Java 7, so we can't upgrade to newer versions. -->
94+
<version>2.12.1</version>
95+
<exclusions>
96+
<!-- exclude this as we've imported a newer version directly and want to eliminate the convergence mismatch -->
97+
<exclusion>
98+
<groupId>org.slf4j</groupId>
99+
<artifactId>slf4j-api</artifactId>
100+
</exclusion>
101+
</exclusions>
102+
</dependency>
103+
<dependency>
104+
<groupId>org.apache.xmlgraphics</groupId>
105+
<artifactId>batik-css</artifactId>
106+
<version>1.14</version>
107+
<exclusions>
108+
<!-- exclude this as batik-css has a dependency that uses an older commons-logging and we want to eliminate the convergence mismatch -->
109+
<exclusion>
110+
<groupId>commons-logging</groupId>
111+
<artifactId>commons-logging</artifactId>
112+
</exclusion>
113+
</exclusions>
114+
</dependency>
115+
<dependency>
116+
<groupId>org.slf4j</groupId>
117+
<artifactId>slf4j-api</artifactId>
118+
<version>1.7.30</version>
119+
</dependency>
120+
<!-- While Java 7+ includes Xerces in the JRE, it apparently doesn't provide all the features we use
121+
that are in the Apache version. So we import it directly. -->
103122
<dependency>
104123
<groupId>xerces</groupId>
105124
<artifactId>xercesImpl</artifactId>
106125
<version>2.12.1</version>
107126
</dependency>
108127
<dependency>
109-
<groupId>commons-codec</groupId>
110-
<artifactId>commons-codec</artifactId>
111-
<version>1.15</version>
128+
<groupId>xml-apis</groupId>
129+
<artifactId>xml-apis</artifactId>
130+
<!-- Note that there is a 2.0.2 version of this, but it is actually much older than 1.4.01. -->
131+
<version>1.4.01</version>
112132
</dependency>
113133

114134
<!-- SpotBugs dependencies -->
@@ -129,27 +149,43 @@
129149
<dependency>
130150
<groupId>junit</groupId>
131151
<artifactId>junit</artifactId>
132-
<version>4.13.1</version>
152+
<version>4.13.2</version>
133153
<scope>test</scope>
134154
</dependency>
135155

136156
</dependencies>
137157

138158
<build>
159+
139160
<pluginManagement>
140161
<plugins>
162+
<plugin>
163+
<groupId>org.apache.maven.plugins</groupId>
164+
<artifactId>maven-assembly-plugin</artifactId>
165+
<version>3.3.0</version>
166+
</plugin>
141167
<plugin>
142168
<groupId>org.apache.maven.plugins</groupId>
143169
<artifactId>maven-dependency-plugin</artifactId>
144170
<version>3.1.2</version>
145171
</plugin>
172+
<plugin>
173+
<groupId>org.apache.maven.plugins</groupId>
174+
<artifactId>maven-javadoc-plugin</artifactId>
175+
<version>3.2.0</version>
176+
<configuration>
177+
<!-- supports reproducibility of generated Javadocs -->
178+
<notimestamp>true</notimestamp>
179+
</configuration>
180+
</plugin>
146181
<plugin>
147182
<groupId>org.apache.maven.plugins</groupId>
148183
<artifactId>maven-release-plugin</artifactId>
149184
<version>3.0.0-M1</version>
150185
</plugin>
151186
</plugins>
152187
</pluginManagement>
188+
153189
<plugins>
154190
<plugin>
155191
<groupId>org.apache.maven.plugins</groupId>
@@ -249,7 +285,6 @@
249285
<plugin>
250286
<groupId>org.apache.maven.plugins</groupId>
251287
<artifactId>maven-javadoc-plugin</artifactId>
252-
<version>3.2.0</version>
253288
<executions>
254289
<execution>
255290
<id>attach-javadocs</id>
@@ -285,6 +320,11 @@
285320
<artifactId>maven-surefire-plugin</artifactId>
286321
<version>3.0.0-M5</version>
287322
</plugin>
323+
<plugin>
324+
<groupId>org.cyclonedx</groupId>
325+
<artifactId>cyclonedx-maven-plugin</artifactId>
326+
<version>2.3.0</version>
327+
</plugin>
288328
<plugin>
289329
<groupId>com.github.spotbugs</groupId>
290330
<artifactId>spotbugs-maven-plugin</artifactId>

0 commit comments

Comments
 (0)