From b635ecf29c93c2b4e8923c8e33f9c163c6124b5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Wed, 2 Feb 2022 20:12:42 -0300
Subject: [PATCH 01/36] Add constants for two directives names

---
 src/main/java/org/owasp/validator/html/Policy.java | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/main/java/org/owasp/validator/html/Policy.java b/src/main/java/org/owasp/validator/html/Policy.java
index 42b90c08..64f1353a 100644
--- a/src/main/java/org/owasp/validator/html/Policy.java
+++ b/src/main/java/org/owasp/validator/html/Policy.java
@@ -144,6 +144,8 @@ public class Policy {
     public static final String PRESERVE_COMMENTS = "preserveComments";
     public static final String ENTITY_ENCODE_INTL_CHARS = "entityEncodeIntlChars";
     public static final String ALLOW_DYNAMIC_ATTRIBUTES = "allowDynamicAttributes";
+    public static final String MAX_INPUT_SIZE = "maxInputSize";
+    public static final String MAX_STYLESHEET_IMPORTS = "maxStyleSheetImports";
 
     public static final String EXTERNAL_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities";
     public static final String EXTERNAL_PARAM_ENTITIES = "http://xml.org/sax/features/external-parameter-entities";

From 01a27b266c4a09f9ddff07de31f984a12dfdbd04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Wed, 2 Feb 2022 20:13:32 -0300
Subject: [PATCH 02/36] Add tests to improve coverage

CssScannerTest is a new class for specific test cases on CssScanner.
---
 .../owasp/validator/css/CssScannerTest.java   | 122 ++++++++++++++++++
 .../validator/html/test/AntiSamyTest.java     |  26 ++++
 2 files changed, 148 insertions(+)
 create mode 100644 src/test/java/org/owasp/validator/css/CssScannerTest.java

diff --git a/src/test/java/org/owasp/validator/css/CssScannerTest.java b/src/test/java/org/owasp/validator/css/CssScannerTest.java
new file mode 100644
index 00000000..0473ae43
--- /dev/null
+++ b/src/test/java/org/owasp/validator/css/CssScannerTest.java
@@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li, Sebastián Passaro
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this list
+ * of conditions and the following disclaimer.  Redistributions in binary form must
+ * reproduce the above copyright notice, this list of conditions and the following
+ * disclaimer in the documentation and/or other materials provided with the distribution.
+ * Neither the name of OWASP nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+package org.owasp.validator.css;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.owasp.validator.html.*;
+import org.owasp.validator.html.scan.Constants;
+import org.owasp.validator.html.test.TestPolicy;
+
+import java.net.URL;
+import java.util.Locale;
+import java.util.MissingResourceException;
+import java.util.ResourceBundle;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.CoreMatchers.not;
+import static org.hamcrest.MatcherAssert.assertThat;
+
+public class CssScannerTest {
+    private TestPolicy policy = null;
+    private ResourceBundle messages = null;
+
+    @Before
+    public void setUp() throws Exception {
+        // Load the policy. You may have to change the path to find the Policy file for your environment.
+        URL url = getClass().getResource("/antisamy.xml");
+        policy = TestPolicy.getInstance(url);
+        // Load resource bundle
+        try {
+            messages = ResourceBundle.getBundle("AntiSamy", Locale.getDefault());
+        } catch (MissingResourceException mre) {
+            messages =  ResourceBundle.getBundle("AntiSamy", new Locale(Constants.DEFAULT_LOCALE_LANG,
+                    Constants.DEFAULT_LOCALE_LOC));
+        }
+    }
+
+    @Test
+    public void testAvoidImportingStyles() throws ScanException {
+        final String input = "@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/classic.css);\n" +
+                ".very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}";
+        // If not passing "shouldParseImportedStyles" then it's false by default.
+        CssScanner scanner = new CssScanner(policy, messages);
+        String result = scanner.scanStyleSheet(input, 1000).getCleanHTML();
+        // If style sheet was imported, .grid_1 class should be there.
+        assertThat(result, not(containsString(".grid_1")));
+        assertThat(result, containsString(".very-specific-antisamy"));
+    }
+
+    @Test
+    public void testAvoidCdataWhenUsingXhtml() throws ScanException {
+        final String input = "<![CDATA[.very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}]]>";
+
+        TestPolicy revised = policy.cloneWithDirective(Policy.USE_XHTML,"true");
+        CssScanner scanner = new CssScanner(revised, messages);
+        assertThat(scanner.scanStyleSheet(input, 1000).getCleanHTML(), not(containsString("CDATA")));
+
+        revised = policy.cloneWithDirective(Policy.USE_XHTML,"false");
+        scanner = new CssScanner(revised, messages);
+        assertThat(scanner.scanStyleSheet(input, 1000).getCleanHTML(), containsString("CDATA"));
+    }
+
+    @Test
+    public void testImportLimiting() throws ScanException {
+        final String input = "@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/classic.css);\n" +
+                "@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/providers.css);\n" +
+                ".very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}";
+        TestPolicy revised = policy.cloneWithDirective(Policy.EMBED_STYLESHEETS,"true")
+                .cloneWithDirective(Policy.MAX_INPUT_SIZE,"500")
+                .cloneWithDirective(Policy.MAX_STYLESHEET_IMPORTS,"2");
+        CssScanner scanner = new CssScanner(revised, messages, true);
+        CleanResults result = scanner.scanStyleSheet(input, 500);
+        // Both sheets are larger than 500 bytes
+        assertThat(result.getErrorMessages().size(), is(2));
+        assertThat(result.getErrorMessages().get(0), containsString("500"));
+
+        // Limit to only one import
+        revised = policy.cloneWithDirective(Policy.EMBED_STYLESHEETS,"true")
+                .cloneWithDirective(Policy.MAX_STYLESHEET_IMPORTS,"1");
+        scanner = new CssScanner(revised, messages, true);
+        result = scanner.scanStyleSheet(input, 500000);
+        // If only first style sheet was imported, .grid_1 class should be there and .janrain-provider150-sprit classes should not.
+        assertThat(result.getCleanHTML(), containsString(".grid_1"));
+        assertThat(result.getCleanHTML(), not(containsString(".janrain-provider150-sprit")));
+
+        // Force timeout errors
+        revised = policy.cloneWithDirective(Policy.EMBED_STYLESHEETS,"true")
+                .cloneWithDirective(Policy.CONNECTION_TIMEOUT,"1");
+        scanner = new CssScanner(revised, messages, true);
+        result = scanner.scanStyleSheet(input, 500000);
+        assertThat(result.getErrorMessages().size(), is(2));
+        // If style sheets were imported, .grid_1 and .janrain-provider150-sprit classes should be there.
+        assertThat(result.getCleanHTML(), not(containsString(".grid_1")));
+        assertThat(result.getCleanHTML(), not(containsString(".janrain-provider150-sprit")));
+    }
+}
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index e15a2bc7..cca9d8d2 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -44,11 +44,13 @@
 import org.junit.Before;
 import org.junit.Test;
 
+import java.io.File;
 import java.io.IOException;
 import java.io.Reader;
 import java.io.StringReader;
 import java.io.StringWriter;
 import java.io.Writer;
+import java.net.URISyntaxException;
 import java.net.URL;
 import java.util.Arrays;
 import java.util.Collections;
@@ -1662,5 +1664,29 @@ public void testLeadingDashOnPropertyName() throws ScanException, PolicyExceptio
         assertThat(as.scan(input, revised, AntiSamy.DOM).getCleanHTML(), both(containsString("-webkit-border-radius")).and(containsString("-moz-border-radius")));
         assertThat(as.scan(input, revised, AntiSamy.SAX).getCleanHTML(), both(containsString("-webkit-border-radius")).and(containsString("-moz-border-radius")));
     }
+
+    @Test
+    public void testScansWithDifferentPolicyLoading() throws ScanException, PolicyException, URISyntaxException {
+        final String input = "<span>text</span>";
+        // Preload policy, do not specify scan type.
+        AntiSamy asInstance = new AntiSamy(policy);
+        assertThat(asInstance.scan(input).getCleanHTML(), is(input));
+        // Pass policy, assume DOM scan type.
+        assertThat(asInstance.scan(input, policy).getCleanHTML(), is(input));
+        // Pass policy as File.
+        File policyFile = new File(getClass().getResource("/antisamy.xml").toURI());
+        assertThat(asInstance.scan(input, policyFile).getCleanHTML(), is(input));
+        // Pass policy filename.
+        String path = getClass().getResource("/antisamy.xml").getPath();
+        path = System.getProperty("file.separator").equals("\\") && path.startsWith("/") ? path.substring(1) : path;
+        assertThat(asInstance.scan(input, path).getCleanHTML(), is(input));
+        // No preloaded nor passed policy, expected to fail.
+        try {
+            as.scan(input, null, AntiSamy.DOM);
+            fail("Scan with no policy must have thrown an exception.");
+        } catch (PolicyException e) {
+            // An error is expected. Pass.
+        }
+    }
 }
 

From 78e77ae1376d68b0029b6ccb2193b3e5ca398b0b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 7 Feb 2022 05:03:51 +0000
Subject: [PATCH 03/36] Bump maven-project-info-reports-plugin from 3.1.2 to
 3.2.1

Bumps [maven-project-info-reports-plugin](https://github.com/apache/maven-project-info-reports-plugin) from 3.1.2 to 3.2.1.
- [Release notes](https://github.com/apache/maven-project-info-reports-plugin/releases)
- [Commits](https://github.com/apache/maven-project-info-reports-plugin/compare/maven-project-info-reports-plugin-3.1.2...maven-project-info-reports-plugin-3.2.1)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-project-info-reports-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index aea7a118..26c6358c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -496,7 +496,7 @@
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
-               <version>3.1.2</version>
+               <version>3.2.1</version>
                <reportSets>
                  <reportSet>
                    <reports>

From 6752ca927fc80e7efd6f5fb152ea067fa6d89692 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 9 Feb 2022 05:03:26 +0000
Subject: [PATCH 04/36] Bump version.slf4j from 1.7.35 to 1.7.36

Bumps `version.slf4j` from 1.7.35 to 1.7.36.

Updates `slf4j-api` from 1.7.35 to 1.7.36
- [Release notes](https://github.com/qos-ch/slf4j/releases)
- [Commits](https://github.com/qos-ch/slf4j/compare/v_1.7.35...v_1.7.36)

Updates `jcl-over-slf4j` from 1.7.35 to 1.7.36
- [Release notes](https://github.com/qos-ch/slf4j/releases)
- [Commits](https://github.com/qos-ch/slf4j/compare/v_1.7.35...v_1.7.36)

Updates `slf4j-simple` from 1.7.35 to 1.7.36
- [Release notes](https://github.com/qos-ch/slf4j/releases)
- [Commits](https://github.com/qos-ch/slf4j/compare/v_1.7.35...v_1.7.36)

---
updated-dependencies:
- dependency-name: org.slf4j:slf4j-api
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.slf4j:jcl-over-slf4j
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: org.slf4j:slf4j-simple
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index aea7a118..ee8e4099 100644
--- a/pom.xml
+++ b/pom.xml
@@ -46,7 +46,7 @@
         <gpg.skip>true</gpg.skip><!-- by default skip gpg -->
         <!--  The latest commons-io is 2.11.0, but requires Java 8 starting with 2.7 -->
         <version.io>2.6</version.io>
-        <version.slf4j>1.7.35</version.slf4j>
+        <version.slf4j>1.7.36</version.slf4j>
         <version.spotbugs.maven>4.5.3.0</version.spotbugs.maven>
         <version.spotbugs>4.5.3</version.spotbugs>
     </properties>

From 988134d26a3c16a09b4e3e4e83cfe063428b4e8d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 14 Feb 2022 05:04:33 +0000
Subject: [PATCH 05/36] Bump maven-javadoc-plugin from 3.3.1 to 3.3.2

Bumps [maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) from 3.3.1 to 3.3.2.
- [Release notes](https://github.com/apache/maven-javadoc-plugin/releases)
- [Commits](https://github.com/apache/maven-javadoc-plugin/compare/maven-javadoc-plugin-3.3.1...maven-javadoc-plugin-3.3.2)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-javadoc-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index aea7a118..390af230 100644
--- a/pom.xml
+++ b/pom.xml
@@ -218,7 +218,7 @@
                <plugin>
                   <groupId>org.apache.maven.plugins</groupId>
                   <artifactId>maven-javadoc-plugin</artifactId>
-                  <version>3.3.1</version>
+                  <version>3.3.2</version>
                   <configuration>
                      <!-- supports reproducibility of generated Javadocs -->
                      <notimestamp>true</notimestamp>

From 36fe73fe89b0580c21d1a2aacd50bf7a0b91acf8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 15 Feb 2022 05:03:20 +0000
Subject: [PATCH 06/36] Bump maven-compiler-plugin from 3.9.0 to 3.10.0

Bumps [maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) from 3.9.0 to 3.10.0.
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](https://github.com/apache/maven-compiler-plugin/compare/maven-compiler-plugin-3.9.0...maven-compiler-plugin-3.10.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index aea7a118..0394356f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -241,7 +241,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.9.0</version>
+                <version>3.10.0</version>
                 <configuration>
                     <source>1.7</source>
                     <target>1.7</target>

From c11fdb04238029e865497a5f25a6233d8a67be35 Mon Sep 17 00:00:00 2001
From: Dave Wichers <dwichers@gmail.com>
Date: Tue, 15 Feb 2022 21:11:59 -0500
Subject: [PATCH 07/36] Change Java targets to Java 8, and upgrade 1 dependency
 that requires Java 8. Remove all @Deprecated methods, all uses of such
 methods, including the test cases.

---
 pom.xml                                       |  26 ++-
 .../org/owasp/validator/css/CssHandler.java   |  25 +--
 .../java/org/owasp/validator/html/Policy.java | 160 +++---------------
 .../test/AntiSamyMalformedPolicyTest.java     |  33 +---
 .../html/test/ESAPIInvalidPolicyTest.java     |  85 +---------
 .../owasp/validator/html/test/PolicyTest.java | 116 +------------
 6 files changed, 51 insertions(+), 394 deletions(-)

diff --git a/pom.xml b/pom.xml
index de87a0ec..40645b71 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
     <groupId>org.owasp.antisamy</groupId>
     <artifactId>antisamy</artifactId>
     <packaging>jar</packaging>
-    <version>1.6.5</version>
+    <version>1.7.0-dev</version>
     <distributionManagement>
         <snapshotRepository>
             <id>ossrh</id>
@@ -42,10 +42,9 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <project.build.outputTimestamp>2022-01-31T23:13:00Z</project.build.outputTimestamp>
+        <project.build.outputTimestamp>2022-02-30T14:33:00Z</project.build.outputTimestamp>
         <gpg.skip>true</gpg.skip><!-- by default skip gpg -->
-        <!--  The latest commons-io is 2.11.0, but requires Java 8 starting with 2.7 -->
-        <version.io>2.6</version.io>
+        <version.io>2.11.0</version.io>
         <version.slf4j>1.7.36</version.slf4j>
         <version.spotbugs.maven>4.5.3.0</version.spotbugs.maven>
         <version.spotbugs>4.5.3</version.spotbugs>
@@ -243,10 +242,10 @@
                 <artifactId>maven-compiler-plugin</artifactId>
                 <version>3.10.0</version>
                 <configuration>
-                    <source>1.7</source>
-                    <target>1.7</target>
-                    <testSource>1.7</testSource>
-                    <testTarget>1.7</testTarget>
+                    <source>1.8</source>
+                    <target>1.8</target>
+                    <testSource>1.8</testSource>
+                    <testTarget>1.8</testTarget>
                     <compilerArgument>-Xlint:unchecked</compilerArgument>
                 </configuration>
             </plugin>
@@ -258,7 +257,6 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-enforcer-plugin</artifactId>
-                <!-- Note that this plugin version and the specified dependency require Java 8-->
                 <version>3.0.0</version>
                 <dependencies>
                     <dependency>
@@ -274,10 +272,10 @@
                         <configuration>
                             <rules>
                                 <enforceBytecodeVersion>
-                                    <maxJdkVersion>1.7</maxJdkVersion>
+                                    <maxJdkVersion>1.8</maxJdkVersion>
                                     <ignoreOptionals>true</ignoreOptionals>
                                     <ignoredScopes>test</ignoredScopes>
-                                    <message>Dependencies shouldn't require Java 8+.</message>
+                                    <message>Dependencies shouldn't require Java 9+.</message>
                                 </enforceBytecodeVersion>
                                 <requireMavenVersion>
                                     <version>3.3.9</version>
@@ -292,8 +290,8 @@
                         <configuration>
                             <rules>
                                 <requireJavaVersion>
-                                    <version>1.7</version>
-                                    <message>Antisamy is written to support Java 7+.</message>
+                                    <version>1.8</version>
+                                    <message>Antisamy is written to support Java 8+.</message>
                                 </requireJavaVersion>
                             </rules>
                         </configuration>
@@ -483,7 +481,7 @@
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <configuration>
-                   <targetJdk>1.7</targetJdk>
+                   <targetJdk>1.8</targetJdk>
                    <sourceEncoding>utf-8</sourceEncoding>
                    <!-- excludeFromFailureFile>exclude-pmd.properties</excludeFromFailureFile -->
                </configuration>
diff --git a/src/main/java/org/owasp/validator/css/CssHandler.java b/src/main/java/org/owasp/validator/css/CssHandler.java
index a6081a82..8341516d 100644
--- a/src/main/java/org/owasp/validator/css/CssHandler.java
+++ b/src/main/java/org/owasp/validator/css/CssHandler.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
@@ -114,29 +114,6 @@ public class CssHandler implements DocumentHandler {
 	 */
 	private boolean selectorOpen = false;
 
-	/**
-	 * Constructs a handler for stylesheets using the given policy and queue for
-	 * imported stylesheets.
-	 * 
-	 * @param policy
-	 *            the policy to use
-	 * @param embeddedStyleSheets
-	 *            the queue of stylesheets imported
-	 * @param errorMessages
-	 *            the List of error messages to add error messages too if there are errors
-	 * @param messages
-	 *            the error message bundle to pull from
-	 *
-	 * @deprecated The embeddedStyleSheets List parameter is removed in the newer version of
-	 * this constructor as the handler has its own internal list that can be accessed through
-	 * the getImportedStylesheetsURIList() method.
-	 */
-	@Deprecated
-	public CssHandler(Policy policy, LinkedList<URI> embeddedStyleSheets,
-					  List<String> errorMessages, ResourceBundle messages) {
-		this(policy, embeddedStyleSheets, errorMessages, null, messages);
-	}
-
 	/**
 	 * Constructs a handler for stylesheets using the given policy. The List of embedded stylesheets
 	 * produced by this constructor is now available via the getImportedStylesheetsURIList() method.
diff --git a/src/main/java/org/owasp/validator/html/Policy.java b/src/main/java/org/owasp/validator/html/Policy.java
index 42b90c08..33a6538f 100644
--- a/src/main/java/org/owasp/validator/html/Policy.java
+++ b/src/main/java/org/owasp/validator/html/Policy.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li, Kristian Rosenvold
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li, Kristian Rosenvold
  *
  * All rights reserved.
  *
@@ -80,40 +80,16 @@
  * 
  * <p>## Schema validation behavior change starting with AntiSamy 1.6.0 ##</p>
  * 
- * <p>Prior to v1.6.0 AntiSamy was not actually enforcing it's defined XSD. Now, by default AntiSamy enforce the schema,
- * and won't continue if the AntiSamy policy is invalid. However, we recognize that it might not be possible for
- * developers to fix their AntiSamy policies right away if they are non-compliant, and yet still want to upgrade
- * AntiSamy to pick up any security improvements, feature enhancements, and bug fixes. As such, we now provide two
- * ways to (temporarily!) disable schema validation:</p>
- *
- * <p>1) Set the Java System property: owasp.validator.validateschema to false. This can be done at the command line
- * (e.g., -Dowasp.validator.validateschema=false) or via the Java System properties file. Neither requires a code
- * change.</p>
- * 
- * <p>2) Change the code using AntiSamy to invoke: Policy.setSchemaValidation(false) before loading the AntiSamy policy.
- * This is a static call so once disabled, it is disabled for all new Policy instances.</p>
- * 
- * <p>To encourage AntiSamy users to only use XSD compliant policies, AntiSamy will always log some type of warning
- * when schema validation is disabled. It will either WARN that the policy is non-compliant so it can be fixed, or
- * it will WARN that the policy is compliant, but schema validation is OFF, so validation should be turned back on
- * (i.e., stop disabling it). We also added INFO level logging when AntiSamy schema's are loaded and validated.</p>
- * 
- * <p>## Disabling schema validation is <b>deprecated immediately</b>, and will go away in AntiSamy 1.7+ ##</p>
- * 
- * <p>The ability to disable the new schema validation feature is intended to be temporary, to smooth the transition to
- * properly valid AntiSamy policy files. We plan to drop this feature in the next major release. We estimate that
- * this will be some time mid-late 2022, so not any time soon. The idea is to give dev teams using AntiSamy directly,
- * or through other libraries like ESAPI, plenty of time to get their policy files schema compliant before schema
- * validation becomes required.</p>
+ * <p>Prior to v1.6.0 AntiSamy was not actually enforcing it's defined XSD. For all of v1.6.x, by default AntiSamy
+ * enforced the schema, and wouldn't continue if the AntiSamy policy was invalid. However, we recognized that it might
+ * not be possible for developers to fix their AntiSamy policies right away so we provided two
+ * ways to (temporarily!) disable schema validation. Via a direct method call and via a System property.</p>
  * 
- * <p>Logging: The logging introduced in 1.6+ uses slf4j. AntiSamy includes the slf4j-simple library for its logging,
- * but AntiSamy users can import and use an alternate slf4j compatible logging library if they prefer. They can also
- * then exclude slf4j-simple if they want to.</p>
+ * <p>## Starting with AntiSamy 1.7.0, schema validation is Mandatory.</p>
  * 
- * <p><b>WARNING:</b>: AntiSamy's use of slf4j-simple, without any configuration file, logs messages in a buffered
- * manner to standard output. As such, some or all of these log messages may get lost if an Exception, such as a
- * PolicyException is thrown. This can likely be rectified by configuring slf4j-simple to log to standard error
- * instead, or use an alternate slf4j logger that does so.</p>
+ * <p>Logging: The logging introduced in 1.6+ uses slf4j. But AntiSamy doesn't actually include an slf4j implementation
+ * library. AntiSamy users must import and properly configure an slf4j logging library if they want to see the very
+ * few log messages generated by AntiSamy.</p>
  * 
  * @author Arshan Dabirsiaghi
  */
@@ -168,25 +144,6 @@ public class Policy {
      * XML Schema for policy validation
      */
     private static volatile Schema schema = null;
-    private static boolean validateSchema = true; // Default is to validate schemas
-    public static final String VALIDATIONPROPERTY = "owasp.validator.validateschema";
-
-	// Support the ability to change the default schema validation behavior by setting the
-	// System property "owasp.antisamy.validateschema".
-    static {
-        loadValidateSchemaProperty();
-    }
-
-    // encapsulated to be simulated from test cases
-    private static void loadValidateSchemaProperty() {
-        String validateProperty = System.getProperty(VALIDATIONPROPERTY);
-        if (validateProperty != null) {
-            setSchemaValidation(Boolean.parseBoolean(validateProperty));
-            logger.warn("Setting AntiSamy policy schema validation to '" + getSchemaValidation() + "' because '"
-                    + VALIDATIONPROPERTY + "' system property set to: '" + validateProperty
-                    + "'. Note: this feature is temporary and will go away in AntiSamy v1.7.0 (~mid/late 2022) when validation will become mandatory.");
-        } else validateSchema = true; // default (or back to default if invoked multiple times during testing)
-    }
 
     /**
      * Get the Tag specified by the provided tag name.
@@ -227,33 +184,6 @@ public Property getPropertyByName(String propertyName) {
         return cssRules.get(propertyName.toLowerCase());
     }
 
-    /**
-     * Is XSD schema validation across all policies enabled or not? It is enabled by default.
-     *
-     * @return True if schema validation enabled. False otherwise.
-     *
-     * @deprecated Temporary method to enable AntiSamy users to upgrade to 1.6.x while still using policy files that aren't 
-     * schema compliant. AntiSamy plans to make schema validation mandatory starting with v1.7.0 (~mid/late 2022).
-     */
-    @Deprecated
-    public static boolean getSchemaValidation() {
-        return validateSchema;
-    }
-
-    /**
-     * This can enable/disable the schema validation against AntiSamy XSD for the instantiated
-     * policies. It is enabled by default.
-     *
-     * @param enable boolean value to specify if the schema validation should be performed. Use false to disable.
-     *
-     * @deprecated Temporary method to enable AntiSamy users to upgrade to 1.6.x while still using policy files that aren't 
-     * schema compliant. AntiSamy plans to make schema validation mandatory starting with v1.7.0 (~mid/late 2022).
-     */
-    @Deprecated
-    public static void setSchemaValidation(boolean enable) {
-        validateSchema = enable;
-    }
-
     /**
      * Construct a Policy using the default policy file location ("antisamy.xml").
      *
@@ -284,10 +214,7 @@ public static Policy getInstance(String filename) throws PolicyException {
      * @throws PolicyException If there is a problem parsing the input stream.
      */
     public static Policy getInstance(InputStream inputStream) throws PolicyException {
-        final String logMsg = "Attempting to load AntiSamy policy from an input stream.";
-        // If schema validation is disabled, we elevate this msg to the warn level to match the
-        // level of the mandatory warning that will follow. We do the same below.
-        if (validateSchema) logger.info(logMsg); else logger.warn(logMsg);
+        logger.info("Attempting to load AntiSamy policy from an input stream.");
         return new InternalPolicy(getSimpleParseContext(getTopLevelElement(inputStream)));
     }
 
@@ -325,8 +252,7 @@ public static Policy getInstance(File file) throws PolicyException {
      * @throws PolicyException If the file is not found or there is a problem parsing the file.
      */
     public static Policy getInstance(URL url) throws PolicyException {
-        String logMsg = "Attempting to load AntiSamy policy from URL: " + url.toString();
-        if (validateSchema) logger.info(logMsg); else logger.warn(logMsg);
+        logger.info("Attempting to load AntiSamy policy from URL: " + url.toString());
         return new InternalPolicy(getParseContext(getTopLevelElement(url), url));
     }
 
@@ -426,30 +352,10 @@ public InputSource call() throws IOException {
 
     protected static Element getTopLevelElement(InputSource source, Callable<InputSource> getResetSource) throws PolicyException {
         // Track whether an exception was ever thrown while processing policy file
-        Exception thrownException = null;
         try {
             return getDocumentElementFromSource(source, true);
-        } catch (SAXException e) {
-            thrownException = e;
-            if (!validateSchema) {
-                try {
-                    source = getResetSource.call();
-                    Element theElement = getDocumentElementFromSource(source, false);
-                    // We warn when the policy has an invalid schema, but schema validation is disabled.
-                    logger.warn("Invalid AntiSamy policy file: " + e.getMessage());
-                    return theElement;
-                } catch (Exception e2) {
-                    throw new PolicyException(e2);
-                }
-            } else throw new PolicyException(e);
-        } catch (ParserConfigurationException | IOException e) {
-            thrownException = e;
+        } catch (SAXException | ParserConfigurationException | IOException e) {
             throw new PolicyException(e);
-        } finally {
-            if (!validateSchema && thrownException == null) {
-                // We warn when the policy has a valid schema, but schema validation is disabled.
-                logger.warn("XML schema validation is disabled for a valid AntiSamy policy. Please reenable policy validation.");
-            }
         }
     }
 
@@ -529,38 +435,17 @@ private static void parsePolicy(Element topLevelElement, ParseContext parseConte
           + "a vulnerability because only local file URLs are allowed.")
     private static Element getPolicy(String href, URL baseUrl) throws PolicyException {
         // Track whether an exception was ever thrown while processing policy file
-        Exception thrownException = null;
         try {
-            return getDocumentElementByUrl(href, baseUrl, true);
-        } catch (SAXException e) {
-            thrownException = e;
-            if (!validateSchema) {
-                try {
-                    Element theElement = getDocumentElementByUrl(href, baseUrl, false);
-                    // We warn when the policy has an invalid schema, but schema validation is disabled.
-                    logger.warn("Invalid AntiSamy policy file: " + e.getMessage());
-                    return theElement;
-                } catch (SAXException | ParserConfigurationException | IOException e2) {
-                    throw new PolicyException(e2);
-                }
-            } else {
-                throw new PolicyException(e);
-            }
-        } catch (ParserConfigurationException | IOException e) {
-            thrownException = e;
+            return getDocumentElementByUrl(href, baseUrl);
+        } catch (SAXException | ParserConfigurationException | IOException e) {
             throw new PolicyException(e);
-        } finally {
-            if (!validateSchema && thrownException == null) {
-                // We warn when the policy has a valid schema, but schema validation is disabled.
-                logger.warn("XML schema validation is disabled for a valid AntiSamy policy. Please reenable policy validation.");
-            }
         }
     }
 
     // TODO: Add JavaDocs for this new method.
     @SuppressFBWarnings(value = "SECURITY", justification="Opening a stream to the provided URL is not "
             + "a vulnerability because only local file URLs are allowed.")
-    private static Element getDocumentElementByUrl(String href, URL baseUrl, boolean schemaValidationEnabled)
+    private static Element getDocumentElementByUrl(String href, URL baseUrl)
             throws IOException, ParserConfigurationException, SAXException {
 
         InputSource source = null;
@@ -575,8 +460,7 @@ private static Element getDocumentElementByUrl(String href, URL baseUrl, boolean
 
             try {
                 url = new URL(baseUrl, href);
-                final String logMsg = "Attempting to load AntiSamy policy from URL: " + url.toString();
-                if (validateSchema) logger.info(logMsg); else logger.warn(logMsg);
+                logger.info("Attempting to load AntiSamy policy from URL: " + url.toString());
                 source = new InputSource(url.openStream());
                 source.setSystemId(href);
             } catch (MalformedURLException | FileNotFoundException e) {
@@ -603,13 +487,11 @@ private static Element getDocumentElementByUrl(String href, URL baseUrl, boolean
         dbf.setFeature(DISALLOW_DOCTYPE_DECL, true);
         dbf.setFeature(LOAD_EXTERNAL_DTD, false);
 
-        // This code doesn't have the retry logic if schema validation fails because schemaValidationEnabled is
-        // passed in. It is up to the caller to try again, if this fails the first time (if they want to).
-        if (schemaValidationEnabled) {
-            getPolicySchema();
-            dbf.setNamespaceAware(true);
-            dbf.setSchema(schema);
-        }
+        // This code doesn't have the retry logic if schema validation fails. It is up to the caller to try again,
+        // if this fails the first time (if they want to).
+        getPolicySchema();
+        dbf.setNamespaceAware(true);
+        dbf.setSchema(schema);
 
         DocumentBuilder db = dbf.newDocumentBuilder();
         db.setErrorHandler(new SAXErrorHandler());
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyMalformedPolicyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyMalformedPolicyTest.java
index 98e345d6..90dbddd4 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyMalformedPolicyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyMalformedPolicyTest.java
@@ -14,50 +14,25 @@
 public class AntiSamyMalformedPolicyTest {
 
     @Test
-    public void testDirectConfigMalformedValidationOn() throws Exception {
-        Policy.setSchemaValidation(false);
+    public void testDirectConfigMalformed() throws Exception {
         InputStream stream = AntiSamyMalformedPolicyTest.class.getResourceAsStream("/invalidPolicyMalformedXml.xml");
         try {
             Policy.getInstance(stream);
-            fail("For Malformed XML, PolicyException expected whether schema validation is enabled or not.");
-        } catch (PolicyException e) {
-			// This is expected, so do nothing. Any other kind of exception is a failed test case.
-        }
-    }
-
-    @Test
-    public void testDirectConfigMalformedValidationOff() throws Exception {
-        Policy.setSchemaValidation(true);
-        InputStream stream = AntiSamyMalformedPolicyTest.class.getResourceAsStream("/invalidPolicyMalformedXml.xml");
-        try {
-            Policy.getInstance(stream);
-            fail("For Malformed XML, PolicyException expected whether schema validation is enabled or not.");
+            fail("For Malformed XML, PolicyException expected.");
         } catch (PolicyException e) {
 			// This is expected, so do nothing. Any other kind of exception is a failed test case.
         }
     }
     
 	@Test
-	public void testDirectConfigAsBaisMalformedValidationOn() throws Exception {
-		Policy.setSchemaValidation(true);
+	public void testDirectConfigAsBaisMalformed() throws Exception {
 		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/invalidPolicyMalformedXml.xml");
 		try {
 			Policy.getInstance(ESAPIInvalidPolicyTest.toByteArrayStream(stream));
-            fail("For Malformed XML, PolicyException expected whether schema validation is enabled or not.");
+            fail("For Malformed XML, PolicyException expected.");
         } catch (PolicyException e) {
 			// This is expected, so do nothing. Any other kind of exception is a failed test case.
 		}
 	}
 
-	@Test
-	public void testDirectConfigAsBaisMalformedValidationOff() throws Exception {
-		Policy.setSchemaValidation(false);
-		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/invalidPolicyMalformedXml.xml");
-		try {
-			Policy.getInstance(ESAPIInvalidPolicyTest.toByteArrayStream(stream));
-            fail("For Malformed XML, PolicyException expected whether schema validation is enabled or not.");
-        } catch (PolicyException e) {
-			// This is expected, so do nothing. Any other kind of exception is a failed test case.
-		}
-	}
 }
diff --git a/src/test/java/org/owasp/validator/html/test/ESAPIInvalidPolicyTest.java b/src/test/java/org/owasp/validator/html/test/ESAPIInvalidPolicyTest.java
index 33ee27b2..a06d66fc 100644
--- a/src/test/java/org/owasp/validator/html/test/ESAPIInvalidPolicyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/ESAPIInvalidPolicyTest.java
@@ -4,10 +4,7 @@
 import java.io.ByteArrayOutputStream;
 import java.io.InputStream;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
-import org.junit.After;
 import org.junit.Test;
 
 import org.owasp.validator.html.Policy;
@@ -15,102 +12,28 @@
 
 public class ESAPIInvalidPolicyTest {
 
-	@After
-	public void resetSystemProp() throws Exception {
-		System.clearProperty(Policy.VALIDATIONPROPERTY);
-		PolicyTest.reloadSchemaValidation();
-		if (!Policy.getSchemaValidation()) System.out.println(
-			"ERROR: resetSystemProp() test method NOT properly enabling AntiSamy policy schema validation!");
-	}
-
 	@Test
-	public void testDirectConfigAsBaisValidationOn() throws Exception {
-		Policy.setSchemaValidation(true);
-		assertTrue("AntiSamy XSD Validation should be enabled", Policy.getSchemaValidation());
+	public void testBaisValidation() throws Exception {
 		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
 		try {
 			Policy.getInstance(toByteArrayStream(stream));
-			fail("Invalid policy with schema validation ON should throw exception.");
-		} catch (PolicyException e) {
-			// This is expected, so do nothing. Any other kind of exception is a failed test case.
-		}
-	}
-
-	@Test
-	public void testDirectConfigAsBaisValidationOff() throws Exception {
-		Policy.setSchemaValidation(false);
-		assertFalse("AntiSamy XSD Validation should be disabled", Policy.getSchemaValidation());
-		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
-		Policy.getInstance(toByteArrayStream(stream));
-	}
-
-	@Test
-	public void testDirectConfigValidationOn() throws Exception {
-		Policy.setSchemaValidation(true);
-		assertTrue("AntiSamy XSD Validation should be enabled", Policy.getSchemaValidation());
-		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
-		try {
-			Policy.getInstance(stream);
-			fail("Invalid policy with schema validation ON should throw exception.");
+			fail("Invalid policy with schema should throw exception.");
 		} catch (PolicyException e) {
 			// This is expected, so do nothing. Any other kind of exception is a failed test case.
 		}
 	}
 
 	@Test
-	public void testDirectConfigValidationOff() throws Exception {
-		Policy.setSchemaValidation(false);
-		assertFalse("AntiSamy XSD Validation should be disabled", Policy.getSchemaValidation());
-		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
-		Policy.getInstance(stream);
-	}
-
-	@Test
-	public void testSystemPropValidationOn() throws Exception {
-		System.setProperty(Policy.VALIDATIONPROPERTY, "true");
-		PolicyTest.reloadSchemaValidation();
-		assertTrue("AntiSamy XSD Validation should be enabled", Policy.getSchemaValidation());
+	public void testDirectValidation() throws Exception {
 		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
 		try {
 			Policy.getInstance(stream);
-			fail("Invalid policy with schema validation ON should throw exception.");
-		} catch (PolicyException e) {
-			// This is expected, so do nothing. Any other kind of exception is a failed test case.
-		}
-	}
-
-	@Test
-	public void testSystemPropValidationOff() throws Exception {
-		System.setProperty(Policy.VALIDATIONPROPERTY, "false");
-		PolicyTest.reloadSchemaValidation();
-		assertFalse("AntiSamy XSD Validation should be disabled", Policy.getSchemaValidation());
-		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
-		Policy.getInstance(stream);
-	}
-
-	@Test
-	public void testSystemPropAsBaisValidationOn() throws Exception {
-		System.setProperty(Policy.VALIDATIONPROPERTY, "true");
-		PolicyTest.reloadSchemaValidation();
-		assertTrue("AntiSamy XSD Validation should be enabled", Policy.getSchemaValidation());
-		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
-		try {
-			Policy.getInstance(toByteArrayStream(stream));
-			fail("Invalid policy with schema validation ON should throw exception.");
+			fail("Invalid policy should throw exception.");
 		} catch (PolicyException e) {
 			// This is expected, so do nothing. Any other kind of exception is a failed test case.
 		}
 	}
 
-	@Test
-	public void testSystemPropAsBaisValidationOff() throws Exception {
-		System.setProperty(Policy.VALIDATIONPROPERTY, "false");
-		PolicyTest.reloadSchemaValidation();
-		assertFalse("AntiSamy XSD Validation should be disabled", Policy.getSchemaValidation());
-		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
-		Policy.getInstance(toByteArrayStream(stream));
-	}
-
 	static InputStream toByteArrayStream(InputStream in) throws Exception {
 		ByteArrayOutputStream buffer = new ByteArrayOutputStream();
 		int nRead;
diff --git a/src/test/java/org/owasp/validator/html/test/PolicyTest.java b/src/test/java/org/owasp/validator/html/test/PolicyTest.java
index 1d95b485..b7f3a06a 100644
--- a/src/test/java/org/owasp/validator/html/test/PolicyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/PolicyTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Jacob Coulter, Mark Oberhaus
+ * Copyright (c) 2007-2022, Jacob Coulter, Mark Oberhaus
  *
  * All rights reserved.
  *
@@ -33,13 +33,11 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 
 import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
-import org.junit.Before;
 import org.junit.Test;
 
 import org.owasp.validator.html.AntiSamy;
@@ -77,11 +75,6 @@ private String assembleFile(String allowedEmptyTagsSection) {
                allowedEmptyTagsSection + FOOTER;
     }
 
-    @Before
-    public void resetSystemProp() throws Exception {
-        Policy.setSchemaValidation(true);
-    }
-
     @Test
     public void testGetAllowedEmptyTags() throws PolicyException {
         String allowedEmptyTagsSection = "<allowed-empty-tags>\n" +
@@ -136,13 +129,13 @@ public void testGetAllowedEmptyTags_NoSection() throws PolicyException {
     
     @Test
     public void testInvalidPolicies() {
-        // Default is to now enforce schema validation on policy files.
+        // Starting with v1.7.0, schema validation is always enforced on policy files.
         // These tests verify various schema violations are detected and flagged.
         String notSupportedTagsSection = "<notSupportedTag>\n" + "</notSupportedTag>\n";
         String policyFile = assembleFile(notSupportedTagsSection);
         try {
             policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-            fail("No PolicyException thrown for <notSupportedTag> with schema validation enabled.");
+            fail("No PolicyException thrown for <notSupportedTag>.");
         } catch (PolicyException e) {
             assertNotNull(e);
         }
@@ -151,7 +144,7 @@ public void testInvalidPolicies() {
         policyFile = assembleFile(duplicatedTagsSection);
         try {
             policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-            fail("No PolicyException thrown when <tag-rules> duplicated and schema validation enabled.");
+            fail("No PolicyException thrown when <tag-rules> duplicated.");
         } catch (PolicyException e) {
             assertNotNull(e);
         }
@@ -159,71 +152,17 @@ public void testInvalidPolicies() {
         policyFile = assembleFile("").replace("<tag-rules>", "").replace("</tag-rules>", "");
         try {
             policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-            fail("No PolicyException thrown when <tag-rules> missing and schema validation enabled.");
+            fail("No PolicyException thrown when <tag-rules> missing.");
         } catch (PolicyException e) {
             assertNotNull(e);
         }
     }
 
-    // Test various Policy schema validation static initializer settings:
-
-    @Test
-    public void testPolicyStaticInitializerTrue() throws Exception {
-        System.setProperty(Policy.VALIDATIONPROPERTY, "True");
-        reloadSchemaValidation();
-        assertTrue("AntiSamy XSD Validation should be enabled", Policy.getSchemaValidation());
-    }
-
-    @Test
-    public void testPolicyStaticInitializerFalse() throws Exception {
-        System.setProperty(Policy.VALIDATIONPROPERTY, "False");
-        reloadSchemaValidation();
-        assertFalse("AntiSamy XSD Validation should be disabled", Policy.getSchemaValidation());
-    }
-
-    @Test
-    public void testPolicyStaticInitializerBlank() throws Exception {
-        System.clearProperty(Policy.VALIDATIONPROPERTY);
-        reloadSchemaValidation();
-        assertTrue("AntiSamy XSD Validation should be enabled", Policy.getSchemaValidation());
-    }
-
-    @Test
-    public void testPolicyStaticInitializerJunk() throws Exception {
-        System.setProperty(Policy.VALIDATIONPROPERTY, "junk");
-        reloadSchemaValidation();
-        assertFalse("AntiSamy XSD Validation should be disabled", Policy.getSchemaValidation());
-    }
-
-
     @Test
     public void testSchemaValidationToggleWithSource() {
         String notSupportedTagsSection = "<notSupportedTag>\n" + "</notSupportedTag>\n";
         String policyFile = assembleFile(notSupportedTagsSection);
 
-        // Disable validation
-        Policy.setSchemaValidation(false);
-
-        try {
-            System.out.println("TESTING: A schema invalid WARNING should mention the invalid tag: <notSupportedTag>");
-            policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-            assertNotNull(policy);
-        } catch (PolicyException e) {
-            fail("Policy creation should not fail when schema validation is disabled.");
-        }
-
-        // This one should only print a warning on the console because validation is disabled
-        try {
-            System.out.println("TESTING: A WARNING should mention that schema validation should not be disabled.");
-            policy = Policy.getInstance(new ByteArrayInputStream(assembleFile("").getBytes()));
-            assertNotNull(policy);
-        } catch (PolicyException e) {
-            fail("Policy creation should not fail when schema validation is disabled.");
-        }
-
-        // Enable validation again
-        Policy.setSchemaValidation(true);
-
         try {
             policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
             fail("Not supported tag on policy, but no PolicyException occurred.");
@@ -233,63 +172,26 @@ public void testSchemaValidationToggleWithSource() {
     }
 
     @Test
-    public void testSchemaValidationToggleWithUrl() {
+    public void testSchemaValidationWithUrl() {
         URL urlOfValidPolicy = getClass().getResource("/antisamy.xml");
         URL urlOfInvalidPolicy = getClass().getResource("/invalidPolicy.xml");
 
-        // Disable validation
-        Policy.setSchemaValidation(false);
-
-        try {
-            System.out.println("TESTING: A schema invalid WARNING should follow:");
-            policy = TestPolicy.getInstance(urlOfInvalidPolicy);
-            assertNotNull(policy);
-        } catch (PolicyException e) {
-            fail("Policy creation should not fail for invalid policy when schema validation disabled.");
-        }
-
-        // This one should only print a warning on the console because validation is disabled
-        try {
-            System.out.println("TESTING: A WARNING should mention that schema validation should not be disabled.");
-            policy = TestPolicy.getInstance(urlOfValidPolicy);
-            assertNotNull(policy);
-        } catch (PolicyException e) {
-            fail("Policy creation should not fail for valid policy when schema validation disabled.");
-        }
-
-        // Enable validation again
-        Policy.setSchemaValidation(true);
-
         try {
             policy = TestPolicy.getInstance(urlOfInvalidPolicy);
-            fail("PolicyException not thrown for policy w/invalid schema and schema validation enabled.");
+            fail("PolicyException not thrown for policy w/invalid schema.");
         } catch (PolicyException e) {
             assertNotNull(e);
         }
     }
 
     @Test
-    public void testSchemaValidationToggleWithInclude() {
+    public void testSchemaValidationWithInclude() {
         // This policy will also include invalidPolicy.xml
         URL url = getClass().getResource("/emptyPolicyWithInclude.xml");
 
-        // Disable validation
-        Policy.setSchemaValidation(false);
-
-        try {
-            System.out.println("TESTING: A schema invalid WARNING should follow:");
-            policy = TestPolicy.getInstance(url);
-            assertNotNull(policy);
-        } catch (PolicyException e) {
-            fail("Policy creation should not fail for invalid policy when schema validation disabled.");
-        }
-
-        // Enable validation again
-        Policy.setSchemaValidation(true);
-
         try {
             policy = TestPolicy.getInstance(url);
-            fail("PolicyException not thrown for policy w/invalid schema and schema validation enabled.");
+            fail("PolicyException not thrown for policy w/invalid schema.");
         } catch (PolicyException e) {
             assertNotNull(e);
         }

From 17d9bf3077ceddac0b9ecffa3e997befbfbffc88 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sat, 19 Feb 2022 12:18:02 -0300
Subject: [PATCH 08/36] Add explicit write permission for SL Scan worflow

---
 .github/workflows/shiftleft-analysis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/shiftleft-analysis.yml b/.github/workflows/shiftleft-analysis.yml
index 7c34a8e0..2198335b 100644
--- a/.github/workflows/shiftleft-analysis.yml
+++ b/.github/workflows/shiftleft-analysis.yml
@@ -12,6 +12,8 @@ jobs:
   Scan-Build:
     # Scan runs on ubuntu, mac and windows
     runs-on: ubuntu-latest
+      permissions:
+      security-events: write
     steps:
     - uses: actions/checkout@v1
     # Instructions

From 32c7838224456cc51474142699045c4c3c83bddb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?=
 <30912689+spassarop@users.noreply.github.com>
Date: Sat, 19 Feb 2022 12:19:29 -0300
Subject: [PATCH 09/36] Fix indentation in shiftleft-analysis.yml

---
 .github/workflows/shiftleft-analysis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/shiftleft-analysis.yml b/.github/workflows/shiftleft-analysis.yml
index 2198335b..32b0d714 100644
--- a/.github/workflows/shiftleft-analysis.yml
+++ b/.github/workflows/shiftleft-analysis.yml
@@ -12,7 +12,7 @@ jobs:
   Scan-Build:
     # Scan runs on ubuntu, mac and windows
     runs-on: ubuntu-latest
-      permissions:
+    permissions:
       security-events: write
     steps:
     - uses: actions/checkout@v1

From a0f3a20e59380a0a51e51ac260e3d49e210f2fad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Thu, 3 Mar 2022 20:33:32 -0300
Subject: [PATCH 10/36] Add require-closing-tags to default schema

With tests to verify it is accepted and parsed in the policy.
---
 src/main/resources/antisamy.xsd               |  5 +-
 .../owasp/validator/html/test/PolicyTest.java | 77 +++++++++++++++++--
 2 files changed, 75 insertions(+), 7 deletions(-)

diff --git a/src/main/resources/antisamy.xsd b/src/main/resources/antisamy.xsd
index 40d9502b..6d82fd23 100644
--- a/src/main/resources/antisamy.xsd
+++ b/src/main/resources/antisamy.xsd
@@ -13,7 +13,8 @@
 				<xsd:element name="tags-to-encode" type="TagsToEncodeList" minOccurs="0"/>
 				<xsd:element name="tag-rules" type="TagRules"/>
 				<xsd:element name="css-rules" type="CSSRules"/>
-	        	<xsd:element name="allowed-empty-tags" type="AllowedEmptyTags" minOccurs="0"/>
+				<xsd:element name="allowed-empty-tags" type="LiteralListTag" minOccurs="0"/>
+				<xsd:element name="require-closing-tags" type="LiteralListTag" minOccurs="0"/>
 			</xsd:sequence>
 		</xsd:complexType>
 	</xsd:element>
@@ -65,7 +66,7 @@
 		<xsd:attribute name="action" use="required"/>
 	</xsd:complexType>
 
-    <xsd:complexType name="AllowedEmptyTags">
+    <xsd:complexType name="LiteralListTag">
         <xsd:sequence>
             <xsd:element name="literal-list" type="LiteralList" minOccurs="0"/>
         </xsd:sequence>
diff --git a/src/test/java/org/owasp/validator/html/test/PolicyTest.java b/src/test/java/org/owasp/validator/html/test/PolicyTest.java
index b7f3a06a..83a1cebf 100644
--- a/src/test/java/org/owasp/validator/html/test/PolicyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/PolicyTest.java
@@ -70,9 +70,9 @@ public class PolicyTest {
     private static final String FOOTER = "</anti-samy-rules>";
 
     // Returns a valid policy file with the specified allowedEmptyTags
-    private String assembleFile(String allowedEmptyTagsSection) {
+    private String assembleFile(String finalTagsSection) {
         return HEADER + DIRECTIVES + COMMON_REGEXPS + COMMON_ATTRIBUTES + GLOBAL_TAG_ATTRIBUTES + DYNAMIC_TAG_ATTRIBUTES + TAG_RULES + CSS_RULES +
-               allowedEmptyTagsSection + FOOTER;
+                finalTagsSection + FOOTER;
     }
 
     @Test
@@ -119,14 +119,64 @@ public void testGetAllowedEmptyTags_emptySection() throws PolicyException {
     @Test
     public void testGetAllowedEmptyTags_NoSection() throws PolicyException {
         String allowedEmptyTagsSection = "";
-
         String policyFile = assembleFile(allowedEmptyTagsSection);
 
         policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
 
         assertTrue(policy.getAllowedEmptyTags().size() == Constants.defaultAllowedEmptyTags.size());
     }
-    
+
+    @Test
+    public void testGetRequireClosingTags() throws PolicyException {
+        String requireClosingTagsSection = "<require-closing-tags>\n" +
+                "    <literal-list>\n" +
+                "                <literal value=\"td\"/>\n" +
+                "                <literal value=\"span\"/>\n" +
+                "    </literal-list>\n" +
+                "</require-closing-tags>\n";
+        String policyFile = assembleFile(requireClosingTagsSection);
+
+        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+        TagMatcher actualTags = policy.getRequiresClosingTags();
+
+        assertTrue(actualTags.matches("td"));
+        assertTrue(actualTags.matches("span"));
+    }
+
+    @Test
+    public void testGetRequireClosingTags_emptyList() throws PolicyException {
+        String requireClosingTagsSection = "<require-closing-tags>\n" +
+                "    <literal-list>\n" +
+                "    </literal-list>\n" +
+                "</require-closing-tags>\n";
+        String policyFile = assembleFile(requireClosingTagsSection);
+
+        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+        assertEquals(0, policy.getRequiresClosingTags().size());
+    }
+
+    @Test
+    public void testGetRequireClosingTags_emptySection() throws PolicyException {
+        String requireClosingTagsSection = "<require-closing-tags>\n" + "</require-closing-tags>\n";
+        String policyFile = assembleFile(requireClosingTagsSection);
+
+        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+        assertEquals(0, policy.getRequiresClosingTags().size());
+    }
+
+    @Test
+    public void testGetRequireClosingTags_NoSection() throws PolicyException {
+        String requireClosingTagsSection = "";
+        String policyFile = assembleFile(requireClosingTagsSection);
+
+        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+        assertTrue(policy.getRequiresClosingTags().size() == Constants.defaultRequireClosingTags.size());
+    }
+
     @Test
     public void testInvalidPolicies() {
         // Starting with v1.7.0, schema validation is always enforced on policy files.
@@ -173,7 +223,6 @@ public void testSchemaValidationToggleWithSource() {
 
     @Test
     public void testSchemaValidationWithUrl() {
-        URL urlOfValidPolicy = getClass().getResource("/antisamy.xml");
         URL urlOfInvalidPolicy = getClass().getResource("/invalidPolicy.xml");
 
         try {
@@ -197,6 +246,24 @@ public void testSchemaValidationWithInclude() {
         }
     }
 
+    @Test
+    public void testSchemaValidationWithOptionallyDefinedTags() throws PolicyException {
+        String allowedEmptyTagsSection = "<allowed-empty-tags>\n" +
+                "    <literal-list>\n" +
+                "                <literal value=\"span\"/>\n" +
+                "    </literal-list>\n" +
+                "</allowed-empty-tags>\n";
+        String requireClosingTagsSection = "<require-closing-tags>\n" +
+                "    <literal-list>\n" +
+                "                <literal value=\"span\"/>\n" +
+                "    </literal-list>\n" +
+                "</require-closing-tags>\n";
+        String policyFile = assembleFile(allowedEmptyTagsSection + requireClosingTagsSection);
+
+        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+        // If it reaches this point, it passed schema validation, which is what we want.
+    }
+
     @Test
     public void testGithubIssue66() {
         // Concern is that LSEP characters are not being considered on .* pattern

From a2a004d52279a2d17d81d7e9a82ae66a14ad0529 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sat, 12 Mar 2022 21:08:23 -0300
Subject: [PATCH 11/36] Use errors list passed to CssHandler constructor

---
 .../java/org/owasp/validator/css/CssHandler.java   |  2 +-
 .../owasp/validator/html/test/AntiSamyTest.java    | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/owasp/validator/css/CssHandler.java b/src/main/java/org/owasp/validator/css/CssHandler.java
index 8341516d..6a669daf 100644
--- a/src/main/java/org/owasp/validator/css/CssHandler.java
+++ b/src/main/java/org/owasp/validator/css/CssHandler.java
@@ -144,7 +144,7 @@ public CssHandler(Policy policy, List<String> errorMessages, ResourceBundle mess
 	 *            the tag name associated with this inline style
 	 */
 	public CssHandler(Policy policy, List<String> errorMessages, ResourceBundle messages, String tagName) {
-		this(policy, null, new ArrayList<String>(), tagName, messages);
+		this(policy, null, errorMessages, tagName, messages);
 	}
 
 	/**
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index cca9d8d2..c9472169 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1688,5 +1688,19 @@ public void testScansWithDifferentPolicyLoading() throws ScanException, PolicyEx
             // An error is expected. Pass.
         }
     }
+
+    @Test
+    public void testGithubIssue151() throws ScanException, PolicyException {
+        // Concern is error messages when parsing stylesheets are no longer returned in AntiSamy 1.6.5
+        String input = "<img style=\"FLOAT: right; CURSOR: hand\" src=\"http://site.com/pic.jpg\" />";
+
+        CleanResults result = as.scan(input, policy, AntiSamy.DOM);
+        assertThat(result.getErrorMessages().size(), is(1));
+        assertThat(result.getCleanHTML(), both(containsString("img")).and(not(containsString("CURSOR"))));
+
+        result = as.scan(input, policy, AntiSamy.SAX);
+        assertThat(result.getErrorMessages().size(), is(1));
+        assertThat(result.getCleanHTML(), both(containsString("img")).and(not(containsString("CURSOR"))));
+    }
 }
 

From f837cc2556f5f0b2e7a486c0aa5fc39036445e8b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?=
 <30912689+spassarop@users.noreply.github.com>
Date: Sun, 13 Mar 2022 13:59:32 -0300
Subject: [PATCH 12/36] Edit copyright date on AntiSamyTest.java

---
 src/test/java/org/owasp/validator/html/test/AntiSamyTest.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index c9472169..f74c9f20 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  *
  * All rights reserved.
  *

From 2f0df8581de997270fe4efe7e3cc853a04659ef9 Mon Sep 17 00:00:00 2001
From: Dave Wichers <dwichers@gmail.com>
Date: Mon, 14 Mar 2022 21:04:58 -0400
Subject: [PATCH 13/36] Upgrade spotbugs.

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 40645b71..3e5583f9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -47,7 +47,7 @@
         <version.io>2.11.0</version.io>
         <version.slf4j>1.7.36</version.slf4j>
         <version.spotbugs.maven>4.5.3.0</version.spotbugs.maven>
-        <version.spotbugs>4.5.3</version.spotbugs>
+        <version.spotbugs>4.6.0</version.spotbugs>
     </properties>
 
     <profiles>

From c642a76d0ba45bd6cc6259f4d3f40c043b67d7e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sun, 27 Mar 2022 11:20:58 -0300
Subject: [PATCH 14/36] Update 1.7.0

---
 .../owasp/validator/html/test/AntiSamyTest.java | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index cca9d8d2..49fcd79b 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1688,5 +1688,22 @@ public void testScansWithDifferentPolicyLoading() throws ScanException, PolicyEx
             // An error is expected. Pass.
         }
     }
+<<<<<<< Updated upstream
+=======
+
+    @Test
+    public void testGithubIssue151() throws ScanException, PolicyException {
+        // Concern is error messages when parsing stylesheets are no longer returned in AntiSamy 1.6.5
+        String input = "<img style=\"FLOAT: right; CURSOR: hand\" src=\"http://site.com/pic.jpg\" />";
+
+        CleanResults result = as.scan(input, policy, AntiSamy.DOM);
+        assertThat(result.getErrorMessages().size(), is(1));
+        assertThat(result.getCleanHTML(), both(containsString("img")).and(not(containsString("CURSOR"))));
+
+        result = as.scan(input, policy, AntiSamy.SAX);
+        assertThat(result.getErrorMessages().size(), is(1));
+        assertThat(result.getCleanHTML(), both(containsString("img")).and(not(containsString("CURSOR"))));
+    }
+>>>>>>> Stashed changes
 }
 

From 0b77106350c731c31ae68f8b834a7927baab6225 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sun, 27 Mar 2022 11:21:27 -0300
Subject: [PATCH 15/36] Change neko html dependecy

---
 pom.xml | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/pom.xml b/pom.xml
index 40645b71..0f1fbd88 100644
--- a/pom.xml
+++ b/pom.xml
@@ -61,16 +61,9 @@
 
     <dependencies>
         <dependency>
-            <groupId>net.sourceforge.nekohtml</groupId>
-            <artifactId>nekohtml</artifactId>
-            <version>1.9.22</version>
-            <exclusions>
-                <!-- exclude this as nekohtml uses an older xercesImpl and we want to eliminate the convergence mismatch -->
-                <exclusion>
-                    <groupId>xerces</groupId>
-                    <artifactId>xercesImpl</artifactId>
-                </exclusion>
-            </exclusions>
+            <groupId>net.sourceforge.htmlunit</groupId>
+            <artifactId>neko-htmlunit</artifactId>
+            <version>2.60.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.httpcomponents</groupId>

From fc3658c1d002752f25489d7dbdd6ab9aacc91b2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sun, 27 Mar 2022 11:35:47 -0300
Subject: [PATCH 16/36] Update neko html imports and tests

---
 .../org/owasp/validator/html/scan/AntiSamyDOMScanner.java   | 4 ++--
 .../org/owasp/validator/html/scan/AntiSamySAXScanner.java   | 4 ++--
 .../java/org/owasp/validator/html/scan/MagicSAXFilter.java  | 4 ++--
 .../java/org/owasp/validator/html/test/AntiSamyTest.java    | 6 ++++--
 4 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java b/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
index cac79688..976c1931 100644
--- a/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  *
  * All rights reserved.
  *
@@ -25,7 +25,7 @@
 
 import org.apache.batik.css.parser.ParseException;
 import org.apache.xerces.dom.DocumentImpl;
-import org.cyberneko.html.parsers.DOMFragmentParser;
+import net.sourceforge.htmlunit.cyberneko.parsers.DOMFragmentParser;
 import org.owasp.validator.css.CssScanner;
 import org.owasp.validator.html.CleanResults;
 import org.owasp.validator.html.Policy;
diff --git a/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java b/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java
index f66bade1..87d10d8f 100644
--- a/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
@@ -41,7 +41,7 @@
 import javax.xml.transform.sax.SAXSource;
 
 import org.apache.xerces.xni.parser.XMLDocumentFilter;
-import org.cyberneko.html.parsers.SAXParser;
+import net.sourceforge.htmlunit.cyberneko.parsers.SAXParser;
 import org.owasp.validator.html.CleanResults;
 import org.owasp.validator.html.Policy;
 import org.owasp.validator.html.ScanException;
diff --git a/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java b/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java
index 819b3b6a..a163dcc3 100644
--- a/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java
+++ b/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
@@ -36,7 +36,7 @@
 import org.apache.xerces.xni.XMLString;
 import org.apache.xerces.xni.XNIException;
 import org.apache.xerces.xni.parser.XMLDocumentFilter;
-import org.cyberneko.html.filters.DefaultFilter;
+import net.sourceforge.htmlunit.cyberneko.filters.DefaultFilter;
 import org.owasp.validator.css.CssScanner;
 import org.owasp.validator.html.CleanResults;
 import org.owasp.validator.html.InternalPolicy;
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index d941dac1..8b71b722 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1511,11 +1511,13 @@ public void entityReferenceEncodedInHtmlAttribute() throws ScanException, Policy
         // Concern is that "&" is not being encoded and "#00058" was not being interpreted as ":"
         // so the validations based on regexp passed and a browser would load "&:" together.
         // All this when not using the XHTML serializer.
+
+        // UPDATE:  Using a new HTML parser library starts decoding entities like #00058
         Policy revised = policy.cloneWithDirective("useXHTML","false");
         assertThat(as.scan("<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>", revised, AntiSamy.DOM).getCleanHTML(),
-                containsString("javascript&amp;#00058"));
+                not(containsString("javascript")));
         assertThat(as.scan("<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>", revised, AntiSamy.SAX).getCleanHTML(),
-                containsString("javascript&amp;#00058"));
+                not(containsString("javascript")));
     }
 
     @Test

From 857202e75330abb9242ff321c9b9ec7da0f3bfd3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sun, 27 Mar 2022 11:04:31 -0300
Subject: [PATCH 17/36] Support multiple children handling on style tags

---
 .../html/scan/AntiSamyDOMScanner.java         | 28 +++++++++++++------
 .../validator/html/test/AntiSamyTest.java     | 14 ++++++++++
 .../owasp/validator/html/test/TestPolicy.java |  2 +-
 3 files changed, 35 insertions(+), 9 deletions(-)

diff --git a/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java b/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
index 976c1931..3cf63f6a 100644
--- a/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
@@ -407,10 +407,17 @@ private boolean processStyleTag(Element ele, Node parentNode) {
         CssScanner styleScanner = new CssScanner(policy, messages, policy.isEmbedStyleSheets());
 
         try {
-            Node firstChild = ele.getFirstChild();
-            if (firstChild != null) {
+            if (ele.getChildNodes().getLength() > 0) {
+                String toScan = "";
+
+                for (int i = 0; i < ele.getChildNodes().getLength(); i++) {
+                    Node childNode = ele.getChildNodes().item(i);
+                    if (!toScan.isEmpty()){
+                        toScan += "\n";
+                    }
+                    toScan += childNode.getTextContent();
+                }
 
-                String toScan = firstChild.getNodeValue();
                 CleanResults cr = styleScanner.scanStyleSheet(toScan, policy.getMaxInputSize());
                 errorMessages.addAll(cr.getErrorMessages());
 
@@ -422,12 +429,17 @@ private boolean processStyleTag(Element ele, Node parentNode) {
                  * break all CSS. To prevent that, we have this check.
                  */
 
-                final String cleanHTML = cr.getCleanHTML();
+                String cleanHTML = cr.getCleanHTML();
+                cleanHTML = cleanHTML == null || cleanHTML.equals("") ? "/* */" : cleanHTML;
 
-                if (cleanHTML == null || cleanHTML.equals("")) {
-                    firstChild.setNodeValue("/* */");
-                } else {
-                    firstChild.setNodeValue(cleanHTML);
+                ele.getFirstChild().setNodeValue(cleanHTML);
+                /*
+                 * Remove every other node after cleaning CSS, there will
+                 * be only one node in the end, as it always should have.
+                 */
+                for (int i = 1; i < ele.getChildNodes().getLength(); i++) {
+                    Node childNode = ele.getChildNodes().item(i);
+                    ele.removeChild(childNode);
                 }
             }
 
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index 8b71b722..51e8a0ed 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1704,5 +1704,19 @@ public void testGithubIssue151() throws ScanException, PolicyException {
         assertThat(result.getErrorMessages().size(), is(1));
         assertThat(result.getCleanHTML(), both(containsString("img")).and(not(containsString("CURSOR"))));
     }
+
+    @Test
+    public void testSmuggledTagsInStyleContent() throws ScanException, PolicyException {
+        // HTML tags may be smuggled into a style tag after parsing input to an internal representation.
+        // If that happens, they should be treated as text content and not as children nodes.
+
+        Policy revised = policy.cloneWithDirective(Policy.USE_XHTML,"true");
+        assertThat(as.scan("<style/>b<![cdata[</style><a href=javascript:alert(1)>test", revised, AntiSamy.DOM).getCleanHTML(), not(containsString("javascript")));
+        assertThat(as.scan("<style/>b<![cdata[</style><a href=javascript:alert(1)>test", revised, AntiSamy.SAX).getCleanHTML(), not(containsString("javascript")));
+
+        Policy revised2 = policy.cloneWithDirective(Policy.USE_XHTML,"false");
+        assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", revised2, AntiSamy.DOM).getCleanHTML(), not(containsString("script")));
+        assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", revised2, AntiSamy.SAX).getCleanHTML(), not(containsString("script")));
+    }
 }
 
diff --git a/src/test/java/org/owasp/validator/html/test/TestPolicy.java b/src/test/java/org/owasp/validator/html/test/TestPolicy.java
index 4b71ebbb..435175bc 100644
--- a/src/test/java/org/owasp/validator/html/test/TestPolicy.java
+++ b/src/test/java/org/owasp/validator/html/test/TestPolicy.java
@@ -43,7 +43,7 @@
  */
 public class TestPolicy extends InternalPolicy {
 
-    protected TestPolicy(Policy.ParseContext parseContext) throws PolicyException {
+    protected TestPolicy(Policy.ParseContext parseContext) {
         super(parseContext);
     }
 

From 6ed9b29e6e0c0ba7d7a17361e2495da9545cb444 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sun, 27 Mar 2022 11:49:07 -0300
Subject: [PATCH 18/36] Add malformed PI test

---
 .../org/owasp/validator/html/test/AntiSamyTest.java | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index 51e8a0ed..f6015e31 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1718,5 +1718,16 @@ public void testSmuggledTagsInStyleContent() throws ScanException, PolicyExcepti
         assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", revised2, AntiSamy.DOM).getCleanHTML(), not(containsString("script")));
         assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", revised2, AntiSamy.SAX).getCleanHTML(), not(containsString("script")));
     }
-}
 
+    @Test(timeout = 3000)
+    public void testMalformedPIScan() {
+        // Certain malformed input including a malformed processing instruction may lead the parser to an internal memory error.
+
+        try {
+            as.scan("<!--><?a/", policy, AntiSamy.DOM).getCleanHTML();
+            as.scan("<!--><?a/", policy, AntiSamy.SAX).getCleanHTML();
+        } catch (Exception ex) {
+            fail("Parser should not throw an exception");
+        }
+    }
+}

From fdaa74f732679d506ed503806c81b5033668aad7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sun, 27 Mar 2022 11:49:56 -0300
Subject: [PATCH 19/36] Update last test

---
 .../java/org/owasp/validator/html/test/AntiSamyTest.java     | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index f6015e31..29109d4f 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1722,12 +1722,13 @@ public void testSmuggledTagsInStyleContent() throws ScanException, PolicyExcepti
     @Test(timeout = 3000)
     public void testMalformedPIScan() {
         // Certain malformed input including a malformed processing instruction may lead the parser to an internal memory error.
-
         try {
             as.scan("<!--><?a/", policy, AntiSamy.DOM).getCleanHTML();
             as.scan("<!--><?a/", policy, AntiSamy.SAX).getCleanHTML();
+        } catch (ScanException ex) {
+            // It is OK, internal parser should fail.
         } catch (Exception ex) {
-            fail("Parser should not throw an exception");
+            fail("Parser should not throw a non-ScanException");
         }
     }
 }

From 4eca7e26193f1597ba1eca48ee50b9bd7297e045 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Thu, 31 Mar 2022 21:15:13 -0300
Subject: [PATCH 20/36] Upgrade 2x Apache httpcomponent libraries

Used from their old 4.x versions to the latest 5.x versions. Required updating imports and rewriting a bit
of code in the CssScanner class.
---
 pom.xml                                       | 44 ++++-------
 .../org/owasp/validator/css/CssScanner.java   | 76 ++++++++++++-------
 2 files changed, 63 insertions(+), 57 deletions(-)

diff --git a/pom.xml b/pom.xml
index 1fc4c8d5..7a92752b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -46,7 +46,7 @@
         <gpg.skip>true</gpg.skip><!-- by default skip gpg -->
         <version.io>2.11.0</version.io>
         <version.slf4j>1.7.36</version.slf4j>
-        <version.spotbugs.maven>4.5.3.0</version.spotbugs.maven>
+        <version.spotbugs.maven>4.6.0.0</version.spotbugs.maven>
         <version.spotbugs>4.6.0</version.spotbugs>
     </properties>
 
@@ -66,30 +66,14 @@
             <version>2.60.0</version>
         </dependency>
         <dependency>
-            <groupId>org.apache.httpcomponents</groupId>
-            <artifactId>httpclient</artifactId>
-            <version>4.5.13</version>
-            <exclusions>
-                <!-- exclude these as httpclient uses older versions of these libraries that we directly import and we want to eliminate the convergence mismatch -->
-                <exclusion>
-                    <groupId>commons-codec</groupId>
-                    <artifactId>commons-codec</artifactId>
-                </exclusion>
-                <!-- exclude obsolete commons-logging in favor of jcl-over-slf4j to ensure logs all pipe through slf4j-api -->
-                <exclusion>
-                    <groupId>commons-logging</groupId>
-                    <artifactId>commons-logging</artifactId>
-                </exclusion>
-                <exclusion>
-                   <groupId>org.apache.httpcomponents</groupId>
-                   <artifactId>httpcore</artifactId>
-                </exclusion>
-            </exclusions>
+            <groupId>org.apache.httpcomponents.client5</groupId>
+            <artifactId>httpclient5</artifactId>
+            <version>5.1.3</version>
         </dependency>
         <dependency>
-            <groupId>org.apache.httpcomponents</groupId>
-            <artifactId>httpcore</artifactId>
-            <version>4.4.15</version>
+            <groupId>org.apache.httpcomponents.core5</groupId>
+            <artifactId>httpcore5</artifactId>
+            <version>5.1.3</version>
         </dependency>
         <dependency>
             <groupId>org.apache.xmlgraphics</groupId>
@@ -198,7 +182,7 @@
                <plugin>
                   <groupId>org.apache.maven.plugins</groupId>
                   <artifactId>maven-dependency-plugin</artifactId>
-                  <version>3.2.0</version>
+                  <version>3.3.0</version>
                     <configuration>
                         <usedDependencies>
                             <dependency>commons-io:commons-io</dependency>
@@ -233,7 +217,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.10.0</version>
+                <version>3.10.1</version>
                 <configuration>
                     <source>1.8</source>
                     <target>1.8</target>
@@ -342,7 +326,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-site-plugin</artifactId>
-                <version>3.10.0</version>
+                <version>3.11.0</version>
             </plugin>
             <plugin>
                <groupId>org.apache.maven.plugins</groupId>
@@ -424,7 +408,7 @@
                     Delete this entire build plugin block in 3.16+ as maven-pmd-plugin is only needed in the reporting block.  -->
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
-               <version>3.15.0</version>
+               <version>3.16.0</version>
                <dependencies>
                    <!-- Without this, 3.15.0+ causes lots of warning like: [WARNING] Could not find class org.owasp.validator.html.util.ErrorMessageUtil,
                due to: java.lang.IncompatibleClassChangeError: class net.sourceforge.pmd.lang.java.typeresolution.visitors.PMDASMVisitor
@@ -444,7 +428,7 @@
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>versions-maven-plugin</artifactId>
-               <version>2.9.0</version>
+               <version>2.10.0</version>
                <reportSets>
                  <reportSet>
                    <reports>
@@ -482,12 +466,12 @@
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jxr-plugin</artifactId>
-               <version>3.1.1</version>
+               <version>3.2.0</version>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
-               <version>3.2.1</version>
+               <version>3.2.2</version>
                <reportSets>
                  <reportSet>
                    <reports>
diff --git a/src/main/java/org/owasp/validator/css/CssScanner.java b/src/main/java/org/owasp/validator/css/CssScanner.java
index 57ad18bb..5b537e5a 100644
--- a/src/main/java/org/owasp/validator/css/CssScanner.java
+++ b/src/main/java/org/owasp/validator/css/CssScanner.java
@@ -1,11 +1,11 @@
 /*
  * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without 
+ *
+ * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
- * - Redistributions of source code must retain the above copyright notice, 
+ * - Redistributions of source code must retain the above copyright notice,
  * 	 this list of conditions and the following disclaimer.
  * - Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
@@ -43,12 +43,17 @@
 
 import org.apache.batik.css.parser.ParseException;
 import org.apache.batik.css.parser.Parser;
-import org.apache.http.HttpResponse;
-import org.apache.http.client.HttpClient;
-import org.apache.http.client.config.RequestConfig;
-import org.apache.http.client.methods.HttpGet;
-import org.apache.http.impl.client.HttpClientBuilder;
-import org.apache.http.util.EntityUtils;
+import org.apache.hc.core5.http.ClassicHttpResponse;
+import org.apache.hc.core5.http.HttpEntity;
+import org.apache.hc.core5.http.HttpStatus;
+import org.apache.hc.client5.http.ClientProtocolException;
+import org.apache.hc.client5.http.classic.HttpClient;
+import org.apache.hc.client5.http.config.RequestConfig;
+import org.apache.hc.client5.http.classic.methods.HttpGet;
+import org.apache.hc.client5.http.impl.classic.HttpClientBuilder;
+import org.apache.hc.core5.http.io.HttpClientResponseHandler;
+import org.apache.hc.core5.http.io.entity.EntityUtils;
+import org.apache.hc.core5.util.Timeout;
 import org.owasp.validator.html.CleanResults;
 import org.owasp.validator.html.InternalPolicy;
 import org.owasp.validator.html.Policy;
@@ -62,18 +67,18 @@
  * declaration. To make use of this class, instantiate the scanner with the
  * desired policy and call either <code>scanInlineSheet()</code> or
  * <code>scanStyleSheet</code> as appropriate.
- * 
+ *
  * @see #scanInlineStyle(String, String, int)
  * @see #scanStyleSheet(String, int)
- * 
+ *
  * @author Jason Li
  */
 public class CssScanner {
 
-    protected static final int DEFAULT_TIMEOUT = 1000;
+    protected static final Timeout DEFAULT_TIMEOUT = Timeout.ofMilliseconds(1000);
 
     private static final String CDATA = "^\\s*<!\\[CDATA\\[(.*)\\]\\]>\\s*$";
-    
+
     /**
      * The parser to be used in any scanning
      */
@@ -111,7 +116,7 @@ public CssScanner(InternalPolicy policy, ResourceBundle messages) {
 
     /**
      * Constructs a scanner based on the given policy.
-     * 
+     *
      * @param policy
      *                the policy to follow when scanning
      * @param messages
@@ -131,7 +136,7 @@ public CssScanner(InternalPolicy policy, ResourceBundle messages, boolean should
      * Scans the contents of a full stylesheet (ex. a file based stylesheet
      * or the complete stylesheet contents as declared within &lt;style&gt;
      * tags)
-     * 
+     *
      * @param taintedCss
      *                a <code>String</code> containing the contents of the
      *                CSS stylesheet to validate
@@ -190,14 +195,14 @@ public CleanResults scanStyleSheet(String taintedCss, int sizeLimit) throws Scan
      * Scans the contents of an inline style declaration (ex. in the style
      * attribute of an HTML tag) and validates the style sheet according to
      * this <code>CssScanner</code>'s policy file.
-     * 
+     *
      * @param taintedCss
      *                a <code>String</code> containing the contents of the
      *                CSS stylesheet to validate
      * @param tagName
      *                the name of the tag for which this inline style was
      *                declared
-     * 
+     *
      * @param sizeLimit
      *                the limit on the total size in bites of any imported
      *                stylesheets
@@ -263,15 +268,15 @@ private void parseImportedStylesheets(LinkedList<URI> stylesheets, List<String>
 
             // Ensure that we have appropriate timeout values so we don't
             // get DoSed waiting for returns
-            int timeout = DEFAULT_TIMEOUT;
+            Timeout timeout = DEFAULT_TIMEOUT;
             try {
-                timeout = Integer.parseInt(policy.getDirective(Policy.CONNECTION_TIMEOUT));
+                timeout = Timeout.ofMilliseconds(Long.parseLong(policy.getDirective(Policy.CONNECTION_TIMEOUT)));
             } catch (NumberFormatException nfe) {
             }
 
             RequestConfig requestConfig = RequestConfig.custom()
-                    .setSocketTimeout(timeout)
                     .setConnectTimeout(timeout)
+                    .setResponseTimeout(timeout)
                     .setConnectionRequestTimeout(timeout)
                     .build();
 
@@ -302,13 +307,33 @@ private void parseImportedStylesheets(LinkedList<URI> stylesheets, List<String>
                     continue;
                 }
 
-                HttpGet stylesheetRequest = new HttpGet(stylesheetUri);
+                // Pulled directly from: https://github.com/apache/httpcomponents-client/blob/5.1.x/httpclient5/src/test/java/org/apache/hc/client5/http/examples/ClientWithResponseHandler.java
+                // Create a custom response handler to read in the stylesheet
+                final HttpClientResponseHandler<String> responseHandler = new HttpClientResponseHandler<String>() {
+
+                    @Override
+                    public String handleResponse(
+                            final ClassicHttpResponse response) throws IOException {
+                        final int status = response.getCode();
+                        if (status >= HttpStatus.SC_SUCCESS && status < HttpStatus.SC_REDIRECTION) {
+                            final HttpEntity entity = response.getEntity();
+                            try {
+                                return entity != null ? EntityUtils.toString(entity) : null;
+                            } catch (final ParseException | org.apache.hc.core5.http.ParseException ex) {
+                                throw new ClientProtocolException(ex);
+                            }
+                        } else {
+                            throw new ClientProtocolException("Unexpected response status: " + status);
+                        }
+                    }
+                };
 
                 byte[] stylesheet = null;
+
                 try {
+                    String responseBody = httpClient.execute(new HttpGet(stylesheetUri), responseHandler);
                     // pull down stylesheet, observing size limit
-                    HttpResponse response = httpClient.execute(stylesheetRequest);
-                    stylesheet = EntityUtils.toByteArray(response.getEntity());
+                    stylesheet = responseBody.getBytes();
                     if (stylesheet != null && stylesheet.length > sizeLimit) {
                         errorMessages.add(ErrorMessageUtil.getMessage(
                                 messages,
@@ -323,8 +348,6 @@ private void parseImportedStylesheets(LinkedList<URI> stylesheets, List<String>
                             messages,
                             ErrorMessageUtil.ERROR_CSS_IMPORT_FAILURE,
                             new Object[] { HTMLEntityEncoder.htmlEntityEncode(stylesheetUri.toString()) }));
-                } finally {
-                    stylesheetRequest.releaseConnection();
                 }
 
                 if (stylesheet != null) {
@@ -343,5 +366,4 @@ private void parseImportedStylesheets(LinkedList<URI> stylesheets, List<String>
             } // end while
         } // end if
     } // end parseImportedStylesheets()
-	
 }

From 21c4061da0fc6da58056e4d6b5036ca6d82fb294 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sat, 9 Apr 2022 18:47:07 -0300
Subject: [PATCH 21/36] Fix child node removal on style tag processing

---
 .../html/scan/AntiSamyDOMScanner.java         | 20 +++++++++----------
 .../validator/html/test/AntiSamyTest.java     |  4 ++++
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java b/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
index 3cf63f6a..a6c2c652 100644
--- a/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
@@ -407,18 +407,19 @@ private boolean processStyleTag(Element ele, Node parentNode) {
         CssScanner styleScanner = new CssScanner(policy, messages, policy.isEmbedStyleSheets());
 
         try {
-            if (ele.getChildNodes().getLength() > 0) {
-                String toScan = "";
+            int childNodesCount = ele.getChildNodes().getLength();
+            if (childNodesCount > 0) {
+                StringBuffer toScan = new StringBuffer();
 
                 for (int i = 0; i < ele.getChildNodes().getLength(); i++) {
                     Node childNode = ele.getChildNodes().item(i);
-                    if (!toScan.isEmpty()){
-                        toScan += "\n";
+                    if (toScan.length() > 0) {
+                        toScan.append("\n");
                     }
-                    toScan += childNode.getTextContent();
+                    toScan.append(childNode.getTextContent());
                 }
 
-                CleanResults cr = styleScanner.scanStyleSheet(toScan, policy.getMaxInputSize());
+                CleanResults cr = styleScanner.scanStyleSheet(toScan.toString(), policy.getMaxInputSize());
                 errorMessages.addAll(cr.getErrorMessages());
 
                 /*
@@ -428,7 +429,6 @@ private boolean processStyleTag(Element ele, Node parentNode) {
                  * would normally be left with an empty style tag and
                  * break all CSS. To prevent that, we have this check.
                  */
-
                 String cleanHTML = cr.getCleanHTML();
                 cleanHTML = cleanHTML == null || cleanHTML.equals("") ? "/* */" : cleanHTML;
 
@@ -436,21 +436,19 @@ private boolean processStyleTag(Element ele, Node parentNode) {
                 /*
                  * Remove every other node after cleaning CSS, there will
                  * be only one node in the end, as it always should have.
+                 * Starting from the end due to list updating on the fly.
                  */
-                for (int i = 1; i < ele.getChildNodes().getLength(); i++) {
+                for (int i = childNodesCount - 1; i >= 1; i--) {
                     Node childNode = ele.getChildNodes().item(i);
                     ele.removeChild(childNode);
                 }
             }
-
         } catch (DOMException | ScanException | ParseException | NumberFormatException e) {
-
             /*
              * ParseException shouldn't be possible anymore, but we'll leave it
              * here because I (Arshan) am hilariously dumb sometimes.
              * Batik can throw NumberFormatExceptions (see bug #48).
              */
-
             addError(ErrorMessageUtil.ERROR_CSS_TAG_MALFORMED, new Object[]{HTMLEntityEncoder.htmlEntityEncode(ele.getFirstChild().getNodeValue())});
             parentNode.removeChild(ele);
             return true;
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index 29109d4f..6828e754 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1713,10 +1713,14 @@ public void testSmuggledTagsInStyleContent() throws ScanException, PolicyExcepti
         Policy revised = policy.cloneWithDirective(Policy.USE_XHTML,"true");
         assertThat(as.scan("<style/>b<![cdata[</style><a href=javascript:alert(1)>test", revised, AntiSamy.DOM).getCleanHTML(), not(containsString("javascript")));
         assertThat(as.scan("<style/>b<![cdata[</style><a href=javascript:alert(1)>test", revised, AntiSamy.SAX).getCleanHTML(), not(containsString("javascript")));
+        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised, AntiSamy.DOM).getCleanHTML(), not(containsString("input")));
+        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised, AntiSamy.SAX).getCleanHTML(), not(containsString("input")));
 
         Policy revised2 = policy.cloneWithDirective(Policy.USE_XHTML,"false");
         assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", revised2, AntiSamy.DOM).getCleanHTML(), not(containsString("script")));
         assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", revised2, AntiSamy.SAX).getCleanHTML(), not(containsString("script")));
+        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised2, AntiSamy.DOM).getCleanHTML(), not(containsString("input")));
+        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised2, AntiSamy.SAX).getCleanHTML(), not(containsString("input")));
     }
 
     @Test(timeout = 3000)

From b6d8ea262b6654d4ac034643e51c0a1f000b64ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Fri, 22 Apr 2022 21:28:23 -0300
Subject: [PATCH 22/36] Add test for malformed PI

---
 .../org/owasp/validator/html/test/AntiSamyTest.java  | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index 6828e754..b46988c4 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1723,12 +1723,20 @@ public void testSmuggledTagsInStyleContent() throws ScanException, PolicyExcepti
         assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised2, AntiSamy.SAX).getCleanHTML(), not(containsString("input")));
     }
 
-    @Test(timeout = 3000)
+    @Test(timeout = 4000)
     public void testMalformedPIScan() {
         // Certain malformed input including a malformed processing instruction may lead the parser to an internal memory error.
+        // Does not matter if it is DOM or SAX scan, the problem was internally the same on HTML parser.
         try {
             as.scan("<!--><?a/", policy, AntiSamy.DOM).getCleanHTML();
-            as.scan("<!--><?a/", policy, AntiSamy.SAX).getCleanHTML();
+        } catch (ScanException ex) {
+            // It is OK, internal parser should fail.
+        } catch (Exception ex) {
+            fail("Parser should not throw a non-ScanException");
+        }
+
+        try {
+            as.scan("<!--?><?a/", policy, AntiSamy.DOM).getCleanHTML();
         } catch (ScanException ex) {
             // It is OK, internal parser should fail.
         } catch (Exception ex) {

From 0955564a8bdd1c0e7da17f05c4582b70bc7ee189 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sat, 23 Apr 2022 12:40:56 -0300
Subject: [PATCH 23/36] GitHub actions update from main

---
 .github/workflows/codeql-analysis.yml    | 3 +--
 .github/workflows/maven.yml              | 4 ++--
 .github/workflows/shiftleft-analysis.yml | 2 +-
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d8064ffc..760ae80b 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
       with:
         # We must fetch at least the immediate parents so that if this is
         # a pull request then we can checkout the head.
@@ -76,4 +76,3 @@ jobs:
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v1
-
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 0d95a437..e86f04e5 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Set up JDK 1.8
-      uses: actions/setup-java@v2
+      uses: actions/setup-java@v3
       with:
         java-version: 8
         distribution: zulu
diff --git a/.github/workflows/shiftleft-analysis.yml b/.github/workflows/shiftleft-analysis.yml
index 32b0d714..1d0c785e 100644
--- a/.github/workflows/shiftleft-analysis.yml
+++ b/.github/workflows/shiftleft-analysis.yml
@@ -15,7 +15,7 @@ jobs:
     permissions:
       security-events: write
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v3
     # Instructions
     # 1. Setup JDK, Node.js, Python etc depending on your project type
     # 2. Compile or build the project before invoking scan

From 925acf49e58e426e45d46344a744648b00350524 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sat, 23 Apr 2022 12:48:19 -0300
Subject: [PATCH 24/36] Update pom.xml from main

---
 pom.xml | 172 ++++++++++++++++++++++++++++++++------------------------
 1 file changed, 99 insertions(+), 73 deletions(-)

diff --git a/pom.xml b/pom.xml
index 7a92752b..0f627f2f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -41,9 +41,11 @@
     </scm>
 
     <properties>
+        <gpg.skip>true</gpg.skip><!-- by default skip gpg -->
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.build.outputTimestamp>2022-02-30T14:33:00Z</project.build.outputTimestamp>
-        <gpg.skip>true</gpg.skip><!-- by default skip gpg -->
+        <project.java.target>1.8</project.java.target>
+        <version.findsecbugs>1.12.0</version.findsecbugs>
         <version.io>2.11.0</version.io>
         <version.slf4j>1.7.36</version.slf4j>
         <version.spotbugs.maven>4.6.0.0</version.spotbugs.maven>
@@ -63,12 +65,19 @@
         <dependency>
             <groupId>net.sourceforge.htmlunit</groupId>
             <artifactId>neko-htmlunit</artifactId>
-            <version>2.60.0</version>
+            <version>2.61.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.httpcomponents.client5</groupId>
             <artifactId>httpclient5</artifactId>
             <version>5.1.3</version>
+            <exclusions>
+                <!-- exclude this old version of slf4j-api as newer can be used -->
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-api</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.apache.httpcomponents.core5</groupId>
@@ -194,7 +203,7 @@
                <plugin>
                   <groupId>org.apache.maven.plugins</groupId>
                   <artifactId>maven-javadoc-plugin</artifactId>
-                  <version>3.3.2</version>
+                  <version>3.4.0</version>
                   <configuration>
                      <!-- supports reproducibility of generated Javadocs -->
                      <notimestamp>true</notimestamp>
@@ -212,18 +221,21 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-clean-plugin</artifactId>
-                <version>3.1.0</version>
+                <version>3.2.0</version>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <version>3.10.1</version>
                 <configuration>
-                    <source>1.8</source>
-                    <target>1.8</target>
-                    <testSource>1.8</testSource>
-                    <testTarget>1.8</testTarget>
-                    <compilerArgument>-Xlint:unchecked</compilerArgument>
+                    <source>${project.java.target}</source>
+                    <target>${project.java.target}</target>
+                    <testSource>${project.java.target}</testSource>
+                    <testTarget>${project.java.target}</testTarget>
+                    <compilerArgument>
+                        <!-- Eventual desire is to use -Xlint:all -->
+                        -Xlint:unchecked
+                    </compilerArgument>
                 </configuration>
             </plugin>
             <plugin>
@@ -241,6 +253,11 @@
                         <artifactId>extra-enforcer-rules</artifactId>
                         <version>1.5.1</version>
                     </dependency>
+                    <dependency>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>animal-sniffer-enforcer-rule</artifactId>
+                        <version>1.21</version>
+                    </dependency>
                 </dependencies>
                 <executions>
                     <execution>
@@ -267,8 +284,8 @@
                         <configuration>
                             <rules>
                                 <requireJavaVersion>
-                                    <version>1.8</version>
-                                    <message>Antisamy is written to support Java 8+.</message>
+                                    <version>${project.java.target}</version>
+                                    <message>Antisamy source code is written to support Java 8+.</message>
                                 </requireJavaVersion>
                             </rules>
                         </configuration>
@@ -318,6 +335,21 @@
                  </execution>
                </executions>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-jxr-plugin</artifactId>
+               <version>3.2.0</version>
+            </plugin>
+            <plugin>
+               <groupId>org.apache.maven.plugins</groupId>
+               <artifactId>maven-pmd-plugin</artifactId>
+               <version>3.16.0</version>
+            </plugin>
+            <plugin>
+               <groupId>org.apache.maven.plugins</groupId>
+               <artifactId>maven-project-info-reports-plugin</artifactId>
+               <version>3.2.2</version>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-resources-plugin</artifactId>
@@ -326,7 +358,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-site-plugin</artifactId>
-                <version>3.11.0</version>
+                <version>3.12.0</version>
             </plugin>
             <plugin>
                <groupId>org.apache.maven.plugins</groupId>
@@ -343,7 +375,12 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.0.0-M5</version>
+                <version>3.0.0-M6</version>
+            </plugin>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>versions-maven-plugin</artifactId>
+                <version>2.10.0</version>
             </plugin>
             <plugin>
                 <groupId>org.cyclonedx</groupId>
@@ -359,7 +396,7 @@
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.7</version>
+                <version>0.8.8</version>
                 <executions>
                     <execution>
                         <id>prepare-agent</id>
@@ -404,74 +441,55 @@
                 </dependencies>
             </plugin>
             <plugin>
-               <!-- Necessary on pmd 3.15.0 only due to leak of old asm, remove this after next pmd plugin release.
-                    Delete this entire build plugin block in 3.16+ as maven-pmd-plugin is only needed in the reporting block.  -->
-               <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-pmd-plugin</artifactId>
-               <version>3.16.0</version>
-               <dependencies>
-                   <!-- Without this, 3.15.0+ causes lots of warning like: [WARNING] Could not find class org.owasp.validator.html.util.ErrorMessageUtil,
-               due to: java.lang.IncompatibleClassChangeError: class net.sourceforge.pmd.lang.java.typeresolution.visitors.PMDASMVisitor
-               has interface org.objectweb.asm.ClassVisitor as super class.
-               However, these warnings don't adversely affect the PMD results, so we are keeping this upgrade. -->
-                   <dependency>
-                       <groupId>org.ow2.asm</groupId>
-                       <artifactId>asm</artifactId>
-                       <version>9.2</version>
-                   </dependency>
-               </dependencies>
+                <groupId>com.h3xstream.findsecbugs</groupId>
+                <artifactId>findsecbugs-plugin</artifactId>
+                <version>${version.findsecbugs}</version>
             </plugin>
+
         </plugins>
     </build>
+
     <reporting>
+        <!-- All plugins used here should first be declared in the <plugins> section above with their
+             versions, so the versions get reported in the plugins Updates report.
+         -->
         <plugins>
            <plugin>
-               <groupId>org.codehaus.mojo</groupId>
-               <artifactId>versions-maven-plugin</artifactId>
-               <version>2.10.0</version>
-               <reportSets>
-                 <reportSet>
-                   <reports>
-                     <report>dependency-updates-report</report>
-                     <report>plugin-updates-report</report>
-                     <report>property-updates-report</report>
-                   </reports>
-                 </reportSet>
-               </reportSets>
+               <groupId>com.github.spotbugs</groupId>
+               <artifactId>spotbugs-maven-plugin</artifactId>
+               <configuration>
+                   <plugins>
+                       <plugin>
+                           <groupId>com.h3xstream.findsecbugs</groupId>
+                           <artifactId>findsecbugs-plugin</artifactId>
+                           <version>${version.findsecbugs}</version>
+                       </plugin>
+                   </plugins>
+                   <effort>Max</effort>
+                   <relaxed>false</relaxed>
+                   <excludeFilterFile>src/test/spotbugsFilterFile.xml</excludeFilterFile>
+               </configuration>
            </plugin>
            <plugin>
-               <!-- This causes the Jacoco report generated during test to be added to the Project
-                    Reports section of the 'site' report. -->
-               <groupId>org.jacoco</groupId>
-               <artifactId>jacoco-maven-plugin</artifactId>
-               <reportSets>
-                 <reportSet>
-                   <reports><report>report</report></reports>
-                 </reportSet>
-               </reportSets>
+               <groupId>org.apache.maven.plugins</groupId>
+               <artifactId>maven-javadoc-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-javadoc-plugin</artifactId>
+               <artifactId>maven-jxr-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <configuration>
-                   <targetJdk>1.8</targetJdk>
+                   <targetJdk>${project.java.target}</targetJdk>
                    <sourceEncoding>utf-8</sourceEncoding>
                    <!-- excludeFromFailureFile>exclude-pmd.properties</excludeFromFailureFile -->
                </configuration>
            </plugin>
-           <plugin>
-               <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-jxr-plugin</artifactId>
-               <version>3.2.0</version>
-           </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
-               <version>3.2.2</version>
                <reportSets>
                  <reportSet>
                    <reports>
@@ -485,20 +503,28 @@
                </configuration>
            </plugin>
            <plugin>
-               <groupId>com.github.spotbugs</groupId>
-               <artifactId>spotbugs-maven-plugin</artifactId>
-               <configuration>
-                   <plugins>
-                       <plugin>
-                           <groupId>com.h3xstream.findsecbugs</groupId>
-                           <artifactId>findsecbugs-plugin</artifactId>
-                           <version>1.11.0</version>
-                       </plugin>
-                   </plugins>
-                   <effort>Max</effort>
-                   <relaxed>false</relaxed>
-                   <excludeFilterFile>src/test/spotbugsFilterFile.xml</excludeFilterFile>
-               </configuration>
+               <groupId>org.codehaus.mojo</groupId>
+               <artifactId>versions-maven-plugin</artifactId>
+               <reportSets>
+                 <reportSet>
+                   <reports>
+                     <report>dependency-updates-report</report>
+                     <report>plugin-updates-report</report>
+                     <report>property-updates-report</report>
+                   </reports>
+                 </reportSet>
+               </reportSets>
+           </plugin>
+           <plugin>
+               <!-- This causes the Jacoco report generated during test to be added to the Project
+                    Reports section of the 'site' report. -->
+               <groupId>org.jacoco</groupId>
+               <artifactId>jacoco-maven-plugin</artifactId>
+               <reportSets>
+                 <reportSet>
+                   <reports><report>report</report></reports>
+                 </reportSet>
+               </reportSets>
            </plugin>
         </plugins>
     </reporting>

From 1416ce94bc2f3c22974843650d80365d144b924f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sat, 7 May 2022 22:23:23 -0300
Subject: [PATCH 25/36] Remove XHTML based logic

---
 .../org/owasp/validator/css/CssScanner.java   |  4 +-
 .../html/scan/ASXHTMLSerializer.java          | 82 -------------------
 .../html/scan/AbstractAntiSamyScanner.java    |  5 --
 .../html/scan/AntiSamySAXScanner.java         |  3 +-
 4 files changed, 3 insertions(+), 91 deletions(-)
 delete mode 100644 src/main/java/org/owasp/validator/html/scan/ASXHTMLSerializer.java

diff --git a/src/main/java/org/owasp/validator/css/CssScanner.java b/src/main/java/org/owasp/validator/css/CssScanner.java
index 5b537e5a..d6dd5e5b 100644
--- a/src/main/java/org/owasp/validator/css/CssScanner.java
+++ b/src/main/java/org/owasp/validator/css/CssScanner.java
@@ -184,8 +184,8 @@ public CleanResults scanStyleSheet(String taintedCss, int sizeLimit) throws Scan
 
         String cleaned = getCleanStylesheetWithImports(sizeLimit, errorMessages, handler);
 
-        if ( isCdata && !policy.isUseXhtml()) {
-            cleaned = "<![CDATA[[" + cleaned + "]]>";
+        if (isCdata) {
+            cleaned = "<![CDATA[" + cleaned + "]]>";
         }
 
         return new CleanResults(startOfScan, cleaned, null, errorMessages);
diff --git a/src/main/java/org/owasp/validator/html/scan/ASXHTMLSerializer.java b/src/main/java/org/owasp/validator/html/scan/ASXHTMLSerializer.java
deleted file mode 100644
index 85cf18f4..00000000
--- a/src/main/java/org/owasp/validator/html/scan/ASXHTMLSerializer.java
+++ /dev/null
@@ -1,82 +0,0 @@
-package org.owasp.validator.html.scan;
-
-import org.apache.xml.serialize.ElementState;
-import org.apache.xml.serialize.OutputFormat;
-import org.owasp.validator.html.InternalPolicy;
-import org.owasp.validator.html.TagMatcher;
-
-import java.io.IOException;
-import java.io.Writer;
-import java.util.Locale;
-
-/**
- * This is an extension of the default XHTMLSerializer class that's had it's endElementIO()
- * method tweaked to serialize closing tags and self-closing tags the way we require.
- */
-@SuppressWarnings("deprecation")
-public class ASXHTMLSerializer extends org.apache.xml.serialize.XHTMLSerializer {
-
-	private boolean encodeAllPossibleEntities;
-	private final TagMatcher allowedEmptyTags;
-	private final TagMatcher requireClosingTags;
-	
-	public ASXHTMLSerializer(Writer w, OutputFormat format, InternalPolicy policy) {
-		super(w, format);
-		this.allowedEmptyTags = policy.getAllowedEmptyTags();
-		this.requireClosingTags = policy.getRequiresClosingTags();
-		this.encodeAllPossibleEntities = policy.isEntityEncodeIntlCharacters();
-	}
-	
-	protected String getEntityRef(int charToPrint) {
-		if(encodeAllPossibleEntities || Constants.big5CharsToEncode.indexOf(charToPrint) != -1)
-			return super.getEntityRef(charToPrint);
-		return null;
-	}
-	
-	public void endElementIO(String namespaceURI, String localName,
-			String rawName) throws IOException {
-		
-		ElementState state;
-
-        // Works much like content() with additions for closing
-		// an element. Note the different checks for the closed
-		// element's state and the parent element's state.
-		_printer.unindent();
-		state = getElementState();
-
-		if (state.empty && isAllowedEmptyTag(rawName) && !requiresClosingTag(rawName)) { //
-			_printer.printText(" />");
-		} else {
-			if(state.empty)
-				_printer.printText('>');
-			// Must leave CData section first
-			if (state.inCData)
-				_printer.printText("]]>");
-			// XHTML: element names are lower case, DOM will be different
-			_printer.printText("</");
-			_printer.printText(state.rawName.toLowerCase(Locale.ENGLISH));
-			_printer.printText('>');
-		}
-
-		// Leave the element state and update that of the parent
-		// (if we're not root) to not empty and after element.
-		state = leaveElementState();
-		// Temporary hack to prevent line breaks inside A/TD
-		if (rawName == null
-				|| (!rawName.equalsIgnoreCase("A") && !rawName
-						.equalsIgnoreCase("TD")))
-
-			state.afterElement = true;
-		state.empty = false;
-		if (isDocumentState())
-			_printer.flush();
-	}
-	
-	private boolean requiresClosingTag(String tagName) {
-        return requireClosingTags.matches(tagName);
-	}
-
-	private boolean isAllowedEmptyTag(String tagName) {
-        return "head".equals(tagName) || allowedEmptyTags.matches( tagName);
-	}
-}
diff --git a/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java b/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java
index ae257e9d..457a613d 100644
--- a/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java
@@ -96,11 +96,6 @@ protected OutputFormat getOutputFormat() {
     }
 
     protected org.apache.xml.serialize.HTMLSerializer getHTMLSerializer(Writer w, OutputFormat format) {
-
-        if (policy.isUseXhtml()) {
-            return new ASXHTMLSerializer(w, format, policy);
-        }
-
         return new ASHTMLSerializer(w, format, policy);
     }
 
diff --git a/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java b/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java
index 87d10d8f..da4aba58 100644
--- a/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java
@@ -164,12 +164,11 @@ public CleanResults scan(Reader reader, Writer writer) throws ScanException {
 
             final Transformer transformer = cachedItem.transformer;
             boolean formatOutput = policy.isFormatOutput();
-            boolean useXhtml = policy.isUseXhtml();
             boolean omitXml = policy.isOmitXmlDeclaration();
 
             transformer.setOutputProperty(OutputKeys.INDENT, formatOutput ? "yes" : "no");
             transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, omitXml ? "yes" : "no");
-            transformer.setOutputProperty(OutputKeys.METHOD, useXhtml ? "xml" : "html");
+            transformer.setOutputProperty(OutputKeys.METHOD, "html");
 
             //noinspection deprecation
             final org.apache.xml.serialize.OutputFormat format = getOutputFormat();

From 254a8431e7553be84e9d16895b3b32b97dde9197 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sat, 7 May 2022 22:24:28 -0300
Subject: [PATCH 26/36] Avoid duplicate attributes on SAX parser

---
 .../validator/html/scan/MagicSAXFilter.java   | 25 +++++++++++--------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java b/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java
index a163dcc3..fe0bcf6e 100644
--- a/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java
+++ b/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java
@@ -312,18 +312,18 @@ public void startElement(QName element, XMLAttributes attributes, Augmentations
 					} else if (attribute != null) {
 						// validate the values against the policy
 						boolean isValid = false;
-                        if (attribute.containsAllowedValue(value.toLowerCase())) {
-                            validattributes.addAttribute(makeSimpleQname(name), "CDATA", value);
+                        if (attribute.containsAllowedValue(value.toLowerCase())
+								|| attribute.matchesAllowedExpression(value)) {
+							int attrIndex;
+							if ((attrIndex = validattributes.getIndex(name)) > 0) {
+								// If attribute is repeated, use last value.
+								validattributes.setValue(attrIndex, value);
+							} else {
+								validattributes.addAttribute(makeSimpleQname(name), "CDATA", value);
+							}
                             isValid = true;
                         }
 
-                        if (!isValid) {
-                            isValid = attribute.matchesAllowedExpression(value);
-                            if (isValid) {
-                                validattributes.addAttribute(makeSimpleQname(name), "CDATA", value);
-                            }
-                        }
-
                         // if value or regexp matched, attribute is already
 						// copied, but what happens if not
 						if (!isValid && "removeTag".equals(attribute.getOnInvalid())) {
@@ -386,7 +386,12 @@ public void startElement(QName element, XMLAttributes attributes, Augmentations
 						}
 						String relValue = Attribute.mergeRelValuesInAnchor(addNofollow, addNoopenerAndNoreferrer, currentRelValue);
 						if (!relValue.isEmpty()){
-							validattributes.addAttribute(makeSimpleQname("rel"), "CDATA", relValue);
+							int relIndex;
+							if ((relIndex = validattributes.getIndex("rel")) > 0) {
+								validattributes.setValue(relIndex, relValue);
+							} else {
+								validattributes.addAttribute(makeSimpleQname("rel"), "CDATA", relValue);
+							}
 						}
 					}
 

From 815a945503c9f4689fb27a747f24788f9407a8a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sat, 7 May 2022 22:25:16 -0300
Subject: [PATCH 27/36] Remove useXHTML usage from policies

---
 src/main/java/org/owasp/validator/html/InternalPolicy.java | 7 -------
 src/main/java/org/owasp/validator/html/Policy.java         | 1 -
 src/main/java/org/owasp/validator/html/scan/Constants.java | 1 -
 src/main/resources/antisamy-anythinggoes.xml               | 1 -
 src/main/resources/antisamy-ebay.xml                       | 1 -
 src/main/resources/antisamy-myspace.xml                    | 1 -
 src/main/resources/antisamy-slashdot.xml                   | 1 -
 src/main/resources/antisamy-tinymce.xml                    | 1 -
 src/main/resources/antisamy.xml                            | 1 -
 9 files changed, 15 deletions(-)

diff --git a/src/main/java/org/owasp/validator/html/InternalPolicy.java b/src/main/java/org/owasp/validator/html/InternalPolicy.java
index cf5e4051..cd2807cf 100644
--- a/src/main/java/org/owasp/validator/html/InternalPolicy.java
+++ b/src/main/java/org/owasp/validator/html/InternalPolicy.java
@@ -22,7 +22,6 @@ public class InternalPolicy extends Policy {
     private final boolean omitXmlDeclaration;
     private final boolean omitDoctypeDeclaration;
     private final boolean entityEncodeIntlCharacters;
-    private final boolean useXhtml;
     private final Tag embedTag;
     private final Tag styleTag;
     private final String onUnknownTag;
@@ -43,7 +42,6 @@ protected InternalPolicy(ParseContext parseContext) {
         this.omitXmlDeclaration = isTrue(Policy.OMIT_XML_DECLARATION);
         this.omitDoctypeDeclaration = isTrue(Policy.OMIT_DOCTYPE_DECLARATION);
         this.entityEncodeIntlCharacters = isTrue(Policy.ENTITY_ENCODE_INTL_CHARS);
-        this.useXhtml = isTrue(Policy.USE_XHTML);
         this.embedTag = getTagByLowercaseName("embed");
         this.onUnknownTag = getDirective("onUnknownTag");
         this.isEncodeUnknownTag = "encode".equals(onUnknownTag);
@@ -69,7 +67,6 @@ protected InternalPolicy(Policy old, Map<String, String> directives, Map<String,
         this.omitXmlDeclaration = isTrue(Policy.OMIT_XML_DECLARATION);
         this.omitDoctypeDeclaration = isTrue(Policy.OMIT_DOCTYPE_DECLARATION);
         this.entityEncodeIntlCharacters = isTrue(Policy.ENTITY_ENCODE_INTL_CHARS);
-        this.useXhtml = isTrue(Policy.USE_XHTML);
         this.embedTag = getTagByLowercaseName("embed");
         this.onUnknownTag = getDirective("onUnknownTag");
         this.isEncodeUnknownTag = "encode".equals(onUnknownTag);
@@ -132,10 +129,6 @@ public boolean isOmitXmlDeclaration() {
         return omitXmlDeclaration;
     }
 
-    public boolean isUseXhtml() {
-        return useXhtml;
-    }
-
     public boolean isOmitDoctypeDeclaration() {
         return omitDoctypeDeclaration;
     }
diff --git a/src/main/java/org/owasp/validator/html/Policy.java b/src/main/java/org/owasp/validator/html/Policy.java
index 5aaad9c2..79e4628a 100644
--- a/src/main/java/org/owasp/validator/html/Policy.java
+++ b/src/main/java/org/owasp/validator/html/Policy.java
@@ -109,7 +109,6 @@ public class Policy {
 
     public static final String OMIT_XML_DECLARATION = "omitXmlDeclaration";
     public static final String OMIT_DOCTYPE_DECLARATION = "omitDoctypeDeclaration";
-    public static final String USE_XHTML = "useXHTML";
     public static final String FORMAT_OUTPUT = "formatOutput";
     public static final String EMBED_STYLESHEETS = "embedStyleSheets";
     public static final String CONNECTION_TIMEOUT = "connectionTimeout";
diff --git a/src/main/java/org/owasp/validator/html/scan/Constants.java b/src/main/java/org/owasp/validator/html/scan/Constants.java
index c65e90d2..f84d164b 100644
--- a/src/main/java/org/owasp/validator/html/scan/Constants.java
+++ b/src/main/java/org/owasp/validator/html/scan/Constants.java
@@ -31,7 +31,6 @@
 
 public class Constants {
 
-    public static final String DEFAULT_ENCODING_ALGORITHM = "UTF-8";
     public static final Tag BASIC_PARAM_TAG_RULE;
     public static final List<String> defaultAllowedEmptyTags;
     public static final List<String> defaultRequireClosingTags;
diff --git a/src/main/resources/antisamy-anythinggoes.xml b/src/main/resources/antisamy-anythinggoes.xml
index 1ec5350f..da6548e1 100644
--- a/src/main/resources/antisamy-anythinggoes.xml
+++ b/src/main/resources/antisamy-anythinggoes.xml
@@ -14,7 +14,6 @@ http://www.w3.org/TR/html401/struct/global.html
 		<directive name="omitXmlDeclaration" value="true"/>
 		<directive name="omitDoctypeDeclaration" value="true"/>
 		<directive name="maxInputSize" value="200000"/>
-		<directive name="useXHTML" value="true"/>
 		<directive name="formatOutput" value="true"/>
 
 		<!--
diff --git a/src/main/resources/antisamy-ebay.xml b/src/main/resources/antisamy-ebay.xml
index 2bac178e..bcbc3f47 100644
--- a/src/main/resources/antisamy-ebay.xml
+++ b/src/main/resources/antisamy-ebay.xml
@@ -14,7 +14,6 @@ http://www.w3.org/TR/html401/struct/global.html
 		<directive name="omitXmlDeclaration" value="true"/>
 		<directive name="omitDoctypeDeclaration" value="true"/>
 		<directive name="maxInputSize" value="20000"/>
-		<directive name="useXHTML" value="true"/>
 		<directive name="formatOutput" value="true"/>
 
 		<!--
diff --git a/src/main/resources/antisamy-myspace.xml b/src/main/resources/antisamy-myspace.xml
index 5e8ecb4f..d26bb8d4 100644
--- a/src/main/resources/antisamy-myspace.xml
+++ b/src/main/resources/antisamy-myspace.xml
@@ -14,7 +14,6 @@ http://www.w3.org/TR/html401/struct/global.html
 		<directive name="omitXmlDeclaration" value="true"/>
 		<directive name="omitDoctypeDeclaration" value="true"/>
 		<directive name="maxInputSize" value="15000"/>
-		<directive name="useXHTML" value="true"/>
 		<directive name="formatOutput" value="true"/>
 
 		<!--
diff --git a/src/main/resources/antisamy-slashdot.xml b/src/main/resources/antisamy-slashdot.xml
index 8f0da973..2cbe9f00 100644
--- a/src/main/resources/antisamy-slashdot.xml
+++ b/src/main/resources/antisamy-slashdot.xml
@@ -17,7 +17,6 @@ Slashdot allowed tags taken from "Reply" page:
 		<directive name="omitXmlDeclaration" value="true"/>
 		<directive name="omitDoctypeDeclaration" value="true"/>
 		<directive name="maxInputSize" value="5000"/>
-		<directive name="useXHTML" value="true"/>
 		<directive name="formatOutput" value="true"/>
 		
 		<directive name="embedStyleSheets" value="false"/>
diff --git a/src/main/resources/antisamy-tinymce.xml b/src/main/resources/antisamy-tinymce.xml
index de952ff1..0b494e03 100644
--- a/src/main/resources/antisamy-tinymce.xml
+++ b/src/main/resources/antisamy-tinymce.xml
@@ -12,7 +12,6 @@
 		<directive name="omitDoctypeDeclaration" value="false" />
 		<directive name="maxInputSize" value="100000" />
 		<directive name="embedStyleSheets" value="false" />
-		<directive name="useXHTML" value="true" />
 		<directive name="formatOutput" value="true" />
 	</directives>
 
diff --git a/src/main/resources/antisamy.xml b/src/main/resources/antisamy.xml
index 1f9c28d5..72742c93 100644
--- a/src/main/resources/antisamy.xml
+++ b/src/main/resources/antisamy.xml
@@ -14,7 +14,6 @@ http://www.w3.org/TR/html401/struct/global.html
 		<directive name="omitXmlDeclaration" value="true"/>
 		<directive name="omitDoctypeDeclaration" value="true"/>
 		<directive name="maxInputSize" value="200000"/>
-		<directive name="useXHTML" value="true"/>
 		<directive name="formatOutput" value="true"/>
 		<directive name="nofollowAnchors" value="true" />
 		<directive name="validateParamAsEmbed" value="true" />

From 2d96cbcea6762845baa9c4f69fbc180c6970556f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sat, 7 May 2022 22:26:24 -0300
Subject: [PATCH 28/36] Update tests to reflect XHTML usage removal

---
 .../owasp/validator/css/CssScannerTest.java   |  7 +-
 .../validator/html/test/AntiSamyTest.java     | 87 +++++++++----------
 2 files changed, 46 insertions(+), 48 deletions(-)

diff --git a/src/test/java/org/owasp/validator/css/CssScannerTest.java b/src/test/java/org/owasp/validator/css/CssScannerTest.java
index 0473ae43..e020632f 100644
--- a/src/test/java/org/owasp/validator/css/CssScannerTest.java
+++ b/src/test/java/org/owasp/validator/css/CssScannerTest.java
@@ -77,12 +77,13 @@ public void testAvoidImportingStyles() throws ScanException {
     public void testAvoidCdataWhenUsingXhtml() throws ScanException {
         final String input = "<![CDATA[.very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}]]>";
 
-        TestPolicy revised = policy.cloneWithDirective(Policy.USE_XHTML,"true");
+        /* Commented due to XHTML deprecation.
+        TestPolicy revised = policy.cloneWithDirective("useXHTML","true");
         CssScanner scanner = new CssScanner(revised, messages);
         assertThat(scanner.scanStyleSheet(input, 1000).getCleanHTML(), not(containsString("CDATA")));
+         */
 
-        revised = policy.cloneWithDirective(Policy.USE_XHTML,"false");
-        scanner = new CssScanner(revised, messages);
+        CssScanner scanner = new CssScanner(policy, messages);
         assertThat(scanner.scanStyleSheet(input, 1000).getCleanHTML(), containsString("CDATA"));
     }
 
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index b46988c4..1a755275 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -35,6 +35,7 @@
 import static org.junit.Assert.fail;
 import static org.hamcrest.CoreMatchers.both;
 import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.either;
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.not;
@@ -54,7 +55,6 @@
 import java.net.URL;
 import java.util.Arrays;
 import java.util.Collections;
-import java.util.concurrent.ExecutionException;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.regex.Matcher;
@@ -395,7 +395,6 @@ public void IllegalXML() throws PolicyException {
 
     @Test
     public void issue12() throws ScanException, PolicyException {
-
         /*
          * issues 12 (and 36, which was similar). empty tags cause display
          * problems/"formjacking"
@@ -415,8 +414,8 @@ public void issue12() throws ScanException, PolicyException {
         assertFalse(p.matcher(s1).matches());
         assertFalse(p.matcher(s2).matches());
 
-        assertTrue(s1.contains("<hr />") || s1.contains("<hr/>"));
-        assertTrue(s2.contains("<hr />") || s2.contains("<hr/>"));
+        assertThat(s1 , containsString("<hr>"));
+        assertThat(s2 , containsString("<hr>"));
     }
 
     @Test
@@ -472,7 +471,7 @@ public void issue30() throws ScanException, PolicyException {
         /* next followup - does non-CDATA parsing still work? */
 
         String s3 = "<style>P {\n\tmargin-bottom: 0.08in;\n}\n";
-        cr = as.scan(s3, policy.cloneWithDirective(Policy.USE_XHTML, "false"), AntiSamy.DOM);
+        cr = as.scan(s3, policy, AntiSamy.DOM);
         assertEquals("<style>P {\n\tmargin-bottom: 0.08in;\n}\n</style>\n", cr.getCleanHTML());
     }
 
@@ -906,7 +905,9 @@ public void issue107() throws ScanException, PolicyException {
 
     @Test
     public void issue112() throws ScanException, PolicyException {
-        TestPolicy revised = policy.cloneWithDirective(Policy.PRESERVE_COMMENTS, "true").cloneWithDirective(Policy.PRESERVE_SPACE, "true").cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
+        TestPolicy revised = policy.cloneWithDirective(Policy.PRESERVE_COMMENTS, "true")
+                .cloneWithDirective(Policy.PRESERVE_SPACE, "true")
+                .cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
 
         /*
         * #112 - empty tag becomes self closing
@@ -922,13 +923,12 @@ public void issue112() throws ScanException, PolicyException {
 
         StringBuilder sb = new StringBuilder();
         sb.append("<html><head><title>foobar</title></head><body>");
-        sb.append("<img src=\"http://foobar.com/pic.gif\" /></body></html>");
+        sb.append("<img src=\"http://foobar.com/pic.gif\"></body></html>");
 
         html = sb.toString();
 
-        Policy aTrue = revised.cloneWithDirective(Policy.USE_XHTML, "true");
-        crDom = as.scan(html, aTrue, AntiSamy.DOM).getCleanHTML();
-        crSax = as.scan(html, aTrue, AntiSamy.SAX).getCleanHTML();
+        crDom = as.scan(html, revised, AntiSamy.DOM).getCleanHTML();
+        crSax = as.scan(html, revised, AntiSamy.SAX).getCleanHTML();
 
         assertTrue(html.equals(crDom));
         assertTrue(html.equals(crSax));
@@ -959,21 +959,13 @@ public void issue101InternationalCharacterSupport() throws ScanException, Policy
         assertTrue(crDom.contains("\u00e4"));
         assertTrue(crSax.contains("\u00e4"));
 
-        Policy revised2 = policy.cloneWithDirective(Policy.USE_XHTML, "false").cloneWithDirective(Policy.ENTITY_ENCODE_INTL_CHARS, "true");
+        Policy revised2 = policy.cloneWithDirective(Policy.ENTITY_ENCODE_INTL_CHARS, "true");
         crDom = as.scan(html, revised2, AntiSamy.DOM).getCleanHTML();
         crSax = as.scan(html, revised2, AntiSamy.SAX).getCleanHTML();
         assertTrue(!crDom.contains("\u00e4"));
         assertTrue(crDom.contains("&auml;"));
         assertTrue(!crSax.contains("\u00e4"));
         assertTrue(crSax.contains("&auml;"));
-
-        Policy revised3 = policy.cloneWithDirective(Policy.USE_XHTML, "true").cloneWithDirective(Policy.ENTITY_ENCODE_INTL_CHARS, "true");
-        crDom = as.scan(html, revised3, AntiSamy.DOM).getCleanHTML();
-        crSax = as.scan(html, revised3, AntiSamy.SAX).getCleanHTML();
-        assertTrue(!crDom.contains("\u00e4"));
-        assertTrue(crDom.contains("&auml;"));
-        assertTrue(!crSax.contains("\u00e4"));
-        assertTrue(crSax.contains("&auml;"));
     }
 
     @Test
@@ -1028,23 +1020,23 @@ public void nofollowAnchors() throws ScanException, PolicyException {
     @Test
     public void validateParamAsEmbed() throws ScanException, PolicyException {
         // activate policy setting for this test
-        Policy revised = policy.cloneWithDirective(Policy.VALIDATE_PARAM_AS_EMBED, "true").cloneWithDirective(Policy.FORMAT_OUTPUT, "false").cloneWithDirective(Policy.USE_XHTML, "true");
+        Policy revised = policy.cloneWithDirective(Policy.VALIDATE_PARAM_AS_EMBED, "true").cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
 
         // let's start with a YouTube embed
         String input = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
-        String expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" /><param name=\"allowFullScreen\" value=\"true\" /><param name=\"allowscriptaccess\" value=\"always\" /><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\" /></object>";
+        String expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\"></embed></object>";
         CleanResults cr = as.scan(input, revised, AntiSamy.DOM);
         assertThat(cr.getCleanHTML(), containsString(expectedOutput));
 
-        String saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" /><param name=\"allowFullScreen\" value=\"true\" /><param name=\"allowscriptaccess\" value=\"always\" /><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\" /></object>";
+        String saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
         cr = as.scan(input, revised, AntiSamy.SAX);
         assertThat(cr.getCleanHTML(), equalTo(saxExpectedOutput));
 
         // now what if someone sticks malicious URL in the value of the
         // value attribute in the param tag? remove that param tag
         input = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://supermaliciouscode.com/badstuff.swf\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
-        expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"allowFullScreen\" value=\"true\" /><param name=\"allowscriptaccess\" value=\"always\" /><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\" /></object>";
-        saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"allowFullScreen\" value=\"true\" /><param name=\"allowscriptaccess\" value=\"always\" /><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\" /></object>";
+        expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\"></embed></object>";
+        saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
         cr = as.scan(input, revised, AntiSamy.DOM);
         assertThat(cr.getCleanHTML(), containsString(expectedOutput));
 
@@ -1054,8 +1046,8 @@ public void validateParamAsEmbed() throws ScanException, PolicyException {
         // now what if someone sticks malicious URL in the value of the src
         // attribute in the embed tag? remove that embed tag
         input = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://hereswhereikeepbadcode.com/ohnoscary.swf\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
-        expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" /><param name=\"allowFullScreen\" value=\"true\" /><param name=\"allowscriptaccess\" value=\"always\" /></object>";
-        saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" /><param name=\"allowFullScreen\" value=\"true\" /><param name=\"allowscriptaccess\" value=\"always\" /></object>";
+        expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"></object>";
+        saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"></object>";
 
         cr = as.scan(input, revised, AntiSamy.DOM);
         assertThat(cr.getCleanHTML(), containsString(expectedOutput));
@@ -1202,10 +1194,11 @@ public void issue144() throws ScanException, PolicyException {
     @Test
     public void testWhitespaceNotBeingMangled() throws ScanException, PolicyException {
         String test = "<select name=\"name\"><option value=\"Something\">Something</select>";
-        String expected = "<select name=\"name\"><option value=\"Something\">Something</option></select>";
+        // option closing tag is not mandatory
+        String expected = "<select name=\"name\"><option value=\"Something\">Something</select>";
         Policy preserveSpace = policy.cloneWithDirective( Policy.PRESERVE_SPACE, "true" );
         CleanResults preserveSpaceResults = as.scan(test, preserveSpace, AntiSamy.SAX);
-        assertEquals( expected, preserveSpaceResults.getCleanHTML() );
+        assertEquals(expected, preserveSpaceResults.getCleanHTML());
     }
 
     @Test
@@ -1239,8 +1232,8 @@ public void testXSSInAntiSamy151() throws ScanException, PolicyException {
         CleanResults results_sax = as.scan(test, policy, AntiSamy.SAX);
         CleanResults results_dom = as.scan(test, policy, AntiSamy.DOM);
 
-        assertEquals( results_sax.getCleanHTML(), results_dom.getCleanHTML());
-        assertEquals("whatever<img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\" />", results_dom.getCleanHTML());
+        assertEquals(results_sax.getCleanHTML(), results_dom.getCleanHTML());
+        assertEquals("whatever<img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\">", results_dom.getCleanHTML());
     }
 
     @Test
@@ -1273,13 +1266,13 @@ public void testUnknownTags() throws ScanException, PolicyException {
     }
     
     @Test
-    public void testStreamScan() throws ScanException, PolicyException, InterruptedException, ExecutionException {
-        String testImgSrcURL = "<img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\" ";
-        Reader reader = new StringReader("<bogus>whatever</bogus>" + testImgSrcURL + "onmouseover=\"alert('xss')\">");
+    public void testStreamScan() throws ScanException {
+        String testImgSrcURL = "<img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\"";
+        Reader reader = new StringReader("<bogus>whatever</bogus>" + testImgSrcURL + " onmouseover=\"alert('xss')\">");
         Writer writer = new StringWriter();
         as.scan(reader, writer, policy);
         String cleanHtml = writer.toString().trim();
-        assertEquals("whatever" + testImgSrcURL + "/>", cleanHtml);
+        assertEquals("whatever" + testImgSrcURL + ">", cleanHtml);
     }
     
     @Test
@@ -1293,8 +1286,11 @@ public void testGithubIssue23() throws ScanException, PolicyException {
     	
     	// The a.replaceAll("\\s","") is used to strip out all the whitespace in the CleanHTML so we can successfully find
     	// what we expect to find.
-        assertThat(as.scan(test23, policy, AntiSamy.SAX).getCleanHTML().replaceAll("\\s",""), containsString("<ul><li>a</li>"));
-        assertThat(as.scan(test23, policy, AntiSamy.DOM).getCleanHTML().replaceAll("\\s",""), containsString("<ul><li>a</li>"));
+        // Tags like UL and LI have optional closing, so they are not closed on output for now.
+        assertThat(as.scan(test23, policy, AntiSamy.DOM).getCleanHTML().replaceAll("\\s",""),
+                either(containsString("<ul><li>a</li>")).or(containsString("<ul><li>a<li>")));
+        assertThat(as.scan(test23, policy, AntiSamy.SAX).getCleanHTML().replaceAll("\\s",""),
+                either(containsString("<ul><li>a</li>")).or(containsString("<ul><li>a<li>")));
         
         // However, the test above can't replicate this misbehavior.
     }
@@ -1513,10 +1509,10 @@ public void entityReferenceEncodedInHtmlAttribute() throws ScanException, Policy
         // All this when not using the XHTML serializer.
 
         // UPDATE:  Using a new HTML parser library starts decoding entities like #00058
-        Policy revised = policy.cloneWithDirective("useXHTML","false");
-        assertThat(as.scan("<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>", revised, AntiSamy.DOM).getCleanHTML(),
+        // UPDATE 2: XHTML is no longer used
+        assertThat(as.scan("<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>", policy, AntiSamy.DOM).getCleanHTML(),
                 not(containsString("javascript")));
-        assertThat(as.scan("<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>", revised, AntiSamy.SAX).getCleanHTML(),
+        assertThat(as.scan("<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>", policy, AntiSamy.SAX).getCleanHTML(),
                 not(containsString("javascript")));
     }
 
@@ -1710,17 +1706,18 @@ public void testSmuggledTagsInStyleContent() throws ScanException, PolicyExcepti
         // HTML tags may be smuggled into a style tag after parsing input to an internal representation.
         // If that happens, they should be treated as text content and not as children nodes.
 
-        Policy revised = policy.cloneWithDirective(Policy.USE_XHTML,"true");
+        /* Commented due to XHTML deprecation.
+        Policy revised = policy.cloneWithDirective("useXHTML","true");
         assertThat(as.scan("<style/>b<![cdata[</style><a href=javascript:alert(1)>test", revised, AntiSamy.DOM).getCleanHTML(), not(containsString("javascript")));
         assertThat(as.scan("<style/>b<![cdata[</style><a href=javascript:alert(1)>test", revised, AntiSamy.SAX).getCleanHTML(), not(containsString("javascript")));
         assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised, AntiSamy.DOM).getCleanHTML(), not(containsString("input")));
         assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised, AntiSamy.SAX).getCleanHTML(), not(containsString("input")));
+        */
 
-        Policy revised2 = policy.cloneWithDirective(Policy.USE_XHTML,"false");
-        assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", revised2, AntiSamy.DOM).getCleanHTML(), not(containsString("script")));
-        assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", revised2, AntiSamy.SAX).getCleanHTML(), not(containsString("script")));
-        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised2, AntiSamy.DOM).getCleanHTML(), not(containsString("input")));
-        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised2, AntiSamy.SAX).getCleanHTML(), not(containsString("input")));
+        assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", policy, AntiSamy.DOM).getCleanHTML(), not(containsString("script")));
+        assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", policy, AntiSamy.SAX).getCleanHTML(), not(containsString("script")));
+        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", policy, AntiSamy.DOM).getCleanHTML(), not(containsString("input")));
+        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", policy, AntiSamy.SAX).getCleanHTML(), not(containsString("input")));
     }
 
     @Test(timeout = 4000)

From 87ee48ca173776a39bb76aca6e2fecd9da36afb4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Sat, 21 May 2022 17:32:30 -0300
Subject: [PATCH 29/36] Make optional-closing tags close on output

---
 .../org/owasp/validator/css/CssScanner.java   |  2 +-
 .../validator/html/scan/ASHTMLSerializer.java |  2 +-
 .../owasp/validator/css/CssScannerTest.java   |  9 +--------
 .../validator/html/test/AntiSamyTest.java     | 19 +++----------------
 4 files changed, 6 insertions(+), 26 deletions(-)

diff --git a/src/main/java/org/owasp/validator/css/CssScanner.java b/src/main/java/org/owasp/validator/css/CssScanner.java
index d6dd5e5b..90543d73 100644
--- a/src/main/java/org/owasp/validator/css/CssScanner.java
+++ b/src/main/java/org/owasp/validator/css/CssScanner.java
@@ -160,7 +160,7 @@ public CleanResults scanStyleSheet(String taintedCss, int sizeLimit) throws Scan
         Matcher m = cdataMatchPattern.matcher(taintedCss);
         boolean isCdata = m.matches();
 
-        if ( isCdata ) {
+        if (isCdata) {
             taintedCss = m.group(1);
         }
 
diff --git a/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java b/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java
index 9492a2c2..f0a2ff69 100644
--- a/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java
+++ b/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java
@@ -45,7 +45,7 @@ public void endElementIO(String namespaceURI, String localName,
 		// last element and this element's closing tag.
 		// [keith] Provided this is not an anchor.
 		// HTML: some elements do not print closing tag (e.g. LI)
-		if (rawName == null || !HTMLdtd.isOnlyOpening(rawName)) {
+		if (rawName == null || !HTMLdtd.isOnlyOpening(rawName) || HTMLdtd.isOptionalClosing(rawName)) {
 			if (_indenting && !state.preserveSpace && state.afterElement)
 				_printer.breakLine();
 			// Must leave CData section first (Illegal in HTML, but still)
diff --git a/src/test/java/org/owasp/validator/css/CssScannerTest.java b/src/test/java/org/owasp/validator/css/CssScannerTest.java
index e020632f..3de36a28 100644
--- a/src/test/java/org/owasp/validator/css/CssScannerTest.java
+++ b/src/test/java/org/owasp/validator/css/CssScannerTest.java
@@ -74,15 +74,8 @@ public void testAvoidImportingStyles() throws ScanException {
     }
 
     @Test
-    public void testAvoidCdataWhenUsingXhtml() throws ScanException {
+    public void testReAddCdataIfPresentInStyle() throws ScanException {
         final String input = "<![CDATA[.very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}]]>";
-
-        /* Commented due to XHTML deprecation.
-        TestPolicy revised = policy.cloneWithDirective("useXHTML","true");
-        CssScanner scanner = new CssScanner(revised, messages);
-        assertThat(scanner.scanStyleSheet(input, 1000).getCleanHTML(), not(containsString("CDATA")));
-         */
-
         CssScanner scanner = new CssScanner(policy, messages);
         assertThat(scanner.scanStyleSheet(input, 1000).getCleanHTML(), containsString("CDATA"));
     }
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index 1a755275..ed6008f6 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1194,8 +1194,7 @@ public void issue144() throws ScanException, PolicyException {
     @Test
     public void testWhitespaceNotBeingMangled() throws ScanException, PolicyException {
         String test = "<select name=\"name\"><option value=\"Something\">Something</select>";
-        // option closing tag is not mandatory
-        String expected = "<select name=\"name\"><option value=\"Something\">Something</select>";
+        String expected = "<select name=\"name\"><option value=\"Something\">Something</option></select>";
         Policy preserveSpace = policy.cloneWithDirective( Policy.PRESERVE_SPACE, "true" );
         CleanResults preserveSpaceResults = as.scan(test, preserveSpace, AntiSamy.SAX);
         assertEquals(expected, preserveSpaceResults.getCleanHTML());
@@ -1286,11 +1285,8 @@ public void testGithubIssue23() throws ScanException, PolicyException {
     	
     	// The a.replaceAll("\\s","") is used to strip out all the whitespace in the CleanHTML so we can successfully find
     	// what we expect to find.
-        // Tags like UL and LI have optional closing, so they are not closed on output for now.
-        assertThat(as.scan(test23, policy, AntiSamy.DOM).getCleanHTML().replaceAll("\\s",""),
-                either(containsString("<ul><li>a</li>")).or(containsString("<ul><li>a<li>")));
-        assertThat(as.scan(test23, policy, AntiSamy.SAX).getCleanHTML().replaceAll("\\s",""),
-                either(containsString("<ul><li>a</li>")).or(containsString("<ul><li>a<li>")));
+        assertThat(as.scan(test23, policy, AntiSamy.DOM).getCleanHTML().replaceAll("\\s",""), containsString("<ul><li>a</li>"));
+        assertThat(as.scan(test23, policy, AntiSamy.SAX).getCleanHTML().replaceAll("\\s",""), containsString("<ul><li>a</li>"));
         
         // However, the test above can't replicate this misbehavior.
     }
@@ -1705,15 +1701,6 @@ public void testGithubIssue151() throws ScanException, PolicyException {
     public void testSmuggledTagsInStyleContent() throws ScanException, PolicyException {
         // HTML tags may be smuggled into a style tag after parsing input to an internal representation.
         // If that happens, they should be treated as text content and not as children nodes.
-
-        /* Commented due to XHTML deprecation.
-        Policy revised = policy.cloneWithDirective("useXHTML","true");
-        assertThat(as.scan("<style/>b<![cdata[</style><a href=javascript:alert(1)>test", revised, AntiSamy.DOM).getCleanHTML(), not(containsString("javascript")));
-        assertThat(as.scan("<style/>b<![cdata[</style><a href=javascript:alert(1)>test", revised, AntiSamy.SAX).getCleanHTML(), not(containsString("javascript")));
-        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised, AntiSamy.DOM).getCleanHTML(), not(containsString("input")));
-        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised, AntiSamy.SAX).getCleanHTML(), not(containsString("input")));
-        */
-
         assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", policy, AntiSamy.DOM).getCleanHTML(), not(containsString("script")));
         assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", policy, AntiSamy.SAX).getCleanHTML(), not(containsString("script")));
         assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", policy, AntiSamy.DOM).getCleanHTML(), not(containsString("input")));

From a788ebee148894b35997a4a81b5bc6d845a827a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Passaro?= <sebastian.passaro@owasp.org>
Date: Fri, 1 Jul 2022 19:39:43 -0300
Subject: [PATCH 30/36] Update changes from main in pom.xml and SECURITY.md

---
 SECURITY.md |  6 ++++++
 pom.xml     | 27 ++++++++++++++-------------
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index b94c7ccc..7b7dc0a2 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -31,3 +31,9 @@ These are the known CVEs reported for AntiSamy:
 * AntiSamy CVE #1 - CVE-2016-10006: XSS Bypass in AntiSamy before v1.5.5 - https://www.cvedetails.com/cve/CVE-2016-10006
 * AntiSamy CVE #2 - CVE-2017-14735: XSS via HTML5 Entities in AntiSamy before v1.5.7 - https://www.cvedetails.com/cve/CVE-2017-14735
 * AntiSamy CVE #3 - CVE-2021-35043: XSS via HTML attributes using &#00058 as replacement for : character before v1.6.4 - https://www.cvedetails.com/cve/CVE-2021-35043
+* AntiSamy CVE #4 - CVE-2022-28367: AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content. https://www.cvedetails.com/cve/CVE-2022-28367. NOTE: This release only included a PARTIAL fix.
+* AntiSamy CVE #5 - CVE-2022-29577: AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content. - https://www.cvedetails.com/cve/CVE-2022-29577. This is the complete fix to the previous CVE.
+
+CVEs in AntiSamy dependencies:
+* AntiSamy prior to 1.6.6 used the old CyberNeko HTML library v1.9.22, which is subject to https://www.cvedetails.com/cve/CVE-2022-28366 and no longer maintained. AntiSamy 1.6.6 upgraded to an active fork of CyberNeko called HtmlUnit-Neko which fixed this CVE in v2.27 of that library. AntiSamy 1.6.6 upgraded to version 2.60.0 of HtmlUnit-Neko.
+* AntiSamy 1.6.8 upgraded to HtmlUnit-Neko v2.61.0 because v2.60.0 is subject to https://www.cvedetails.com/cve/CVE-2022-29546
diff --git a/pom.xml b/pom.xml
index 0f627f2f..dec28722 100644
--- a/pom.xml
+++ b/pom.xml
@@ -43,13 +43,13 @@
     <properties>
         <gpg.skip>true</gpg.skip><!-- by default skip gpg -->
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <project.build.outputTimestamp>2022-02-30T14:33:00Z</project.build.outputTimestamp>
+        <project.build.outputTimestamp>2022-06-26T19:54:30Z</project.build.outputTimestamp>
         <project.java.target>1.8</project.java.target>
         <version.findsecbugs>1.12.0</version.findsecbugs>
         <version.io>2.11.0</version.io>
         <version.slf4j>1.7.36</version.slf4j>
-        <version.spotbugs.maven>4.6.0.0</version.spotbugs.maven>
-        <version.spotbugs>4.6.0</version.spotbugs>
+        <version.spotbugs.maven>4.7.0.0</version.spotbugs.maven>
+        <version.spotbugs>4.7.0</version.spotbugs>
     </properties>
 
     <profiles>
@@ -65,7 +65,7 @@
         <dependency>
             <groupId>net.sourceforge.htmlunit</groupId>
             <artifactId>neko-htmlunit</artifactId>
-            <version>2.61.0</version>
+            <version>2.62.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.httpcomponents.client5</groupId>
@@ -212,7 +212,7 @@
                <plugin>
                   <groupId>org.apache.maven.plugins</groupId>
                   <artifactId>maven-release-plugin</artifactId>
-                  <version>3.0.0-M5</version>
+                  <version>3.0.0-M6</version>
                </plugin>
             </plugins>
         </pluginManagement>
@@ -246,7 +246,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-enforcer-plugin</artifactId>
-                <version>3.0.0</version>
+                <version>3.1.0</version>
                 <dependencies>
                     <dependency>
                         <groupId>org.codehaus.mojo</groupId>
@@ -343,12 +343,12 @@
             <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
-               <version>3.16.0</version>
+               <version>3.17.0</version>
             </plugin>
             <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
-               <version>3.2.2</version>
+               <version>3.3.0</version>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -358,7 +358,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-site-plugin</artifactId>
-                <version>3.12.0</version>
+                <version>4.0.0-M1</version>
             </plugin>
             <plugin>
                <groupId>org.apache.maven.plugins</groupId>
@@ -375,17 +375,17 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.0.0-M6</version>
+                <version>3.0.0-M7</version>
             </plugin>
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>versions-maven-plugin</artifactId>
-                <version>2.10.0</version>
+                <version>2.11.0</version>
             </plugin>
             <plugin>
                 <groupId>org.cyclonedx</groupId>
                 <artifactId>cyclonedx-maven-plugin</artifactId>
-                <version>2.5.3</version>
+                <version>2.7.0</version>
                 <executions>
                   <execution>
                     <phase>package</phase>
@@ -445,7 +445,6 @@
                 <artifactId>findsecbugs-plugin</artifactId>
                 <version>${version.findsecbugs}</version>
             </plugin>
-
         </plugins>
     </build>
 
@@ -470,6 +469,7 @@
                    <excludeFilterFile>src/test/spotbugsFilterFile.xml</excludeFilterFile>
                </configuration>
            </plugin>
+
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
@@ -502,6 +502,7 @@
                  <dependencyLocationsEnabled>false</dependencyLocationsEnabled>
                </configuration>
            </plugin>
+
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>versions-maven-plugin</artifactId>

From 873979213a8984d48325d7b5735a51ea09ba7ba6 Mon Sep 17 00:00:00 2001
From: Dave Wichers <dwichers@gmail.com>
Date: Sat, 9 Jul 2022 15:19:05 -0400
Subject: [PATCH 31/36] Remove a deprecated CssHandler constructor to address 1
 task in issue #195. Most of the deprecated items listed in this issue have
 already been addressed by @spassarop.

---
 .../org/owasp/validator/css/CssHandler.java   | 31 ++-----------------
 .../java/org/owasp/validator/html/Policy.java | 10 +++---
 .../org/owasp/validator/html/TagMatcher.java  |  4 +--
 .../validator/html/test/AntiSamyTest.java     |  2 --
 4 files changed, 10 insertions(+), 37 deletions(-)

diff --git a/src/main/java/org/owasp/validator/css/CssHandler.java b/src/main/java/org/owasp/validator/css/CssHandler.java
index 6a669daf..18543611 100644
--- a/src/main/java/org/owasp/validator/css/CssHandler.java
+++ b/src/main/java/org/owasp/validator/css/CssHandler.java
@@ -127,12 +127,12 @@ public class CssHandler implements DocumentHandler {
 	 *            the error message bundle to pull from
 	 */
 	public CssHandler(Policy policy, List<String> errorMessages, ResourceBundle messages) {
-		this(policy, null, errorMessages, null, messages);
+		this(policy, errorMessages, messages, null);
 	}
 
 	/**
 	 * Constructs a handler for stylesheets using the given policy. The List of embedded stylesheets
-	 * produced by this constructor is now available via the getImportedStylesheetsURIList() method.
+	 * produced by this constructor is available via the getImportedStylesheetsURIList() method.
 	 *
 	 * @param policy
 	 *            the policy to use
@@ -144,31 +144,6 @@ public CssHandler(Policy policy, List<String> errorMessages, ResourceBundle mess
 	 *            the tag name associated with this inline style
 	 */
 	public CssHandler(Policy policy, List<String> errorMessages, ResourceBundle messages, String tagName) {
-		this(policy, null, errorMessages, tagName, messages);
-	}
-
-	/**
-	 * Constructs a handler for inline style declarations using the given policy
-	 * and queue for imported stylesheets.
-	 *
-	 * @param policy
-	 *            the policy to use
-	 * @param embeddedStyleSheets
-	 *            the queue of stylesheets imported
-	 * @param errorMessages
-	 *            the List of error messages to add error messages too if there are errors
-	 * @param tagName
-	 *            the tag name associated with this inline style
-	 * @param messages
-	 *            the error message bundle to pull from
-	 *
-	 * @deprecated The embeddedStyleSheets List parameter is removed in the newer version of
-	 * this constructor as the handler has its own internal list that can be accessed through
-	 * the getImportedStylesheetsURIList() method.
-	 */
-	@Deprecated
-	public CssHandler(Policy policy, LinkedList<URI> embeddedStyleSheets,
-					  List<String> errorMessages, String tagName, ResourceBundle messages) {
 		assert policy instanceof InternalPolicy : policy.getClass();
 		this.policy = (InternalPolicy) policy;
 		this.errorMessages = errorMessages;
@@ -176,7 +151,7 @@ public CssHandler(Policy policy, LinkedList<URI> embeddedStyleSheets,
 		this.validator = new CssValidator(policy);
 		// Create a queue of all style sheets that need to be validated to
 		// account for any sheets that may be imported by the current CSS
-		this.importedStyleSheets = (embeddedStyleSheets != null ? embeddedStyleSheets : new LinkedList<URI>());
+		this.importedStyleSheets = new LinkedList<URI>();
 		this.tagName = tagName;
 		this.isInline = (tagName != null);
 	}
diff --git a/src/main/java/org/owasp/validator/html/Policy.java b/src/main/java/org/owasp/validator/html/Policy.java
index 79e4628a..cba081e9 100644
--- a/src/main/java/org/owasp/validator/html/Policy.java
+++ b/src/main/java/org/owasp/validator/html/Policy.java
@@ -386,6 +386,7 @@ private static InputStream toByteArrayStream(InputStream in) throws PolicyExcept
 
     private static Element getDocumentElementFromSource(InputSource source, boolean schemaValidationEnabled)
             throws ParserConfigurationException, SAXException, IOException {
+    	// FIXME: remove boolean schemaValidationEnabled from this API and refactor all callers. 
 
         DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
 
@@ -397,11 +398,10 @@ private static Element getDocumentElementFromSource(InputSource source, boolean
         dbf.setFeature(DISALLOW_DOCTYPE_DECL, true);
         dbf.setFeature(LOAD_EXTERNAL_DTD, false);
 
-        if (schemaValidationEnabled) {
-            getPolicySchema();
-            dbf.setNamespaceAware(true);
-            dbf.setSchema(schema);
-        }
+    	// Schema validation is always required now. So turn it on.
+        getPolicySchema();
+        dbf.setNamespaceAware(true);
+        dbf.setSchema(schema);
 
         DocumentBuilder db = dbf.newDocumentBuilder();
         db.setErrorHandler(new SAXErrorHandler());
diff --git a/src/main/java/org/owasp/validator/html/TagMatcher.java b/src/main/java/org/owasp/validator/html/TagMatcher.java
index 3f55cab2..0695efc6 100644
--- a/src/main/java/org/owasp/validator/html/TagMatcher.java
+++ b/src/main/java/org/owasp/validator/html/TagMatcher.java
@@ -43,9 +43,9 @@ public TagMatcher(Iterable<String> allowedValues) {
     /**
      * Examines if this tag matches the values in this matcher.
      *
-     * Please note that this is case-insensitive, which is ok for html and xhtml, but not really for xml
+     * Please note that this is case-insensitive, which is OK for HTML, but not really for XML
      * @param tagName The tag name to look for
-     * @return true if the tag name matches this mach
+     * @return true if the tag name matches this matcher
      */
     public boolean matches(String tagName) {
         return allowedLowercase.contains(tagName.toLowerCase());
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index ed6008f6..9a6d19cf 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -1502,10 +1502,8 @@ public void testGithubIssue81() throws ScanException, PolicyException {
     public void entityReferenceEncodedInHtmlAttribute() throws ScanException, PolicyException {
         // Concern is that "&" is not being encoded and "#00058" was not being interpreted as ":"
         // so the validations based on regexp passed and a browser would load "&:" together.
-        // All this when not using the XHTML serializer.
 
         // UPDATE:  Using a new HTML parser library starts decoding entities like #00058
-        // UPDATE 2: XHTML is no longer used
         assertThat(as.scan("<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>", policy, AntiSamy.DOM).getCleanHTML(),
                 not(containsString("javascript")));
         assertThat(as.scan("<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>", policy, AntiSamy.SAX).getCleanHTML(),

From b85dd706c886269fb9e1c7c909b380e1ae5ae2fd Mon Sep 17 00:00:00 2001
From: Dave Wichers <dwichers@gmail.com>
Date: Sat, 9 Jul 2022 16:15:44 -0400
Subject: [PATCH 32/36] Update the copyright date on all files not yet marked
 2022. Eliminate one more deprecated item. Update the pom to match the changes
 made in the main branch.

---
 LICENSE                                       |  2 +-
 pom.xml                                       |  8 +--
 .../org/owasp/validator/css/CssScanner.java   |  2 +-
 .../org/owasp/validator/css/CssValidator.java |  2 +-
 .../css/UnknownSelectorException.java         |  4 +-
 .../org/owasp/validator/html/AntiSamy.java    |  5 +-
 .../owasp/validator/html/CleanResults.java    |  5 +-
 .../owasp/validator/html/InternalPolicy.java  |  4 +-
 .../java/org/owasp/validator/html/Policy.java |  5 +-
 .../owasp/validator/html/PolicyException.java |  2 +-
 .../owasp/validator/html/ScanException.java   |  2 +-
 .../validator/html/model/AntiSamyPattern.java |  2 +-
 .../owasp/validator/html/model/Attribute.java | 15 +++--
 .../owasp/validator/html/model/Property.java  |  2 +-
 .../org/owasp/validator/html/model/Tag.java   |  2 +-
 .../html/scan/AbstractAntiSamyScanner.java    |  2 +-
 .../html/scan/AntiSamyDOMScanner.java         |  2 +-
 .../owasp/validator/html/scan/Constants.java  |  2 +-
 .../validator/html/util/ErrorMessageUtil.java |  2 +-
 .../html/util/HTMLEntityEncoder.java          |  2 +-
 .../owasp/validator/html/util/URIUtils.java   |  2 +-
 .../owasp/validator/html/util/XMLUtil.java    |  2 +-
 src/main/resources/antisamy.xml               | 55 +++++++++----------
 .../html/test/AntiSamyPerformanceTest.java    |  2 +-
 .../validator/html/test/LiteralTest.java      |  2 +-
 25 files changed, 68 insertions(+), 67 deletions(-)

diff --git a/LICENSE b/LICENSE
index 4e8f246f..b6d9437f 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2007-2020, Arshan Dabirsiaghi, Jason Li
+Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
 
 All rights reserved.
 
diff --git a/pom.xml b/pom.xml
index dec28722..8dacb3eb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -48,8 +48,8 @@
         <version.findsecbugs>1.12.0</version.findsecbugs>
         <version.io>2.11.0</version.io>
         <version.slf4j>1.7.36</version.slf4j>
-        <version.spotbugs.maven>4.7.0.0</version.spotbugs.maven>
-        <version.spotbugs>4.7.0</version.spotbugs>
+        <version.spotbugs.maven>4.7.1.0</version.spotbugs.maven>
+        <version.spotbugs>4.7.1</version.spotbugs>
     </properties>
 
     <profiles>
@@ -186,7 +186,7 @@
                <plugin>
                   <groupId>org.apache.maven.plugins</groupId>
                   <artifactId>maven-assembly-plugin</artifactId>
-                  <version>3.3.0</version>
+                  <version>3.4.1</version>
                </plugin>
                <plugin>
                   <groupId>org.apache.maven.plugins</groupId>
@@ -358,7 +358,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-site-plugin</artifactId>
-                <version>4.0.0-M1</version>
+                <version>4.0.0-M2</version>
             </plugin>
             <plugin>
                <groupId>org.apache.maven.plugins</groupId>
diff --git a/src/main/java/org/owasp/validator/css/CssScanner.java b/src/main/java/org/owasp/validator/css/CssScanner.java
index 90543d73..0f0e67ec 100644
--- a/src/main/java/org/owasp/validator/css/CssScanner.java
+++ b/src/main/java/org/owasp/validator/css/CssScanner.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  *
  * All rights reserved.
  *
diff --git a/src/main/java/org/owasp/validator/css/CssValidator.java b/src/main/java/org/owasp/validator/css/CssValidator.java
index 8c92a500..f07bc31c 100644
--- a/src/main/java/org/owasp/validator/css/CssValidator.java
+++ b/src/main/java/org/owasp/validator/css/CssValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2019, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/css/UnknownSelectorException.java b/src/main/java/org/owasp/validator/css/UnknownSelectorException.java
index e127c726..31b7f640 100644
--- a/src/main/java/org/owasp/validator/css/UnknownSelectorException.java
+++ b/src/main/java/org/owasp/validator/css/UnknownSelectorException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
@@ -24,12 +24,10 @@
 package org.owasp.validator.css;
 
 /**
- * 
  * This exception gets thrown when there is an unrecognized Selector type parsing
  * the tainted CSS.
  * 
  * @author Jason Li
- *
  */
 import org.owasp.validator.html.ScanException;
 
diff --git a/src/main/java/org/owasp/validator/html/AntiSamy.java b/src/main/java/org/owasp/validator/html/AntiSamy.java
index d9c2fd95..b1803308 100644
--- a/src/main/java/org/owasp/validator/html/AntiSamy.java
+++ b/src/main/java/org/owasp/validator/html/AntiSamy.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2019, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
@@ -32,12 +32,11 @@
 import java.io.Writer;
 
 /**
- * 
  * This is the only class from which the outside world should be calling. The
  * <code>scan()</code> method holds the meat and potatoes of AntiSamy. The file
  * contains a number of ways for <code>scan()</code>'ing depending on the
  * accessibility of the policy file.
- * 
+ *
  * @author Arshan Dabirsiaghi
  */
 
diff --git a/src/main/java/org/owasp/validator/html/CleanResults.java b/src/main/java/org/owasp/validator/html/CleanResults.java
index ffa0a381..57498013 100644
--- a/src/main/java/org/owasp/validator/html/CleanResults.java
+++ b/src/main/java/org/owasp/validator/html/CleanResults.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
@@ -98,7 +98,8 @@ public CleanResults(long startOfScan, Callable<String> cleanHTML,
 
 	/**
 	 * Return the DOM version of the clean HTML.
-	 * return The XML Document fragment version of the clean HTML produced during the sanitization process.
+	 * 
+	 * @return The XML Document fragment version of the clean HTML produced during the sanitization process.
 	 *        This may be null, even if the clean HTML String is not null.
 	 */
 	public DocumentFragment getCleanXMLDocumentFragment() {
diff --git a/src/main/java/org/owasp/validator/html/InternalPolicy.java b/src/main/java/org/owasp/validator/html/InternalPolicy.java
index cd2807cf..96a9efc3 100644
--- a/src/main/java/org/owasp/validator/html/InternalPolicy.java
+++ b/src/main/java/org/owasp/validator/html/InternalPolicy.java
@@ -52,7 +52,7 @@ protected InternalPolicy(ParseContext parseContext) {
 
         if (!isNoopenerAndNoreferrerAnchors) {
             logger.warn("The directive \"" + Policy.ANCHORS_NOOPENER_NOREFERRER +
-                    "\" is not enabled by default. It is recommended to enable it to prevent reverse tabnabbing attacks.");
+                    "\" is enabled by default, but disabled in this policy. It is recommended to leave it enabled to prevent reverse tabnabbing attacks.");
         }
     }
 
@@ -77,7 +77,7 @@ protected InternalPolicy(Policy old, Map<String, String> directives, Map<String,
 
         if (!isNoopenerAndNoreferrerAnchors) {
             logger.warn("The directive \"" + Policy.ANCHORS_NOOPENER_NOREFERRER +
-                    "\" is not enabled by default. It is recommended to enable it to prevent reverse tabnabbing attacks.");
+                    "\" is enabled by default, but disabled in this policy. It is recommended to leave it enabled to prevent reverse tabnabbing attacks.");
         }
     }
 
diff --git a/src/main/java/org/owasp/validator/html/Policy.java b/src/main/java/org/owasp/validator/html/Policy.java
index cba081e9..7a373bcd 100644
--- a/src/main/java/org/owasp/validator/html/Policy.java
+++ b/src/main/java/org/owasp/validator/html/Policy.java
@@ -354,7 +354,7 @@ public InputSource call() throws IOException {
     protected static Element getTopLevelElement(InputSource source, Callable<InputSource> getResetSource) throws PolicyException {
         // Track whether an exception was ever thrown while processing policy file
         try {
-            return getDocumentElementFromSource(source, true);
+            return getDocumentElementFromSource(source);
         } catch (SAXException | ParserConfigurationException | IOException e) {
             throw new PolicyException(e);
         }
@@ -384,9 +384,8 @@ private static InputStream toByteArrayStream(InputStream in) throws PolicyExcept
         return new ByteArrayInputStream(byteArray);
     }
 
-    private static Element getDocumentElementFromSource(InputSource source, boolean schemaValidationEnabled)
+    private static Element getDocumentElementFromSource(InputSource source)
             throws ParserConfigurationException, SAXException, IOException {
-    	// FIXME: remove boolean schemaValidationEnabled from this API and refactor all callers. 
 
         DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
 
diff --git a/src/main/java/org/owasp/validator/html/PolicyException.java b/src/main/java/org/owasp/validator/html/PolicyException.java
index 64087626..be840913 100644
--- a/src/main/java/org/owasp/validator/html/PolicyException.java
+++ b/src/main/java/org/owasp/validator/html/PolicyException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/html/ScanException.java b/src/main/java/org/owasp/validator/html/ScanException.java
index 47afe396..71e7ce6d 100644
--- a/src/main/java/org/owasp/validator/html/ScanException.java
+++ b/src/main/java/org/owasp/validator/html/ScanException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/html/model/AntiSamyPattern.java b/src/main/java/org/owasp/validator/html/model/AntiSamyPattern.java
index 48677af9..7a5d9bd8 100644
--- a/src/main/java/org/owasp/validator/html/model/AntiSamyPattern.java
+++ b/src/main/java/org/owasp/validator/html/model/AntiSamyPattern.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/html/model/Attribute.java b/src/main/java/org/owasp/validator/html/model/Attribute.java
index 03818a91..cfd70d1f 100644
--- a/src/main/java/org/owasp/validator/html/model/Attribute.java
+++ b/src/main/java/org/owasp/validator/html/model/Attribute.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2013, Arshan Dabirsiaghi, Jason Li, Kristian Rosenvold
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li, Kristian Rosenvold
  * 
  * All rights reserved.
  * 
@@ -24,20 +24,25 @@
 
 package org.owasp.validator.html.model;
 
-import java.util.*;
-import java.util.regex.Pattern;
-
 import static org.owasp.validator.html.model.Tag.ANY_NORMAL_WHITESPACES;
 import static org.owasp.validator.html.model.Tag.ATTRIBUTE_DIVIDER;
 import static org.owasp.validator.html.model.Tag.CLOSE_ATTRIBUTE;
 
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Set;
+import java.util.regex.Pattern;
+
 /**
  * A model for HTML attributes and the "rules" they must follow (either literals or regular expressions) in
  * order to be considered valid.
  * 
  * @author Arshan Dabirsiaghi
  * @author Kristian Rosenvold
- *
  */
 
 public class Attribute  {
diff --git a/src/main/java/org/owasp/validator/html/model/Property.java b/src/main/java/org/owasp/validator/html/model/Property.java
index 757d92d4..1f752b32 100644
--- a/src/main/java/org/owasp/validator/html/model/Property.java
+++ b/src/main/java/org/owasp/validator/html/model/Property.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/html/model/Tag.java b/src/main/java/org/owasp/validator/html/model/Tag.java
index 4c76accf..e6643a17 100644
--- a/src/main/java/org/owasp/validator/html/model/Tag.java
+++ b/src/main/java/org/owasp/validator/html/model/Tag.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2019, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java b/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java
index 457a613d..cd81e5a3 100644
--- a/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2021, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java b/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
index a6c2c652..6c25ad4c 100644
--- a/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
@@ -115,7 +115,7 @@ public AntiSamyDOMScanner() throws PolicyException {
     public CleanResults scan(String html) throws ScanException {
 
         if (html == null) {
-            throw new ScanException(new NullPointerException("Null html input"));
+            throw new ScanException(new NullPointerException("Null HTML input"));
         }
 
         errorMessages.clear();
diff --git a/src/main/java/org/owasp/validator/html/scan/Constants.java b/src/main/java/org/owasp/validator/html/scan/Constants.java
index f84d164b..9a975fc5 100644
--- a/src/main/java/org/owasp/validator/html/scan/Constants.java
+++ b/src/main/java/org/owasp/validator/html/scan/Constants.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2020, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/html/util/ErrorMessageUtil.java b/src/main/java/org/owasp/validator/html/util/ErrorMessageUtil.java
index e3ad5054..bd5afeb2 100644
--- a/src/main/java/org/owasp/validator/html/util/ErrorMessageUtil.java
+++ b/src/main/java/org/owasp/validator/html/util/ErrorMessageUtil.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/html/util/HTMLEntityEncoder.java b/src/main/java/org/owasp/validator/html/util/HTMLEntityEncoder.java
index 8526e1a8..beddae9b 100644
--- a/src/main/java/org/owasp/validator/html/util/HTMLEntityEncoder.java
+++ b/src/main/java/org/owasp/validator/html/util/HTMLEntityEncoder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/html/util/URIUtils.java b/src/main/java/org/owasp/validator/html/util/URIUtils.java
index 12bb9bc2..14140134 100644
--- a/src/main/java/org/owasp/validator/html/util/URIUtils.java
+++ b/src/main/java/org/owasp/validator/html/util/URIUtils.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2020, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/java/org/owasp/validator/html/util/XMLUtil.java b/src/main/java/org/owasp/validator/html/util/XMLUtil.java
index 8db5b47b..901256fd 100644
--- a/src/main/java/org/owasp/validator/html/util/XMLUtil.java
+++ b/src/main/java/org/owasp/validator/html/util/XMLUtil.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2019, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/main/resources/antisamy.xml b/src/main/resources/antisamy.xml
index 72742c93..80b5ef14 100644
--- a/src/main/resources/antisamy.xml
+++ b/src/main/resources/antisamy.xml
@@ -5,8 +5,8 @@
 W3C rules retrieved from:
 http://www.w3.org/TR/html401/struct/global.html
 -->
-	
-	
+
+
 <anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 		xsi:noNamespaceSchemaLocation="antisamy.xsd">
 
@@ -17,8 +17,8 @@ http://www.w3.org/TR/html401/struct/global.html
 		<directive name="formatOutput" value="true"/>
 		<directive name="nofollowAnchors" value="true" />
 		<directive name="validateParamAsEmbed" value="true" />
-		<directive name="noopenerAndNoreferrerAnchors" value="false" />
-		
+		<directive name="noopenerAndNoreferrerAnchors" value="true" />
+
 		<!--
 		remember, this won't work for relative URIs - AntiSamy doesn't
 		know anything about the URL or your web structure
@@ -26,13 +26,13 @@ http://www.w3.org/TR/html401/struct/global.html
 		<directive name="embedStyleSheets" value="false"/> 
 		<directive name="connectionTimeout" value="5000"/>
 		<directive name="maxStyleSheetImports" value="3"/>
-		
+
 		<!-- Allows the use of dynamic attributes (i.e. HTML5 "data-") -->
 		<directive name="allowDynamicAttributes" value="true" />
 	</directives>
-	
+
 	<common-regexps>
-		
+
 		<!-- 
 		From W3C:
 		This attribute assigns a class name or set of class names to an
@@ -43,10 +43,10 @@ http://www.w3.org/TR/html401/struct/global.html
 
 		<!-- The 16 colors defined by the HTML Spec (also used by the CSS Spec) -->
 		<regexp name="colorName" value="(aqua|black|blue|fuchsia|gray|grey|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow)"/>
-		
+
 		<!-- HTML/CSS Spec allows 3 or 6 digit hex to specify color -->
 		<regexp name="colorCode" value="(#([0-9a-fA-F]{6}|[0-9a-fA-F]{3}))"/>
-				
+
 		<regexp name="anything" value=".*"/>
 		<regexp name="numberOrPercent" value="(\d)+(%{0,1})"/>
 		<regexp name="paragraph" value="([\p{L}\p{N},'\.\s\-_\(\)]|&amp;[0-9]{2};)*"/>
@@ -72,32 +72,32 @@ http://www.w3.org/TR/html401/struct/global.html
 
 		<!--  This is to list out any class names that are *not* valid -->
 		<regexp name="cssClassExclusion" value=""/>
-		
+
 		<!--  This is for ID selectors (ex: #myId { ... } -->
 		<regexp name="cssIDSelector" value="#[a-zA-Z0-9\-_]+"/>
-		
+
 		<!--  This is to list out any IDs that are *not* valid - FIXME: What should the default be to avoid div hijacking? *? -->
 		<regexp name="cssIDExclusion" value=""/>
-		
+
 		<!--  This is for pseudo-element selector (ex. foo:pseudo-element { ... } -->
 		<regexp name="cssPseudoElementSelector" value=":[a-zA-Z0-9\-_]+"/>
-		
+
 		<!--  This is to list out any psuedo-element names that are *not* valid -->
 		<regexp name="cssPsuedoElementExclusion" value=""/>
-		
+
 		<!--  This is for attribute selectors (ex. foo[attr=value] { ... } -->
 		<regexp name="cssAttributeSelector" value="\[[a-zA-Z0-9\-_]+((=|~=|\|=){1}[a-zA-Z0-9\-_]+){1}\]"/>
-		
+
 		<!--  This is to list out any attribute names that are *not* valid -->
 		<regexp name="cssAttributeExclusion" value=""/>
-		
+
 		<!--  This is for resources referenced from CSS (such as background images and other imported stylesheets) -->
 		<regexp name="cssOnsiteUri" value="url\(([\p{L}\p{N}\\/\.\?=\#&amp;;\-_~]+|\#(\w)+)\)"/>
 		<regexp name="cssOffsiteUri" value="url\((\s)*((ht|f)tp(s?)://)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@#$%&amp;;:,\?=/\+!]*(\s)*\)"/>
-		
+
 		<!--  This if for CSS Identifiers -->
 		<regexp name="cssIdentifier" value="[a-zA-Z0-9\-_]+"/>
-		
+
 		<!--  This is for comments within CSS (ex. /* comment */) -->
 		<regexp name="cssCommentText" value="[\p{L}\p{N}\-_,\/\\\.\s\(\)!\?\=\$#%\^&amp;:&quot;']+"/>
 
@@ -111,28 +111,28 @@ http://www.w3.org/TR/html401/struct/global.html
 		<regexp name="positiveLength" value="((\+)?0|(\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))"/>
 		<regexp name="percentage" value="(-|\+)?([0-9]+(\.[0-9]+)?)%"/>
 		<regexp name="positivePercentage" value="(\+)?([0-9]+(\.[0-9]+)?)%"/>
-		
+
 		<regexp name="absolute-size" value="(xx-small|x-small|small|medium|large|x-large|xx-large)"/>
 		<regexp name="relative-size" value="(larger|smaller)"/>
-		
+
 		<!-- Used for CSS Color specifications (complex regexp expresses integer values of 0-255) -->
 		<regexp name="rgbCode" value="rgb\(([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\)"/>
-		
+
 		<!-- CSS2 Allowed System Color Values -->		
 		<regexp name="systemColor" value="(activeborder|activecaption|appworkspace|background|buttonface|buttonhighlight|buttonshadow|buttontext|captiontext|graytext|highlight|highlighttext|inactiveborder|inactivecaption|inactivecaptiontext|infobackground|infotext|menu|menutext|scrollbar|threeddarkshadow|threedface|threedhighlight|threedlightshadow|threedshadow|window|windowframe|windowtext)"/>
 
 		<!-- This is where we specify what Flash src to allow -->
 		<regexp name="flashSites" value="http://(download\.macromedia\.com/pub|www\.macromedia\.com/(go|shockwave)|c\.brightcove\.com/services|gamevideos\.1up\.com/swf|www\.youtube\.com/v|vimeo\.com|www\.gametrailers\.com|videomedia\.ign\.com/ev|image\.com\.com/gamespot|www\.hulu\.com/embed|embed\.break\.com|player\.ordienetworks\.com/flash|www\.adultswim\.com/video/vplayer|www\.dailymotion\.com/swf|www\.ustream\.tv/flash/video|cdn-i\.dmdentertainment\.com|media\.mtvnservices\.com|www\.justin\.tv/widgets|www\.viddler\.com/(player|simple_on_site)|static\.twitter\.com/flash|www\.gamepro\.com/bin|www\.divshare\.com/flash|www\.facebook\.com/v)/.*"/>
 	</common-regexps>
-	
+
 	<!-- 
-	
+
 	Tag.name = a, b, div, body, etc.
 	Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, remove: remove tag and contents
 	Attribute.name = id, class, href, align, width, etc.
 	Attribute.onInvalid = what to do when the attribute is invalid, e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag)
 	Attribute.description = What rules in English you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML
-	 
+
 	 -->
 
 	<!-- 
@@ -140,17 +140,16 @@ http://www.w3.org/TR/html401/struct/global.html
 	collisions between any of these attribute names with attribute names of other tags that are for different purposes.
 	-->
 
-	<common-attributes>
-		
+	<common-attributes>		
 
 		<!-- Common to all HTML tags  -->
-		
+
 		<attribute name="id" description="The 'id' of any HTML attribute should not contain anything besides letters and numbers">
 			<regexp-list>
 				<regexp name="htmlId"/>
 			</regexp-list>
 		</attribute>
-	
+
 		<attribute name="classid">
 			<regexp-list>
 				<regexp name="anything" />
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyPerformanceTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyPerformanceTest.java
index e2adaedb..af13761f 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyPerformanceTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyPerformanceTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2019, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  * 
  * All rights reserved.
  * 
diff --git a/src/test/java/org/owasp/validator/html/test/LiteralTest.java b/src/test/java/org/owasp/validator/html/test/LiteralTest.java
index 217b42ab..94d674a6 100644
--- a/src/test/java/org/owasp/validator/html/test/LiteralTest.java
+++ b/src/test/java/org/owasp/validator/html/test/LiteralTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2020, Arshan Dabirsiaghi, Jason Li
+ * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
  *
  * All rights reserved.
  *

From 8eb24879c10e8db754638ed303b976d18ca6d4b7 Mon Sep 17 00:00:00 2001
From: Dave Wichers <dwichers@gmail.com>
Date: Sat, 9 Jul 2022 17:48:07 -0400
Subject: [PATCH 33/36] Add spotless apply maven plugin to configuration. It
 will now reformat everything automatically every time mvn compile is run. And
 reformat everything so pretty much every file has had its format changed
 some.

---
 DevStyleXml.prefs                             |    5 +
 SECURITY.md                                   |    4 +-
 pom.xml                                       |  432 +-
 .../org/owasp/validator/css/CssHandler.java   |  951 ++-
 .../org/owasp/validator/css/CssScanner.java   |  538 +-
 .../org/owasp/validator/css/CssValidator.java |  674 +-
 .../css/UnknownSelectorException.java         |   37 +-
 .../org/owasp/validator/html/AntiSamy.java    |  286 +-
 .../owasp/validator/html/CleanResults.java    |  258 +-
 .../owasp/validator/html/InternalPolicy.java  |  317 +-
 .../java/org/owasp/validator/html/Policy.java | 1843 +++---
 .../owasp/validator/html/PolicyException.java |   34 +-
 .../owasp/validator/html/ScanException.java   |   36 +-
 .../org/owasp/validator/html/TagMatcher.java  |   37 +-
 .../validator/html/model/AntiSamyPattern.java |   56 +-
 .../owasp/validator/html/model/Attribute.java |  298 +-
 .../owasp/validator/html/model/Property.java  |  101 +-
 .../org/owasp/validator/html/model/Tag.java   |  220 +-
 .../validator/html/scan/ASHTMLSerializer.java |  130 +-
 .../html/scan/AbstractAntiSamyScanner.java    |  117 +-
 .../html/scan/AntiSamyDOMScanner.java         | 1345 ++--
 .../html/scan/AntiSamySAXScanner.java         |  316 +-
 .../owasp/validator/html/scan/Constants.java  |  107 +-
 .../validator/html/scan/MagicSAXFilter.java   |  793 +--
 .../validator/html/util/ErrorMessageUtil.java |  113 +-
 .../html/util/HTMLEntityEncoder.java          |   79 +-
 .../owasp/validator/html/util/URIUtils.java   |  347 +-
 .../owasp/validator/html/util/XMLUtil.java    |  350 +-
 src/main/resources/antisamy-anythinggoes.xml  | 5094 ++++++++-------
 src/main/resources/antisamy-ebay.xml          | 4796 ++++++++-------
 src/main/resources/antisamy-myspace.xml       | 5106 ++++++++-------
 src/main/resources/antisamy-slashdot.xml      |  376 +-
 src/main/resources/antisamy-tinymce.xml       |  413 +-
 src/main/resources/antisamy.xml               | 5460 ++++++++---------
 .../owasp/validator/css/CssScannerTest.java   |  155 +-
 .../test/AntiSamyMalformedPolicyTest.java     |   46 +-
 .../html/test/AntiSamyPerformanceTest.java    |  153 +-
 .../validator/html/test/AntiSamyTest.java     | 4003 +++++++-----
 .../html/test/ESAPIInvalidPolicyTest.java     |   75 +-
 .../validator/html/test/LiteralTest.java      |  124 +-
 .../owasp/validator/html/test/PolicyTest.java |  566 +-
 .../owasp/validator/html/test/TestPolicy.java |   95 +-
 42 files changed, 18679 insertions(+), 17607 deletions(-)
 create mode 100644 DevStyleXml.prefs

diff --git a/DevStyleXml.prefs b/DevStyleXml.prefs
new file mode 100644
index 00000000..5805e757
--- /dev/null
+++ b/DevStyleXml.prefs
@@ -0,0 +1,5 @@
+eclipse.preferences.version=1
+indentationChar=space
+indentationSize=4
+lineWidth=140
+formatCommentJoinLines=true
diff --git a/SECURITY.md b/SECURITY.md
index 7b7dc0a2..e37a0537 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -7,8 +7,8 @@ GitHut issues list (for both open and closed issues) to see if it has already be
 
 If it has not, then please contact Dave Wichers (dave.wichers at owasp.org) _directly_.
 Please do **not** report any suspected vulnerabilities via GitHub issues
-as we wish to keep our users secure while a patch is implemented and deployed. 
-This is because if this is reported as a GitHub issue, it more or less is equivalent 
+as we wish to keep our users secure while a patch is implemented and deployed.
+This is because if this is reported as a GitHub issue, it more or less is equivalent
 to dropping a 0-day on all applications using AntiSamy. Instead, we encourage
 responsible disclosure.
 
diff --git a/pom.xml b/pom.xml
index 8dacb3eb..2e2734b6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1,4 +1,5 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.owasp.antisamy</groupId>
     <artifactId>antisamy</artifactId>
@@ -20,20 +21,20 @@
     <url>https://github.com/nahsra/antisamy</url>
 
     <developers>
-      <developer>
-        <id>nahsra</id>
-        <name>Arshan Dabirsiaghi</name>
-        <email>arshan.dabirsiaghi@gmail.com</email>
-      </developer>
+        <developer>
+            <id>nahsra</id>
+            <name>Arshan Dabirsiaghi</name>
+            <email>arshan.dabirsiaghi@gmail.com</email>
+        </developer>
     </developers>
 
     <licenses>
-      <license>
-        <name>BSD 3</name>
-        <url>https://opensource.org/licenses/BSD-3-Clause</url>
-      </license>
+        <license>
+            <name>BSD 3</name>
+            <url>https://opensource.org/licenses/BSD-3-Clause</url>
+        </license>
     </licenses>
-   
+
     <scm>
         <connection>scm:git:git@github.com:nahsra/antisamy.git</connection>
         <url>scm:git:git@github.com:nahsra/antisamy.git</url>
@@ -53,12 +54,12 @@
     </properties>
 
     <profiles>
-      <profile>
-        <id>release</id>
-        <properties>
-          <gpg.skip>false</gpg.skip>
-        </properties>
-      </profile>
+        <profile>
+            <id>release</id>
+            <properties>
+                <gpg.skip>false</gpg.skip>
+            </properties>
+        </profile>
     </profiles>
 
     <dependencies>
@@ -124,8 +125,8 @@
             <version>${version.slf4j}</version>
             <scope>test</scope>
         </dependency>
-        <!-- While Java 7+ includes Xerces in the JRE, it apparently doesn't provide all the features we use
-             that are in the 3rd party version. So we import it directly. -->
+        <!-- While Java 7+ includes Xerces in the JRE, it apparently doesn't provide all the features we use that are in the 3rd party version. 
+            So we import it directly. -->
         <dependency>
             <groupId>xerces</groupId>
             <artifactId>xercesImpl</artifactId>
@@ -183,15 +184,15 @@
 
         <pluginManagement>
             <plugins>
-               <plugin>
-                  <groupId>org.apache.maven.plugins</groupId>
-                  <artifactId>maven-assembly-plugin</artifactId>
-                  <version>3.4.1</version>
-               </plugin>
-               <plugin>
-                  <groupId>org.apache.maven.plugins</groupId>
-                  <artifactId>maven-dependency-plugin</artifactId>
-                  <version>3.3.0</version>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-assembly-plugin</artifactId>
+                    <version>3.4.1</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-dependency-plugin</artifactId>
+                    <version>3.3.0</version>
                     <configuration>
                         <usedDependencies>
                             <dependency>commons-io:commons-io</dependency>
@@ -199,21 +200,21 @@
                             <dependency>org.slf4j:slf4j-simple</dependency>
                         </usedDependencies>
                     </configuration>
-               </plugin>
-               <plugin>
-                  <groupId>org.apache.maven.plugins</groupId>
-                  <artifactId>maven-javadoc-plugin</artifactId>
-                  <version>3.4.0</version>
-                  <configuration>
-                     <!-- supports reproducibility of generated Javadocs -->
-                     <notimestamp>true</notimestamp>
-                  </configuration>
-               </plugin>
-               <plugin>
-                  <groupId>org.apache.maven.plugins</groupId>
-                  <artifactId>maven-release-plugin</artifactId>
-                  <version>3.0.0-M6</version>
-               </plugin>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-javadoc-plugin</artifactId>
+                    <version>3.4.0</version>
+                    <configuration>
+                        <!-- supports reproducibility of generated Javadocs -->
+                        <notimestamp>true</notimestamp>
+                    </configuration>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-release-plugin</artifactId>
+                    <version>3.0.0-M6</version>
+                </plugin>
             </plugins>
         </pluginManagement>
 
@@ -262,7 +263,9 @@
                 <executions>
                     <execution>
                         <id>enforce-bytecode-version</id>
-                        <goals><goal>enforce</goal></goals>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
                         <configuration>
                             <rules>
                                 <enforceBytecodeVersion>
@@ -280,7 +283,9 @@
                     </execution>
                     <execution>
                         <id>enforce-jdk-version</id>
-                        <goals><goal>enforce</goal></goals>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
                         <configuration>
                             <rules>
                                 <requireJavaVersion>
@@ -300,7 +305,9 @@
                     <execution>
                         <id>sign-artifacts</id>
                         <phase>verify</phase>
-                        <goals><goal>sign</goal></goals>
+                        <goals>
+                            <goal>sign</goal>
+                        </goals>
                     </execution>
                 </executions>
             </plugin>
@@ -325,30 +332,32 @@
                 </configuration>
             </plugin>
             <plugin>
-               <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-javadoc-plugin</artifactId>
-               <executions>
-                 <execution>
-                   <id>attach-javadocs</id>
-                   <phase>package</phase>
-                   <goals><goal>jar</goal></goals>
-                 </execution>
-               </executions>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-javadoc-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>attach-javadocs</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>jar</goal>
+                        </goals>
+                    </execution>
+                </executions>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-jxr-plugin</artifactId>
-               <version>3.2.0</version>
+                <version>3.2.0</version>
             </plugin>
             <plugin>
-               <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-pmd-plugin</artifactId>
-               <version>3.17.0</version>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-pmd-plugin</artifactId>
+                <version>3.17.0</version>
             </plugin>
             <plugin>
-               <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-project-info-reports-plugin</artifactId>
-               <version>3.3.0</version>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-project-info-reports-plugin</artifactId>
+                <version>3.3.0</version>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -361,16 +370,18 @@
                 <version>4.0.0-M2</version>
             </plugin>
             <plugin>
-               <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-source-plugin</artifactId>
-               <version>3.2.1</version>
-               <executions>
-                 <execution>
-                   <id>attach-sources</id>
-                   <phase>package</phase>
-                   <goals><goal>jar-no-fork</goal></goals>
-                 </execution>
-               </executions>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-source-plugin</artifactId>
+                <version>3.2.1</version>
+                <executions>
+                    <execution>
+                        <id>attach-sources</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>jar-no-fork</goal>
+                        </goals>
+                    </execution>
+                </executions>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -387,10 +398,12 @@
                 <artifactId>cyclonedx-maven-plugin</artifactId>
                 <version>2.7.0</version>
                 <executions>
-                  <execution>
-                    <phase>package</phase>
-                    <goals><goal>makeBom</goal></goals>
-                  </execution>
+                    <execution>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>makeBom</goal>
+                        </goals>
+                    </execution>
                 </executions>
             </plugin>
             <plugin>
@@ -400,44 +413,123 @@
                 <executions>
                     <execution>
                         <id>prepare-agent</id>
-                        <goals><goal>prepare-agent</goal></goals>
+                        <goals>
+                            <goal>prepare-agent</goal>
+                        </goals>
                     </execution>
                     <execution>
                         <id>report</id>
                         <phase>test</phase>
-                        <goals><goal>report</goal></goals>
+                        <goals>
+                            <goal>report</goal>
+                        </goals>
                     </execution>
                     <execution>
                         <id>jacoco-check</id>
                         <phase>test</phase>
-                        <goals><goal>check</goal></goals>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
                         <configuration>
-                           <haltOnFailure>false</haltOnFailure>
-                           <rules><rule>
-                              <element>CLASS</element>
-                              <limits><limit>
-                                  <counter>METHOD</counter>
-                                  <value>MISSEDCOUNT</value>
-                                  <maximum>0</maximum>
-                              </limit></limits>
-                           </rule></rules>
+                            <haltOnFailure>false</haltOnFailure>
+                            <rules>
+                                <rule>
+                                    <element>CLASS</element>
+                                    <limits>
+                                        <limit>
+                                            <counter>METHOD</counter>
+                                            <value>MISSEDCOUNT</value>
+                                            <maximum>0</maximum>
+                                        </limit>
+                                    </limits>
+                                </rule>
+                            </rules>
                         </configuration>
                     </execution>
                 </executions>
             </plugin>
 
+            <plugin>
+                <groupId>com.diffplug.spotless</groupId>
+                <artifactId>spotless-maven-plugin</artifactId>
+                <version>2.22.8</version>
+                <configuration>
+                    <!-- optional: limit format enforcement to just the files changed by this feature branch -->
+                    <ratchetFrom>origin/main</ratchetFrom>
+                    <formats>
+                        <!-- you can define as many formats as you want, each is independent -->
+                        <format>
+                            <!-- define the files to apply to -->
+                            <includes>
+                                <include>*.md</include>
+                            </includes>
+                            <excludes>
+                                <exclude>target/**/*.*</exclude>
+                            </excludes>
+                            <!-- define the steps to apply to those files -->
+                            <trimTrailingWhitespace />
+                            <endWithNewline />
+                            <indent>
+                                <tabs>false</tabs>
+                                <spaces>true</spaces>
+                                <spacesPerTab>4</spacesPerTab>
+                            </indent>
+                        </format>
+
+                        <format>
+                            <includes>
+                                <include>**/*.xml</include>
+                            </includes>
+                            <excludes>
+                                <exclude>target/**/*.*</exclude>
+                            </excludes>
+                            <eclipseWtp>
+                                <type>XML</type>
+                                <files>
+                                    <file>DevStyleXml.prefs</file>
+                                </files>
+                            </eclipseWtp>
+                        </format>
+                    </formats>
+
+                    <!-- define a language-specific format -->
+                    <java>
+                        <importOrder /> <!-- standard import order -->
+                        <removeUnusedImports /> <!-- self-explanatory -->
+                        <toggleOffOn /> <!-- enable spotless override tags -->
+
+                        <!-- apply a specific flavor of google-java-format -->
+                        <googleJavaFormat>
+                            <version>1.7</version>
+                            <style>GOOGLE</style>
+                            <groupArtifact>com.google.googlejavaformat:google-java-format</groupArtifact>
+                        </googleJavaFormat>
+                    </java>
+                </configuration>
+
+                <executions>
+                    <execution>
+                        <id>spotless-apply</id>
+                        <phase>compile</phase>
+                        <goals>
+                            <goal>apply</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+
             <plugin>
                 <groupId>com.github.spotbugs</groupId>
                 <artifactId>spotbugs-maven-plugin</artifactId>
                 <version>${version.spotbugs.maven}</version>
                 <dependencies>
-                  <!-- Overwrite dependency on SpotBugs if you want to specify the version of SpotBugs.
-                       SpotBugs itself is frequently several versions ahead of the spotbugs-maven-plugin -->
-                  <dependency>
-                    <groupId>com.github.spotbugs</groupId>
-                    <artifactId>spotbugs</artifactId>
-                    <version>${version.spotbugs}</version>
-                  </dependency>
+                    <!-- Overwrite dependency on SpotBugs if you want to specify the version of SpotBugs. SpotBugs itself is frequently several 
+                        versions ahead of the spotbugs-maven-plugin -->
+                    <dependency>
+                        <groupId>com.github.spotbugs</groupId>
+                        <artifactId>spotbugs</artifactId>
+                        <version>${version.spotbugs}</version>
+                    </dependency>
                 </dependencies>
             </plugin>
             <plugin>
@@ -449,84 +541,84 @@
     </build>
 
     <reporting>
-        <!-- All plugins used here should first be declared in the <plugins> section above with their
-             versions, so the versions get reported in the plugins Updates report.
-         -->
+        <!-- All plugins used here should first be declared in the <plugins> section above with their versions, so the versions get reported 
+            in the plugins Updates report. -->
         <plugins>
-           <plugin>
-               <groupId>com.github.spotbugs</groupId>
-               <artifactId>spotbugs-maven-plugin</artifactId>
-               <configuration>
-                   <plugins>
-                       <plugin>
-                           <groupId>com.h3xstream.findsecbugs</groupId>
-                           <artifactId>findsecbugs-plugin</artifactId>
-                           <version>${version.findsecbugs}</version>
-                       </plugin>
-                   </plugins>
-                   <effort>Max</effort>
-                   <relaxed>false</relaxed>
-                   <excludeFilterFile>src/test/spotbugsFilterFile.xml</excludeFilterFile>
-               </configuration>
-           </plugin>
+            <plugin>
+                <groupId>com.github.spotbugs</groupId>
+                <artifactId>spotbugs-maven-plugin</artifactId>
+                <configuration>
+                    <plugins>
+                        <plugin>
+                            <groupId>com.h3xstream.findsecbugs</groupId>
+                            <artifactId>findsecbugs-plugin</artifactId>
+                            <version>${version.findsecbugs}</version>
+                        </plugin>
+                    </plugins>
+                    <effort>Max</effort>
+                    <relaxed>false</relaxed>
+                    <excludeFilterFile>src/test/spotbugsFilterFile.xml</excludeFilterFile>
+                </configuration>
+            </plugin>
 
-           <plugin>
-               <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-javadoc-plugin</artifactId>
-           </plugin>
-           <plugin>
-               <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-jxr-plugin</artifactId>
-           </plugin>
-           <plugin>
-               <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-pmd-plugin</artifactId>
-               <configuration>
-                   <targetJdk>${project.java.target}</targetJdk>
-                   <sourceEncoding>utf-8</sourceEncoding>
-                   <!-- excludeFromFailureFile>exclude-pmd.properties</excludeFromFailureFile -->
-               </configuration>
-           </plugin>
-           <plugin>
-               <groupId>org.apache.maven.plugins</groupId>
-               <artifactId>maven-project-info-reports-plugin</artifactId>
-               <reportSets>
-                 <reportSet>
-                   <reports>
-                     <report>index</report>
-                     <report>dependency-convergence</report>
-                   </reports>
-                 </reportSet>
-               </reportSets>
-               <configuration>
-                 <dependencyLocationsEnabled>false</dependencyLocationsEnabled>
-               </configuration>
-           </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-javadoc-plugin</artifactId>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-jxr-plugin</artifactId>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-pmd-plugin</artifactId>
+                <configuration>
+                    <targetJdk>${project.java.target}</targetJdk>
+                    <sourceEncoding>utf-8</sourceEncoding>
+                    <!-- excludeFromFailureFile>exclude-pmd.properties</excludeFromFailureFile -->
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-project-info-reports-plugin</artifactId>
+                <reportSets>
+                    <reportSet>
+                        <reports>
+                            <report>index</report>
+                            <report>dependency-convergence</report>
+                        </reports>
+                    </reportSet>
+                </reportSets>
+                <configuration>
+                    <dependencyLocationsEnabled>false</dependencyLocationsEnabled>
+                </configuration>
+            </plugin>
 
-           <plugin>
-               <groupId>org.codehaus.mojo</groupId>
-               <artifactId>versions-maven-plugin</artifactId>
-               <reportSets>
-                 <reportSet>
-                   <reports>
-                     <report>dependency-updates-report</report>
-                     <report>plugin-updates-report</report>
-                     <report>property-updates-report</report>
-                   </reports>
-                 </reportSet>
-               </reportSets>
-           </plugin>
-           <plugin>
-               <!-- This causes the Jacoco report generated during test to be added to the Project
-                    Reports section of the 'site' report. -->
-               <groupId>org.jacoco</groupId>
-               <artifactId>jacoco-maven-plugin</artifactId>
-               <reportSets>
-                 <reportSet>
-                   <reports><report>report</report></reports>
-                 </reportSet>
-               </reportSets>
-           </plugin>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>versions-maven-plugin</artifactId>
+                <reportSets>
+                    <reportSet>
+                        <reports>
+                            <report>dependency-updates-report</report>
+                            <report>plugin-updates-report</report>
+                            <report>property-updates-report</report>
+                        </reports>
+                    </reportSet>
+                </reportSets>
+            </plugin>
+            <plugin>
+                <!-- This causes the Jacoco report generated during test to be added to the Project Reports section of the 'site' report. -->
+                <groupId>org.jacoco</groupId>
+                <artifactId>jacoco-maven-plugin</artifactId>
+                <reportSets>
+                    <reportSet>
+                        <reports>
+                            <report>report</report>
+                        </reports>
+                    </reportSet>
+                </reportSets>
+            </plugin>
         </plugins>
     </reporting>
 </project>
diff --git a/src/main/java/org/owasp/validator/css/CssHandler.java b/src/main/java/org/owasp/validator/css/CssHandler.java
index 18543611..6704c54d 100644
--- a/src/main/java/org/owasp/validator/css/CssHandler.java
+++ b/src/main/java/org/owasp/validator/css/CssHandler.java
@@ -1,11 +1,11 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without 
+ *
+ * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
- * - Redistributions of source code must retain the above copyright notice, 
+ * - Redistributions of source code must retain the above copyright notice,
  * 	 this list of conditions and the following disclaimer.
  * - Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
@@ -35,13 +35,11 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.ResourceBundle;
-
 import org.owasp.validator.html.InternalPolicy;
 import org.owasp.validator.html.Policy;
 import org.owasp.validator.html.ScanException;
 import org.owasp.validator.html.util.ErrorMessageUtil;
 import org.owasp.validator.html.util.HTMLEntityEncoder;
-
 import org.w3c.css.sac.CSSException;
 import org.w3c.css.sac.DocumentHandler;
 import org.w3c.css.sac.InputSource;
@@ -51,487 +49,472 @@
 import org.w3c.css.sac.SelectorList;
 
 /**
- * A implementation of a SAC DocumentHandler for CSS validation. The appropriate
- * validation method is called whenever the handler is invoked by the parser.
- * The handler also builds a clean CSS document as the original CSS is scanned.
- * 
- * NOTE: keeping state in this class is not ideal as handler style parsing a la
- * SAX should generally be event driven. However, there is not a fully
- * implemented "DOM" equivalent to CSS at this time. Java has a StyleSheet class
- * that could accomplish this "DOM" like behavior but it has yet to be fully
- * implemented.
- * 
+ * A implementation of a SAC DocumentHandler for CSS validation. The appropriate validation method
+ * is called whenever the handler is invoked by the parser. The handler also builds a clean CSS
+ * document as the original CSS is scanned.
+ *
+ * <p>NOTE: keeping state in this class is not ideal as handler style parsing a la SAX should
+ * generally be event driven. However, there is not a fully implemented "DOM" equivalent to CSS at
+ * this time. Java has a StyleSheet class that could accomplish this "DOM" like behavior but it has
+ * yet to be fully implemented.
+ *
  * @see javax.swing.text.html.StyleSheet
  * @author Jason Li
  */
 public class CssHandler implements DocumentHandler {
 
-	/**
-	 * The style sheet as it is being built by the handler
-	 */
-	private StringBuffer styleSheet = new StringBuffer();
-
-	/**
-	 * The validator to use when CSS constituents are encountered
-	 */
-	private final CssValidator validator;
-
-	/**
-	 * The policy file to use in validation
-	 */
-	private final InternalPolicy policy;
-
-	/**
-	 * The error messages
-	 */
-	private final Collection<String> errorMessages;
-	
-	/**
-	 * The error message bundle to pull from.
-	 */
-	private ResourceBundle messages;
-	
-	/**
-	 * A queue of imported stylesheets; used to track imported stylesheets
-	 */
-	private final LinkedList<URI> importedStyleSheets;
-
-	/**
-	 * The tag currently being examined (if any); used for inline stylesheet
-	 * error messages
-	 */
-	private final String tagName;
-
-	/**
-	 * Indicates whether we are scanning a stylesheet or an inline declaration.
-	 * true if this is an inline declaration; false otherwise
-	 */
-	private final boolean isInline;
-
-	/**
-	 * Indicates whether the handler is currently parsing the contents between
-	 * an open selector tag and an close selector tag
-	 */
-	private boolean selectorOpen = false;
-
-	/**
-	 * Constructs a handler for stylesheets using the given policy. The List of embedded stylesheets
-	 * produced by this constructor is now available via the getImportedStylesheetsURIList() method.
-	 * This constructor to be used when there is no tag name associated with this inline style.
-	 *
-	 * @param policy
-	 *            the policy to use
-	 * @param errorMessages
-	 *            the List of error messages to add error messages too if there are errors
-	 * @param messages
-	 *            the error message bundle to pull from
-	 */
-	public CssHandler(Policy policy, List<String> errorMessages, ResourceBundle messages) {
-		this(policy, errorMessages, messages, null);
-	}
-
-	/**
-	 * Constructs a handler for stylesheets using the given policy. The List of embedded stylesheets
-	 * produced by this constructor is available via the getImportedStylesheetsURIList() method.
-	 *
-	 * @param policy
-	 *            the policy to use
-	 * @param errorMessages
-	 *            the List of error messages to add error messages too if there are errors
-	 * @param messages
-	 *            the error message bundle to pull from
-	 * @param tagName
-	 *            the tag name associated with this inline style
-	 */
-	public CssHandler(Policy policy, List<String> errorMessages, ResourceBundle messages, String tagName) {
-		assert policy instanceof InternalPolicy : policy.getClass();
-		this.policy = (InternalPolicy) policy;
-		this.errorMessages = errorMessages;
-		this.messages = messages;
-		this.validator = new CssValidator(policy);
-		// Create a queue of all style sheets that need to be validated to
-		// account for any sheets that may be imported by the current CSS
-		this.importedStyleSheets = new LinkedList<URI>();
-		this.tagName = tagName;
-		this.isInline = (tagName != null);
-	}
-
-	/**
-	 * Returns the cleaned stylesheet.
-	 * 
-	 * @return the cleaned stylesheet.
-	 */
-	public String getCleanStylesheet() {
-		// Always ensure results contain most recent generation of stylesheet
-		return styleSheet.toString();
-	}
-
-	/**
-	 * Returns a list of imported stylesheets from the main parsed stylesheet.
-	 *
-	 * @return the import stylesheet URI list.
-	 */
-	public LinkedList<URI> getImportedStylesheetsURIList() {
-		return importedStyleSheets;
-	}
-
-	/**
-	 * Empties the stylesheet buffer.
-	 */
-	public void emptyStyleSheet() {
-		styleSheet.delete(0, styleSheet.length());
-	}
-
-	/**
-	 * Returns the error messages generated during parsing.
-	 * @return the error messages generated during parsing
-	 */
-	public Collection<String> getErrorMessages() {
-		return new ArrayList<String>(errorMessages);
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#comment(java.lang.String)
-	 */
-	public void comment(String text) throws CSSException {
-		errorMessages.add(ErrorMessageUtil.getMessage(
-			messages,
-			ErrorMessageUtil.ERROR_COMMENT_REMOVED,
-			new Object[] { HTMLEntityEncoder.htmlEntityEncode(text) }));
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#ignorableAtRule(java.lang.String)
-	 */
-	public void ignorableAtRule(String atRule) throws CSSException {
-		// this method is called when the parser hits an unrecognized
-		// @-rule. Like the page/media/font declarations, this is
-		// CSS2+ stuff
-		if (tagName != null) {
-			errorMessages.add(ErrorMessageUtil.getMessage(
-				messages,
-				ErrorMessageUtil.ERROR_CSS_TAG_RULE_NOTFOUND,
-				new Object[] { 
-					HTMLEntityEncoder.htmlEntityEncode(tagName), 
-					HTMLEntityEncoder.htmlEntityEncode(atRule)
-				}));
-		} else {
-			errorMessages.add(ErrorMessageUtil.getMessage(
-				messages,
-				ErrorMessageUtil.ERROR_STYLESHEET_RULE_NOTFOUND,
-				new Object[] {  
-					HTMLEntityEncoder.htmlEntityEncode(atRule)
-				}));
-		}
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#importStyle(java.lang.String,
-	 *      org.w3c.css.sac.SACMediaList, java.lang.String)
-	 */
-	public void importStyle(String uri, SACMediaList media,
-			String defaultNamespaceURI) throws CSSException {
-
-		if (!policy.isEmbedStyleSheets()) {
-			errorMessages.add(ErrorMessageUtil.getMessage(
-				messages,
-				ErrorMessageUtil.ERROR_CSS_IMPORT_DISABLED,
-				new Object[] {}));
-			return;
-		}
-
-		try {
-			// check for non-nullness (validate after canonicalization)
-			if (uri == null) {
-				errorMessages.add(ErrorMessageUtil.getMessage(
-					messages,
-					ErrorMessageUtil.ERROR_CSS_IMPORT_URL_INVALID,
-					new Object[] {}));
-				return;
-			} 
-
-			URI importedStyleSheet = new URI(uri);
-
-			// canonicalize the URI
-			importedStyleSheet.normalize();
-
-			// validate the URL
-
-			if (!policy.getCommonRegularExpressions("offsiteURL").matches(importedStyleSheet.toString())
-				&& !policy.getCommonRegularExpressions("onsiteURL").matches(importedStyleSheet.toString())) {
-				errorMessages.add(ErrorMessageUtil.getMessage(
-					messages,
-					ErrorMessageUtil.ERROR_CSS_IMPORT_URL_INVALID,
-					new Object[] { HTMLEntityEncoder.htmlEntityEncode(uri) }));
-				return;
-			}
-			
-			if (!importedStyleSheet.isAbsolute()) {
-				// we have no concept of relative reference for free form
-				// text as an end user can't know where the corresponding
-				// free form will end up
-				if (tagName != null) {
-					errorMessages.add(ErrorMessageUtil.getMessage(
-						messages,
-						ErrorMessageUtil.ERROR_CSS_TAG_RELATIVE,
-						new Object[] {
-							HTMLEntityEncoder.htmlEntityEncode(tagName),
-							HTMLEntityEncoder.htmlEntityEncode(uri) }));
-				} else {
-					errorMessages.add(ErrorMessageUtil.getMessage(
-						messages,
-						ErrorMessageUtil.ERROR_STYLESHEET_RELATIVE,
-						new Object[] { HTMLEntityEncoder.htmlEntityEncode(uri) }));
-				}
-				return;
-			}
-
-			importedStyleSheets.add(importedStyleSheet);
-		} catch (URISyntaxException use) {
-			errorMessages.add(ErrorMessageUtil.getMessage(
-					messages,
-				ErrorMessageUtil.ERROR_CSS_IMPORT_URL_INVALID,
-				new Object[] { HTMLEntityEncoder.htmlEntityEncode(uri) }));
-		}	
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#namespaceDeclaration(java.lang.String,
-	 *      java.lang.String)
-	 */
-	public void namespaceDeclaration(String prefix, String uri)
-			throws CSSException {
-		// CSS3 - Namespace declaration - ignore for now
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#startDocument(org.w3c.css.sac.InputSource)
-	 */
-	public void startDocument(InputSource arg0) throws CSSException {
-		// no-op
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#endDocument(org.w3c.css.sac.InputSource)
-	 */
-	public void endDocument(InputSource source) throws CSSException {
-		// no-op
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#startFontFace()
-	 */
-	public void startFontFace() throws CSSException {
-		// CSS2 Font Face declaration - ignore this for now
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#endFontFace()
-	 */
-	public void endFontFace() throws CSSException {
-		// CSS2 Font Face declaration - ignore this for now
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#startMedia(org.w3c.css.sac.SACMediaList)
-	 */
-	public void startMedia(SACMediaList media) throws CSSException {
-		// CSS2 Media declaration - ignore this for now
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#endMedia(org.w3c.css.sac.SACMediaList)
-	 */
-	public void endMedia(SACMediaList media) throws CSSException {
-		// CSS2 Media declaration - ignore this for now
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#startPage(java.lang.String,
-	 *      java.lang.String)
-	 */
-	public void startPage(String name, String pseudoPage) throws CSSException {
-		// CSS2 Page declaration - ignore this for now
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#endPage(java.lang.String,
-	 *      java.lang.String)
-	 */
-	public void endPage(String name, String pseudoPage) throws CSSException {
-		// CSS2 Page declaration - ignore this for now
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#startSelector(org.w3c.css.sac.SelectorList)
-	 */
-	public void startSelector(SelectorList selectors) throws CSSException {
-
-		// keep track of number of valid selectors from this rule
-		int selectorCount = 0;
-
-		// check each selector from this rule
-		for (int i = 0; i < selectors.getLength(); i++) {
-			Selector selector = selectors.item(i);
-
-			if (selector != null) {
-				String selectorName = selector.toString();
-
-				boolean isValidSelector = false;
-
-				try {
-					isValidSelector = validator.isValidSelector(selectorName,
-							selector);
-				} catch (ScanException se) {
-					if (tagName != null) {
-						errorMessages.add(ErrorMessageUtil.getMessage(
-							messages,
-							ErrorMessageUtil.ERROR_CSS_TAG_SELECTOR_NOTFOUND,
-							new Object[] {
-								HTMLEntityEncoder.htmlEntityEncode(selector.toString())
-							}));
-					} else {
-						errorMessages.add(ErrorMessageUtil.getMessage(
-							messages,
-							ErrorMessageUtil.ERROR_STYLESHEET_SELECTOR_NOTFOUND,
-							new Object[] {
-								HTMLEntityEncoder.htmlEntityEncode(tagName),
-								HTMLEntityEncoder.htmlEntityEncode(selector.toString())
-							}));
-					}
-				}
-
-				// if the selector is valid, add to list
-				if (isValidSelector) {
-					if (selectorCount > 0) {
-						styleSheet.append(',');
-						styleSheet.append(' ');
-					}
-					styleSheet.append(selectorName);
-
-					selectorCount++;
-
-				} else if (tagName != null) {
-					errorMessages.add(ErrorMessageUtil.getMessage(
-						messages,
-						ErrorMessageUtil.ERROR_CSS_TAG_SELECTOR_DISALLOWED,
-						new Object[] {
-							HTMLEntityEncoder.htmlEntityEncode(tagName),
-							HTMLEntityEncoder.htmlEntityEncode(selector.toString())
-						}));
-
-				} else {
-					errorMessages.add(ErrorMessageUtil.getMessage(
-						messages,
-						ErrorMessageUtil.ERROR_STYLESHEET_SELECTOR_DISALLOWED,
-						new Object[] {
-							HTMLEntityEncoder.htmlEntityEncode(selector.toString())
-						}));
-				}
-			}
-		}
-
-		// if and only if there were selectors that were valid, append
-		// appropriate open brace and set state to within selector
-		if (selectorCount > 0) {
-			styleSheet.append(' ');
-			styleSheet.append('{');
-			styleSheet.append('\n');
-			selectorOpen = true;
-		}
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#endSelector(org.w3c.css.sac.SelectorList)
-	 */
-	public void endSelector(SelectorList selectors) throws CSSException {
-		// if we are in a state within a selector, close brace
-		if (selectorOpen) {
-			styleSheet.append('}');
-			styleSheet.append('\n');
-		}
-
-		// reset state
-		selectorOpen = false;
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see org.w3c.css.sac.DocumentHandler#property(java.lang.String,
-	 *      org.w3c.css.sac.LexicalUnit, boolean)
-	 */
-	public void property(String name, LexicalUnit value, boolean important)
-			throws CSSException {
-		// only bother validating and building if we are either inline or within
-		// a selector tag
-
-		if (!selectorOpen && !isInline) {
-			return;
-		}
-
-		// validate the property
-		if (validator.isValidProperty(name, value)) {
-
-			if (!isInline) { styleSheet.append('\t'); }
-			styleSheet.append(name);
-			styleSheet.append(':');
-
-			// append all values
-			while (value != null) {
-				styleSheet.append(' ');
-				styleSheet.append(validator.lexicalValueToString(value));
-				value = value.getNextLexicalUnit();
-			}
-			if (important) { styleSheet.append(" !important"); }
-			styleSheet.append(';');
-			if (!isInline) { styleSheet.append('\n'); }
-
-		} else if (tagName != null) {
-			errorMessages.add(ErrorMessageUtil.getMessage(
-				messages,
-				ErrorMessageUtil.ERROR_CSS_TAG_PROPERTY_INVALID,
-				new Object[] {
-					HTMLEntityEncoder.htmlEntityEncode(tagName),
-					HTMLEntityEncoder.htmlEntityEncode(name),
-					HTMLEntityEncoder.htmlEntityEncode(validator
-						.lexicalValueToString(value)) }));
-		} else {
-			errorMessages.add(ErrorMessageUtil.getMessage(
-				messages,
-				ErrorMessageUtil.ERROR_STYLESHEET_PROPERTY_INVALID,
-				new Object[] {
-					HTMLEntityEncoder.htmlEntityEncode(name),
-					HTMLEntityEncoder.htmlEntityEncode(validator
-						.lexicalValueToString(value)) }));
-		}
-	}
+  /** The style sheet as it is being built by the handler */
+  private StringBuffer styleSheet = new StringBuffer();
+
+  /** The validator to use when CSS constituents are encountered */
+  private final CssValidator validator;
+
+  /** The policy file to use in validation */
+  private final InternalPolicy policy;
+
+  /** The error messages */
+  private final Collection<String> errorMessages;
+
+  /** The error message bundle to pull from. */
+  private ResourceBundle messages;
+
+  /** A queue of imported stylesheets; used to track imported stylesheets */
+  private final LinkedList<URI> importedStyleSheets;
+
+  /** The tag currently being examined (if any); used for inline stylesheet error messages */
+  private final String tagName;
+
+  /**
+   * Indicates whether we are scanning a stylesheet or an inline declaration. true if this is an
+   * inline declaration; false otherwise
+   */
+  private final boolean isInline;
+
+  /**
+   * Indicates whether the handler is currently parsing the contents between an open selector tag
+   * and an close selector tag
+   */
+  private boolean selectorOpen = false;
+
+  /**
+   * Constructs a handler for stylesheets using the given policy. The List of embedded stylesheets
+   * produced by this constructor is now available via the getImportedStylesheetsURIList() method.
+   * This constructor to be used when there is no tag name associated with this inline style.
+   *
+   * @param policy the policy to use
+   * @param errorMessages the List of error messages to add error messages too if there are errors
+   * @param messages the error message bundle to pull from
+   */
+  public CssHandler(Policy policy, List<String> errorMessages, ResourceBundle messages) {
+    this(policy, errorMessages, messages, null);
+  }
+
+  /**
+   * Constructs a handler for stylesheets using the given policy. The List of embedded stylesheets
+   * produced by this constructor is available via the getImportedStylesheetsURIList() method.
+   *
+   * @param policy the policy to use
+   * @param errorMessages the List of error messages to add error messages too if there are errors
+   * @param messages the error message bundle to pull from
+   * @param tagName the tag name associated with this inline style
+   */
+  public CssHandler(
+      Policy policy, List<String> errorMessages, ResourceBundle messages, String tagName) {
+    assert policy instanceof InternalPolicy : policy.getClass();
+    this.policy = (InternalPolicy) policy;
+    this.errorMessages = errorMessages;
+    this.messages = messages;
+    this.validator = new CssValidator(policy);
+    // Create a queue of all style sheets that need to be validated to
+    // account for any sheets that may be imported by the current CSS
+    this.importedStyleSheets = new LinkedList<URI>();
+    this.tagName = tagName;
+    this.isInline = (tagName != null);
+  }
+
+  /**
+   * Returns the cleaned stylesheet.
+   *
+   * @return the cleaned stylesheet.
+   */
+  public String getCleanStylesheet() {
+    // Always ensure results contain most recent generation of stylesheet
+    return styleSheet.toString();
+  }
+
+  /**
+   * Returns a list of imported stylesheets from the main parsed stylesheet.
+   *
+   * @return the import stylesheet URI list.
+   */
+  public LinkedList<URI> getImportedStylesheetsURIList() {
+    return importedStyleSheets;
+  }
+
+  /** Empties the stylesheet buffer. */
+  public void emptyStyleSheet() {
+    styleSheet.delete(0, styleSheet.length());
+  }
+
+  /**
+   * Returns the error messages generated during parsing.
+   *
+   * @return the error messages generated during parsing
+   */
+  public Collection<String> getErrorMessages() {
+    return new ArrayList<String>(errorMessages);
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#comment(java.lang.String)
+   */
+  public void comment(String text) throws CSSException {
+    errorMessages.add(
+        ErrorMessageUtil.getMessage(
+            messages,
+            ErrorMessageUtil.ERROR_COMMENT_REMOVED,
+            new Object[] {HTMLEntityEncoder.htmlEntityEncode(text)}));
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#ignorableAtRule(java.lang.String)
+   */
+  public void ignorableAtRule(String atRule) throws CSSException {
+    // this method is called when the parser hits an unrecognized @-rule. Like the page/media/font
+    // declarations, this is CSS2+ stuff
+    if (tagName != null) {
+      errorMessages.add(
+          ErrorMessageUtil.getMessage(
+              messages,
+              ErrorMessageUtil.ERROR_CSS_TAG_RULE_NOTFOUND,
+              new Object[] {
+                HTMLEntityEncoder.htmlEntityEncode(tagName),
+                HTMLEntityEncoder.htmlEntityEncode(atRule)
+              }));
+    } else {
+      errorMessages.add(
+          ErrorMessageUtil.getMessage(
+              messages,
+              ErrorMessageUtil.ERROR_STYLESHEET_RULE_NOTFOUND,
+              new Object[] {HTMLEntityEncoder.htmlEntityEncode(atRule)}));
+    }
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#importStyle(java.lang.String,
+   *      org.w3c.css.sac.SACMediaList, java.lang.String)
+   */
+  public void importStyle(String uri, SACMediaList media, String defaultNamespaceURI)
+      throws CSSException {
+
+    if (!policy.isEmbedStyleSheets()) {
+      errorMessages.add(
+          ErrorMessageUtil.getMessage(
+              messages, ErrorMessageUtil.ERROR_CSS_IMPORT_DISABLED, new Object[] {}));
+      return;
+    }
+
+    try {
+      // check for non-nullness (validate after canonicalization)
+      if (uri == null) {
+        errorMessages.add(
+            ErrorMessageUtil.getMessage(
+                messages, ErrorMessageUtil.ERROR_CSS_IMPORT_URL_INVALID, new Object[] {}));
+        return;
+      }
+
+      URI importedStyleSheet = new URI(uri);
+
+      // canonicalize the URI
+      importedStyleSheet.normalize();
+
+      // validate the URL
+
+      if (!policy.getCommonRegularExpressions("offsiteURL").matches(importedStyleSheet.toString())
+          && !policy
+              .getCommonRegularExpressions("onsiteURL")
+              .matches(importedStyleSheet.toString())) {
+        errorMessages.add(
+            ErrorMessageUtil.getMessage(
+                messages,
+                ErrorMessageUtil.ERROR_CSS_IMPORT_URL_INVALID,
+                new Object[] {HTMLEntityEncoder.htmlEntityEncode(uri)}));
+        return;
+      }
+
+      if (!importedStyleSheet.isAbsolute()) {
+        // we have no concept of relative reference for free form text as an end user can't know
+        // where the corresponding free form will end up
+        if (tagName != null) {
+          errorMessages.add(
+              ErrorMessageUtil.getMessage(
+                  messages,
+                  ErrorMessageUtil.ERROR_CSS_TAG_RELATIVE,
+                  new Object[] {
+                    HTMLEntityEncoder.htmlEntityEncode(tagName),
+                    HTMLEntityEncoder.htmlEntityEncode(uri)
+                  }));
+        } else {
+          errorMessages.add(
+              ErrorMessageUtil.getMessage(
+                  messages,
+                  ErrorMessageUtil.ERROR_STYLESHEET_RELATIVE,
+                  new Object[] {HTMLEntityEncoder.htmlEntityEncode(uri)}));
+        }
+        return;
+      }
+
+      importedStyleSheets.add(importedStyleSheet);
+    } catch (URISyntaxException use) {
+      errorMessages.add(
+          ErrorMessageUtil.getMessage(
+              messages,
+              ErrorMessageUtil.ERROR_CSS_IMPORT_URL_INVALID,
+              new Object[] {HTMLEntityEncoder.htmlEntityEncode(uri)}));
+    }
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#namespaceDeclaration(java.lang.String,
+   *      java.lang.String)
+   */
+  public void namespaceDeclaration(String prefix, String uri) throws CSSException {
+    // CSS3 - Namespace declaration - ignore for now
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#startDocument(org.w3c.css.sac.InputSource)
+   */
+  public void startDocument(InputSource arg0) throws CSSException {
+    // no-op
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#endDocument(org.w3c.css.sac.InputSource)
+   */
+  public void endDocument(InputSource source) throws CSSException {
+    // no-op
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#startFontFace()
+   */
+  public void startFontFace() throws CSSException {
+    // CSS2 Font Face declaration - ignore this for now
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#endFontFace()
+   */
+  public void endFontFace() throws CSSException {
+    // CSS2 Font Face declaration - ignore this for now
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#startMedia(org.w3c.css.sac.SACMediaList)
+   */
+  public void startMedia(SACMediaList media) throws CSSException {
+    // CSS2 Media declaration - ignore this for now
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#endMedia(org.w3c.css.sac.SACMediaList)
+   */
+  public void endMedia(SACMediaList media) throws CSSException {
+    // CSS2 Media declaration - ignore this for now
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#startPage(java.lang.String,
+   *      java.lang.String)
+   */
+  public void startPage(String name, String pseudoPage) throws CSSException {
+    // CSS2 Page declaration - ignore this for now
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#endPage(java.lang.String,
+   *      java.lang.String)
+   */
+  public void endPage(String name, String pseudoPage) throws CSSException {
+    // CSS2 Page declaration - ignore this for now
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#startSelector(org.w3c.css.sac.SelectorList)
+   */
+  public void startSelector(SelectorList selectors) throws CSSException {
+
+    // keep track of number of valid selectors from this rule
+    int selectorCount = 0;
+
+    // check each selector from this rule
+    for (int i = 0; i < selectors.getLength(); i++) {
+      Selector selector = selectors.item(i);
+
+      if (selector != null) {
+        String selectorName = selector.toString();
+
+        boolean isValidSelector = false;
+
+        try {
+          isValidSelector = validator.isValidSelector(selectorName, selector);
+        } catch (ScanException se) {
+          if (tagName != null) {
+            errorMessages.add(
+                ErrorMessageUtil.getMessage(
+                    messages,
+                    ErrorMessageUtil.ERROR_CSS_TAG_SELECTOR_NOTFOUND,
+                    new Object[] {HTMLEntityEncoder.htmlEntityEncode(selector.toString())}));
+          } else {
+            errorMessages.add(
+                ErrorMessageUtil.getMessage(
+                    messages,
+                    ErrorMessageUtil.ERROR_STYLESHEET_SELECTOR_NOTFOUND,
+                    new Object[] {
+                      HTMLEntityEncoder.htmlEntityEncode(tagName),
+                      HTMLEntityEncoder.htmlEntityEncode(selector.toString())
+                    }));
+          }
+        }
+
+        // if the selector is valid, add to list
+        if (isValidSelector) {
+          if (selectorCount > 0) {
+            styleSheet.append(',');
+            styleSheet.append(' ');
+          }
+          styleSheet.append(selectorName);
+
+          selectorCount++;
+
+        } else if (tagName != null) {
+          errorMessages.add(
+              ErrorMessageUtil.getMessage(
+                  messages,
+                  ErrorMessageUtil.ERROR_CSS_TAG_SELECTOR_DISALLOWED,
+                  new Object[] {
+                    HTMLEntityEncoder.htmlEntityEncode(tagName),
+                    HTMLEntityEncoder.htmlEntityEncode(selector.toString())
+                  }));
+
+        } else {
+          errorMessages.add(
+              ErrorMessageUtil.getMessage(
+                  messages,
+                  ErrorMessageUtil.ERROR_STYLESHEET_SELECTOR_DISALLOWED,
+                  new Object[] {HTMLEntityEncoder.htmlEntityEncode(selector.toString())}));
+        }
+      }
+    }
+
+    // if and only if there were selectors that were valid, append appropriate open brace and set
+    // state to within selector
+    if (selectorCount > 0) {
+      styleSheet.append(' ');
+      styleSheet.append('{');
+      styleSheet.append('\n');
+      selectorOpen = true;
+    }
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#endSelector(org.w3c.css.sac.SelectorList)
+   */
+  public void endSelector(SelectorList selectors) throws CSSException {
+    // if we are in a state within a selector, close brace
+    if (selectorOpen) {
+      styleSheet.append('}');
+      styleSheet.append('\n');
+    }
+
+    // reset state
+    selectorOpen = false;
+  }
+
+  /*
+   * (non-Javadoc)
+   *
+   * @see org.w3c.css.sac.DocumentHandler#property(java.lang.String,
+   *      org.w3c.css.sac.LexicalUnit, boolean)
+   */
+  public void property(String name, LexicalUnit value, boolean important) throws CSSException {
+    // only bother validating and building if we are either inline or within a selector tag
+
+    if (!selectorOpen && !isInline) {
+      return;
+    }
+
+    // validate the property
+    if (validator.isValidProperty(name, value)) {
+
+      if (!isInline) {
+        styleSheet.append('\t');
+      }
+      styleSheet.append(name);
+      styleSheet.append(':');
+
+      // append all values
+      while (value != null) {
+        styleSheet.append(' ');
+        styleSheet.append(validator.lexicalValueToString(value));
+        value = value.getNextLexicalUnit();
+      }
+      if (important) {
+        styleSheet.append(" !important");
+      }
+      styleSheet.append(';');
+      if (!isInline) {
+        styleSheet.append('\n');
+      }
+
+    } else if (tagName != null) {
+      errorMessages.add(
+          ErrorMessageUtil.getMessage(
+              messages,
+              ErrorMessageUtil.ERROR_CSS_TAG_PROPERTY_INVALID,
+              new Object[] {
+                HTMLEntityEncoder.htmlEntityEncode(tagName),
+                HTMLEntityEncoder.htmlEntityEncode(name),
+                HTMLEntityEncoder.htmlEntityEncode(validator.lexicalValueToString(value))
+              }));
+    } else {
+      errorMessages.add(
+          ErrorMessageUtil.getMessage(
+              messages,
+              ErrorMessageUtil.ERROR_STYLESHEET_PROPERTY_INVALID,
+              new Object[] {
+                HTMLEntityEncoder.htmlEntityEncode(name),
+                HTMLEntityEncoder.htmlEntityEncode(validator.lexicalValueToString(value))
+              }));
+    }
+  }
 }
diff --git a/src/main/java/org/owasp/validator/css/CssScanner.java b/src/main/java/org/owasp/validator/css/CssScanner.java
index 0f0e67ec..2aba67da 100644
--- a/src/main/java/org/owasp/validator/css/CssScanner.java
+++ b/src/main/java/org/owasp/validator/css/CssScanner.java
@@ -40,17 +40,16 @@
 import java.util.ResourceBundle;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
-
 import org.apache.batik.css.parser.ParseException;
 import org.apache.batik.css.parser.Parser;
-import org.apache.hc.core5.http.ClassicHttpResponse;
-import org.apache.hc.core5.http.HttpEntity;
-import org.apache.hc.core5.http.HttpStatus;
 import org.apache.hc.client5.http.ClientProtocolException;
 import org.apache.hc.client5.http.classic.HttpClient;
-import org.apache.hc.client5.http.config.RequestConfig;
 import org.apache.hc.client5.http.classic.methods.HttpGet;
+import org.apache.hc.client5.http.config.RequestConfig;
 import org.apache.hc.client5.http.impl.classic.HttpClientBuilder;
+import org.apache.hc.core5.http.ClassicHttpResponse;
+import org.apache.hc.core5.http.HttpEntity;
+import org.apache.hc.core5.http.HttpStatus;
 import org.apache.hc.core5.http.io.HttpClientResponseHandler;
 import org.apache.hc.core5.http.io.entity.EntityUtils;
 import org.apache.hc.core5.util.Timeout;
@@ -63,307 +62,290 @@
 import org.w3c.css.sac.InputSource;
 
 /**
- * Encapsulates the parsing and validation of a CSS stylesheet or inline
- * declaration. To make use of this class, instantiate the scanner with the
- * desired policy and call either <code>scanInlineSheet()</code> or
- * <code>scanStyleSheet</code> as appropriate.
+ * Encapsulates the parsing and validation of a CSS stylesheet or inline declaration. To make use of
+ * this class, instantiate the scanner with the desired policy and call either <code>
+ * scanInlineSheet()</code> or <code>scanStyleSheet</code> as appropriate.
  *
  * @see #scanInlineStyle(String, String, int)
  * @see #scanStyleSheet(String, int)
- *
  * @author Jason Li
  */
 public class CssScanner {
 
-    protected static final Timeout DEFAULT_TIMEOUT = Timeout.ofMilliseconds(1000);
-
-    private static final String CDATA = "^\\s*<!\\[CDATA\\[(.*)\\]\\]>\\s*$";
-
-    /**
-     * The parser to be used in any scanning
+  protected static final Timeout DEFAULT_TIMEOUT = Timeout.ofMilliseconds(1000);
+
+  private static final String CDATA = "^\\s*<!\\[CDATA\\[(.*)\\]\\]>\\s*$";
+
+  /** The parser to be used in any scanning */
+  private final Parser parser = new CssParser();
+
+  /** The policy file to be used in any scanning */
+  private final InternalPolicy policy;
+
+  /** The message bundled to pull error messages from. */
+  private final ResourceBundle messages;
+
+  /** The message bundled to pull error messages from. */
+  private final boolean shouldParseImportedStyles;
+
+  private static final Pattern cdataMatchPattern = Pattern.compile(CDATA, Pattern.DOTALL);
+
+  /**
+   * Constructs a scanner based on the given policy. This version of the constructor defaults
+   * shouldParseImportedStyles to false. Look at the other constructor for a description of that
+   * parameter.
+   *
+   * @param policy the policy to follow when scanning
+   * @param messages the error message bundle to pull from
+   */
+  public CssScanner(InternalPolicy policy, ResourceBundle messages) {
+    this(policy, messages, false);
+  }
+
+  /**
+   * Constructs a scanner based on the given policy.
+   *
+   * @param policy the policy to follow when scanning
+   * @param messages the error message bundle to pull from
+   * @param shouldParseImportedStyles Flag to indicate if styles within @import directives should be
+   *     imported and parsed in the resulting style sheet. This boolean determines if URLs should be
+   *     recognized when parsing styles (i.e., to fetch them or ignore them).
+   */
+  public CssScanner(
+      InternalPolicy policy, ResourceBundle messages, boolean shouldParseImportedStyles) {
+    this.policy = policy;
+    this.messages = messages;
+    this.shouldParseImportedStyles = shouldParseImportedStyles;
+  }
+
+  /**
+   * Scans the contents of a full stylesheet (ex. a file based stylesheet or the complete stylesheet
+   * contents as declared within &lt;style&gt; tags)
+   *
+   * @param taintedCss a <code>String</code> containing the contents of the CSS stylesheet to
+   *     validate
+   * @param sizeLimit the limit on the total size in bytes of any imported stylesheets
+   * @return a <code>CleanResuts</code> object containing the results of the scan
+   * @throws ScanException if an error occurs during scanning
+   */
+  public CleanResults scanStyleSheet(String taintedCss, int sizeLimit) throws ScanException {
+
+    long startOfScan = System.currentTimeMillis();
+    List<String> errorMessages = new ArrayList<String>();
+
+    /* Check to see if the text starts with (\s)*<![CDATA[
+     * and end with ]]>(\s)*.
      */
-    private final Parser parser = new CssParser();
 
-    /**
-     * The policy file to be used in any scanning
-     */
-    private final InternalPolicy policy;
+    Matcher m = cdataMatchPattern.matcher(taintedCss);
+    boolean isCdata = m.matches();
 
-    /**
-     * The message bundled to pull error messages from.
-     */
-    private final ResourceBundle messages;
-
-    /**
-     * The message bundled to pull error messages from.
-     */
-    private final boolean shouldParseImportedStyles;
-
-    private static final Pattern cdataMatchPattern = Pattern.compile(CDATA, Pattern.DOTALL);
-
-    /**
-     * Constructs a scanner based on the given policy. This version of the constructor defaults
-     * shouldParseImportedStyles to false. Look at the other constructor for a description of that parameter.
-     *
-     * @param policy
-     *                the policy to follow when scanning
-     * @param messages
-     *                the error message bundle to pull from
-     */
-    public CssScanner(InternalPolicy policy, ResourceBundle messages) {
-        this(policy, messages, false);
+    if (isCdata) {
+      taintedCss = m.group(1);
     }
 
-    /**
-     * Constructs a scanner based on the given policy.
-     *
-     * @param policy
-     *                the policy to follow when scanning
-     * @param messages
-     *                the error message bundle to pull from
-     * @param shouldParseImportedStyles
-     *                Flag to indicate if styles within @import directives should be imported and
-     *                parsed in the resulting style sheet. This boolean determines if URLs should be
-     *                recognized when parsing styles (i.e., to fetch them or ignore them).
-     */
-    public CssScanner(InternalPolicy policy, ResourceBundle messages, boolean shouldParseImportedStyles) {
-    	this.policy = policy;
-    	this.messages = messages;
-    	this.shouldParseImportedStyles = shouldParseImportedStyles;
+    CssHandler handler = new CssHandler(policy, errorMessages, messages);
+
+    // parse the stylesheet
+    parser.setDocumentHandler(handler);
+
+    try {
+      // parse the style declaration
+      // note this does not count against the size limit because it
+      // should already have been counted by the caller since it was
+      // embedded in the HTML
+      parser.parseStyleSheet(new InputSource(new StringReader(taintedCss)));
+    } catch (IOException | ParseException e) {
+      /*
+       * ParseException, from batik, is unfortunately a RuntimeException.
+       */
+      throw new ScanException(e);
     }
 
-    /**
-     * Scans the contents of a full stylesheet (ex. a file based stylesheet
-     * or the complete stylesheet contents as declared within &lt;style&gt;
-     * tags)
-     *
-     * @param taintedCss
-     *                a <code>String</code> containing the contents of the
-     *                CSS stylesheet to validate
-     * @param sizeLimit
-     *                the limit on the total size in bytes of any imported
-     *                stylesheets
-     * @return a <code>CleanResuts</code> object containing the results of
-     *         the scan
-     * @throws ScanException
-     *                 if an error occurs during scanning
-     */
-    public CleanResults scanStyleSheet(String taintedCss, int sizeLimit) throws ScanException {
-
-        long startOfScan = System.currentTimeMillis();
-        List<String> errorMessages = new ArrayList<String>();
-
-        /* Check to see if the text starts with (\s)*<![CDATA[
-         * and end with ]]>(\s)*.
-         */
-
-        Matcher m = cdataMatchPattern.matcher(taintedCss);
-        boolean isCdata = m.matches();
-
-        if (isCdata) {
-            taintedCss = m.group(1);
-        }
-
-        CssHandler handler = new CssHandler(policy, errorMessages, messages);
+    String cleaned = getCleanStylesheetWithImports(sizeLimit, errorMessages, handler);
 
-        // parse the stylesheet
-        parser.setDocumentHandler(handler);
-
-        try {
-	      // parse the style declaration
-	      // note this does not count against the size limit because it
-	      // should already have been counted by the caller since it was
-	      // embedded in the HTML
-	        parser.parseStyleSheet(new InputSource(new StringReader(taintedCss)));
-	    } catch (IOException | ParseException e) {
-            /*
-             * ParseException, from batik, is unfortunately a RuntimeException.
-             */
-	        throw new ScanException(e);
-        }
-
-        String cleaned = getCleanStylesheetWithImports(sizeLimit, errorMessages, handler);
-
-        if (isCdata) {
-            cleaned = "<![CDATA[" + cleaned + "]]>";
-        }
+    if (isCdata) {
+      cleaned = "<![CDATA[" + cleaned + "]]>";
+    }
 
-        return new CleanResults(startOfScan, cleaned, null, errorMessages);
+    return new CleanResults(startOfScan, cleaned, null, errorMessages);
+  }
+
+  /**
+   * Scans the contents of an inline style declaration (ex. in the style attribute of an HTML tag)
+   * and validates the style sheet according to this <code>CssScanner</code>'s policy file.
+   *
+   * @param taintedCss a <code>String</code> containing the contents of the CSS stylesheet to
+   *     validate
+   * @param tagName the name of the tag for which this inline style was declared
+   * @param sizeLimit the limit on the total size in bites of any imported stylesheets
+   * @return a <code>CleanResuts</code> object containing the results of the scan
+   * @throws ScanException if an error occurs during scanning
+   */
+  public CleanResults scanInlineStyle(String taintedCss, String tagName, int sizeLimit)
+      throws ScanException {
+
+    long startOfScan = System.currentTimeMillis();
+
+    List<String> errorMessages = new ArrayList<String>();
+
+    CssHandler handler = new CssHandler(policy, errorMessages, messages, tagName);
+
+    parser.setDocumentHandler(handler);
+
+    try {
+      // parse the inline style declaration
+      // note this does not count against the size limit because it
+      // should already have been counted by the caller since it was
+      // embedded in the HTML
+      parser.parseStyleDeclaration(taintedCss);
+    } catch (IOException ioe) {
+      throw new ScanException(ioe);
     }
 
-    /**
-     * Scans the contents of an inline style declaration (ex. in the style
-     * attribute of an HTML tag) and validates the style sheet according to
-     * this <code>CssScanner</code>'s policy file.
-     *
-     * @param taintedCss
-     *                a <code>String</code> containing the contents of the
-     *                CSS stylesheet to validate
-     * @param tagName
-     *                the name of the tag for which this inline style was
-     *                declared
-     *
-     * @param sizeLimit
-     *                the limit on the total size in bites of any imported
-     *                stylesheets
-     * @return a <code>CleanResuts</code> object containing the results of
-     *         the scan
-     * @throws ScanException
-     *                 if an error occurs during scanning
-     */
-    public CleanResults scanInlineStyle(String taintedCss, String tagName,
-	    int sizeLimit) throws ScanException {
+    String cleaned = getCleanStylesheetWithImports(sizeLimit, errorMessages, handler);
 
-        long startOfScan = System.currentTimeMillis();
+    return new CleanResults(startOfScan, cleaned, null, errorMessages);
+  }
 
-        List<String> errorMessages = new ArrayList<String>();
+  private String getCleanStylesheetWithImports(
+      int sizeLimit, List<String> errorMessages, CssHandler handler) throws ScanException {
+    String cleaned = handler.getCleanStylesheet();
+    if (shouldParseImportedStyles) {
+      handler.emptyStyleSheet();
+      parseImportedStylesheets(handler.getImportedStylesheetsURIList(), errorMessages, sizeLimit);
+      // If there are styles to import they must be added to the beginning
+      cleaned = handler.getCleanStylesheet() + cleaned;
+    }
+    return cleaned;
+  }
+
+  /**
+   * Parses through a <code>LinkedList</code> of imported stylesheet URIs, this method parses
+   * through those stylesheets and validates them
+   *
+   * @param stylesheets the <code>LinkedList</code> of stylesheet URIs to parse
+   * @param errorMessages the list of error messages to append to
+   * @param sizeLimit the limit on the total size in bites of any imported stylesheets
+   * @throws ScanException if an error occurs during scanning
+   */
+  private void parseImportedStylesheets(
+      LinkedList<URI> stylesheets, List<String> errorMessages, int sizeLimit) throws ScanException {
+    // if stylesheets were imported by the inline style declaration,
+    // continue parsing the nested styles. Note this only happens
+    // if CSS importing was enabled in the policy file
+    if (!stylesheets.isEmpty()) {
+      int importedStylesheets = 0;
+
+      // Ensure that we have appropriate timeout values so we don't
+      // get DoSed waiting for returns
+      Timeout timeout = DEFAULT_TIMEOUT;
+      try {
+        timeout =
+            Timeout.ofMilliseconds(Long.parseLong(policy.getDirective(Policy.CONNECTION_TIMEOUT)));
+      } catch (NumberFormatException nfe) {
+      }
+
+      RequestConfig requestConfig =
+          RequestConfig.custom()
+              .setConnectTimeout(timeout)
+              .setResponseTimeout(timeout)
+              .setConnectionRequestTimeout(timeout)
+              .build();
+
+      HttpClient httpClient =
+          HttpClientBuilder.create()
+              .disableAutomaticRetries()
+              .disableConnectionState()
+              .disableCookieManagement()
+              .setDefaultRequestConfig(requestConfig)
+              .build();
+
+      int allowedImports = Policy.DEFAULT_MAX_STYLESHEET_IMPORTS;
+      try {
+        allowedImports = Integer.parseInt(policy.getDirective("maxStyleSheetImports"));
+      } catch (NumberFormatException nfe) {
+      }
+
+      while (!stylesheets.isEmpty()) {
+
+        URI stylesheetUri = stylesheets.removeFirst();
+
+        if (++importedStylesheets > allowedImports) {
+          errorMessages.add(
+              ErrorMessageUtil.getMessage(
+                  messages,
+                  ErrorMessageUtil.ERROR_CSS_IMPORT_EXCEEDED,
+                  new Object[] {
+                    HTMLEntityEncoder.htmlEntityEncode(stylesheetUri.toString()),
+                    String.valueOf(allowedImports)
+                  }));
+          continue;
+        }
 
-        CssHandler handler = new CssHandler(policy, errorMessages, messages, tagName);
+        // Pulled directly from:
+        // https://github.com/apache/httpcomponents-client/blob/5.1.x/httpclient5/src/test/java/org/apache/hc/client5/http/examples/ClientWithResponseHandler.java
+        // Create a custom response handler to read in the stylesheet
+        final HttpClientResponseHandler<String> responseHandler =
+            new HttpClientResponseHandler<String>() {
+
+              @Override
+              public String handleResponse(final ClassicHttpResponse response) throws IOException {
+                final int status = response.getCode();
+                if (status >= HttpStatus.SC_SUCCESS && status < HttpStatus.SC_REDIRECTION) {
+                  final HttpEntity entity = response.getEntity();
+                  try {
+                    return entity != null ? EntityUtils.toString(entity) : null;
+                  } catch (final ParseException | org.apache.hc.core5.http.ParseException ex) {
+                    throw new ClientProtocolException(ex);
+                  }
+                } else {
+                  throw new ClientProtocolException("Unexpected response status: " + status);
+                }
+              }
+            };
 
-        parser.setDocumentHandler(handler);
+        byte[] stylesheet = null;
 
         try {
-            // parse the inline style declaration
-            // note this does not count against the size limit because it
-            // should already have been counted by the caller since it was
-            // embedded in the HTML
-            parser.parseStyleDeclaration(taintedCss);
+          String responseBody = httpClient.execute(new HttpGet(stylesheetUri), responseHandler);
+          // pull down stylesheet, observing size limit
+          stylesheet = responseBody.getBytes();
+          if (stylesheet != null && stylesheet.length > sizeLimit) {
+            errorMessages.add(
+                ErrorMessageUtil.getMessage(
+                    messages,
+                    ErrorMessageUtil.ERROR_CSS_IMPORT_INPUT_SIZE,
+                    new Object[] {
+                      HTMLEntityEncoder.htmlEntityEncode(stylesheetUri.toString()),
+                      String.valueOf(policy.getMaxInputSize())
+                    }));
+            stylesheet = null;
+          }
         } catch (IOException ioe) {
-            throw new ScanException(ioe);
+          errorMessages.add(
+              ErrorMessageUtil.getMessage(
+                  messages,
+                  ErrorMessageUtil.ERROR_CSS_IMPORT_FAILURE,
+                  new Object[] {HTMLEntityEncoder.htmlEntityEncode(stylesheetUri.toString())}));
         }
 
-        String cleaned = getCleanStylesheetWithImports(sizeLimit, errorMessages, handler);
+        if (stylesheet != null) {
+          // decrease the size limit based on the
+          sizeLimit -= stylesheet.length;
 
-        return new CleanResults(startOfScan, cleaned, null, errorMessages);
-    }
+          try {
+            InputSource nextStyleSheet =
+                new InputSource(
+                    new InputStreamReader(
+                        new ByteArrayInputStream(stylesheet), Charset.forName("UTF8")));
+            parser.parseStyleSheet(nextStyleSheet);
 
-    private String getCleanStylesheetWithImports(int sizeLimit, List<String> errorMessages, CssHandler handler)
-            throws ScanException {
-        String cleaned = handler.getCleanStylesheet();
-        if (shouldParseImportedStyles) {
-            handler.emptyStyleSheet();
-            parseImportedStylesheets(handler.getImportedStylesheetsURIList(), errorMessages, sizeLimit);
-            // If there are styles to import they must be added to the beginning
-            cleaned = handler.getCleanStylesheet() + cleaned;
+          } catch (IOException ioe) {
+            throw new ScanException(ioe);
+          }
         }
-        return cleaned;
-    }
-
-    /**
-     * Parses through a <code>LinkedList</code> of imported stylesheet
-     * URIs, this method parses through those stylesheets and validates them
-     *
-     * @param stylesheets the <code>LinkedList</code> of stylesheet URIs to parse
-     * @param errorMessages the list of error messages to append to
-     * @param sizeLimit the limit on the total size in bites of any imported stylesheets
-     * @throws ScanException if an error occurs during scanning
-     */
-    private void parseImportedStylesheets(LinkedList<URI> stylesheets, List<String> errorMessages, int sizeLimit)
-            throws ScanException {
-        // if stylesheets were imported by the inline style declaration,
-        // continue parsing the nested styles. Note this only happens
-        // if CSS importing was enabled in the policy file
-        if (!stylesheets.isEmpty()) {
-            int importedStylesheets = 0;
-
-            // Ensure that we have appropriate timeout values so we don't
-            // get DoSed waiting for returns
-            Timeout timeout = DEFAULT_TIMEOUT;
-            try {
-                timeout = Timeout.ofMilliseconds(Long.parseLong(policy.getDirective(Policy.CONNECTION_TIMEOUT)));
-            } catch (NumberFormatException nfe) {
-            }
-
-            RequestConfig requestConfig = RequestConfig.custom()
-                    .setConnectTimeout(timeout)
-                    .setResponseTimeout(timeout)
-                    .setConnectionRequestTimeout(timeout)
-                    .build();
-
-            HttpClient httpClient = HttpClientBuilder.create().
-                    disableAutomaticRetries().
-                    disableConnectionState().
-                    disableCookieManagement().
-                    setDefaultRequestConfig(requestConfig).
-                    build();
-
-            int allowedImports = Policy.DEFAULT_MAX_STYLESHEET_IMPORTS;
-            try {
-                allowedImports = Integer.parseInt(policy.getDirective("maxStyleSheetImports"));
-            } catch (NumberFormatException nfe) {
-            }
-
-            while (!stylesheets.isEmpty()) {
-
-                URI stylesheetUri = stylesheets.removeFirst();
-
-                if (++importedStylesheets > allowedImports) {
-                    errorMessages.add(ErrorMessageUtil.getMessage(
-                            messages,
-                            ErrorMessageUtil.ERROR_CSS_IMPORT_EXCEEDED,
-                            new Object[] {
-                                    HTMLEntityEncoder.htmlEntityEncode(stylesheetUri.toString()),
-                                    String.valueOf(allowedImports) }));
-                    continue;
-                }
-
-                // Pulled directly from: https://github.com/apache/httpcomponents-client/blob/5.1.x/httpclient5/src/test/java/org/apache/hc/client5/http/examples/ClientWithResponseHandler.java
-                // Create a custom response handler to read in the stylesheet
-                final HttpClientResponseHandler<String> responseHandler = new HttpClientResponseHandler<String>() {
-
-                    @Override
-                    public String handleResponse(
-                            final ClassicHttpResponse response) throws IOException {
-                        final int status = response.getCode();
-                        if (status >= HttpStatus.SC_SUCCESS && status < HttpStatus.SC_REDIRECTION) {
-                            final HttpEntity entity = response.getEntity();
-                            try {
-                                return entity != null ? EntityUtils.toString(entity) : null;
-                            } catch (final ParseException | org.apache.hc.core5.http.ParseException ex) {
-                                throw new ClientProtocolException(ex);
-                            }
-                        } else {
-                            throw new ClientProtocolException("Unexpected response status: " + status);
-                        }
-                    }
-                };
-
-                byte[] stylesheet = null;
-
-                try {
-                    String responseBody = httpClient.execute(new HttpGet(stylesheetUri), responseHandler);
-                    // pull down stylesheet, observing size limit
-                    stylesheet = responseBody.getBytes();
-                    if (stylesheet != null && stylesheet.length > sizeLimit) {
-                        errorMessages.add(ErrorMessageUtil.getMessage(
-                                messages,
-                                ErrorMessageUtil.ERROR_CSS_IMPORT_INPUT_SIZE,
-                                new Object[] {
-                                        HTMLEntityEncoder.htmlEntityEncode(stylesheetUri.toString()),
-                                        String.valueOf(policy.getMaxInputSize()) }));
-                        stylesheet = null;
-                    }
-                } catch (IOException ioe) {
-                    errorMessages.add(ErrorMessageUtil.getMessage(
-                            messages,
-                            ErrorMessageUtil.ERROR_CSS_IMPORT_FAILURE,
-                            new Object[] { HTMLEntityEncoder.htmlEntityEncode(stylesheetUri.toString()) }));
-                }
-
-                if (stylesheet != null) {
-                    // decrease the size limit based on the
-                    sizeLimit -= stylesheet.length;
-
-                    try {
-                        InputSource nextStyleSheet = new InputSource(
-                                new InputStreamReader(new ByteArrayInputStream(stylesheet), Charset.forName("UTF8")));
-                        parser.parseStyleSheet(nextStyleSheet);
-
-                    } catch (IOException ioe) {
-                        throw new ScanException(ioe);
-                    }
-                }
-            } // end while
-        } // end if
-    } // end parseImportedStylesheets()
+      } // end while
+    } // end if
+  } // end parseImportedStylesheets()
 }
diff --git a/src/main/java/org/owasp/validator/css/CssValidator.java b/src/main/java/org/owasp/validator/css/CssValidator.java
index f07bc31c..d6107a61 100644
--- a/src/main/java/org/owasp/validator/css/CssValidator.java
+++ b/src/main/java/org/owasp/validator/css/CssValidator.java
@@ -1,11 +1,11 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without 
+ *
+ * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
- * - Redistributions of source code must retain the above copyright notice, 
+ * - Redistributions of source code must retain the above copyright notice,
  * 	 this list of conditions and the following disclaimer.
  * - Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
@@ -30,13 +30,11 @@
 
 import java.util.Iterator;
 import java.util.regex.Pattern;
-
 import org.owasp.validator.html.Policy;
 import org.owasp.validator.html.ScanException;
 import org.owasp.validator.html.model.AntiSamyPattern;
 import org.owasp.validator.html.model.Property;
 import org.owasp.validator.html.util.HTMLEntityEncoder;
-
 import org.w3c.css.sac.AttributeCondition;
 import org.w3c.css.sac.CombinatorCondition;
 import org.w3c.css.sac.Condition;
@@ -50,351 +48,329 @@
 import org.w3c.css.sac.SimpleSelector;
 
 /**
- * Encapsulates all the necessary operations for validating individual elements
- * of a stylesheet (namely: selectors, conditions and properties).
- * 
+ * Encapsulates all the necessary operations for validating individual elements of a stylesheet
+ * (namely: selectors, conditions and properties).
+ *
  * @author Jason Li
  */
 public class CssValidator {
 
-	private final Policy policy;
-
-	/**
-	 * Constructs a validator for CSS selectors, conditions and properties based
-	 * on the given policy.
-	 * 
-	 * @param policy
-	 *            the policy file to use in this validator
-	 */
-	public CssValidator(Policy policy) {
-		this.policy = policy;
-	}
-
-	/**
-	 * Determines whether the given property (both name and value) are valid
-	 * according to this validator's policy.
-	 * 
-	 * @param name
-	 *            the name of the property
-	 * @param lu
-	 *            the value of the property
-	 * @return true if this property name/value is valid; false otherwise
-	 */
-	public boolean isValidProperty(String name, LexicalUnit lu) {
-		boolean isValid = false;
-		Property property = null;
-
-		if (name != null) {
-			property = policy.getPropertyByName(name.toLowerCase());
-		}
-
-		// if we were able to find the property by name, validate the value
-		if (property != null) {
-
-			// validate all values attached to this property
-			isValid = true;
-			while (lu != null) {
-				String value = lexicalValueToString(lu);
-
-				if (value == null || !validateValue(property, value)) {
-					isValid = false;
-					break;
-				}
-
-				lu = lu.getNextLexicalUnit();
-			}
-		}
-
-		return isValid;
-	}
-
-	/**
-	 * Determines whether the given selector name is valid according to this
-	 * validator's policy.
-	 * 
-	 * @param selectorName
-	 *            the name of the selector
-	 * @param selector
-	 *            the object representation of the selector
-	 * @return true if this selector name is valid; false otherwise
-	 * @throws ScanException When there is a problem encountered
-	 *         while scanning this selector
-	 */
-	public boolean isValidSelector(String selectorName, Selector selector)
-			throws ScanException {
-
-		// determine correct behavior
-		switch (selector.getSelectorType()) {
-		case Selector.SAC_ANY_NODE_SELECTOR:
-		case Selector.SAC_ELEMENT_NODE_SELECTOR:
-		case Selector.SAC_PSEUDO_ELEMENT_SELECTOR:
-		case Selector.SAC_ROOT_NODE_SELECTOR:
-			// these selectors are the most base selectors
-			return validateSimpleSelector((SimpleSelector) selector);
-		case Selector.SAC_CHILD_SELECTOR:
-		case Selector.SAC_DESCENDANT_SELECTOR:
-			// these are compound selectors - decompose into simple selectors
-			DescendantSelector descSelector = (DescendantSelector) selector;
-			return isValidSelector(selectorName, descSelector
-					.getSimpleSelector())
-					&& isValidSelector(selectorName, descSelector
-							.getAncestorSelector());
-		case Selector.SAC_CONDITIONAL_SELECTOR:
-			// this is a compound selector - decompose into simple selectors
-			ConditionalSelector condSelector = (ConditionalSelector) selector;
-			return isValidSelector(selectorName, condSelector
-					.getSimpleSelector())
-					&& isValidCondition(selectorName, condSelector
-							.getCondition());
-		case Selector.SAC_DIRECT_ADJACENT_SELECTOR:
-			// this is a compound selector - decompose into simple selectors
-			SiblingSelector sibSelector = (SiblingSelector) selector;
-			return isValidSelector(selectorName, sibSelector
-					.getSiblingSelector())
-					&& isValidSelector(selectorName, sibSelector.getSelector());
-		case Selector.SAC_NEGATIVE_SELECTOR:
-			// this is a compound selector with one simple selector
-			return validateSimpleSelector((NegativeSelector) selector);
-		case Selector.SAC_CDATA_SECTION_NODE_SELECTOR:
-		case Selector.SAC_COMMENT_NODE_SELECTOR:
-		case Selector.SAC_PROCESSING_INSTRUCTION_NODE_SELECTOR:
-		case Selector.SAC_TEXT_NODE_SELECTOR:
-		default:
-		    
-			throw new UnknownSelectorException(HTMLEntityEncoder.htmlEntityEncode(selector.toString()));
-		}
-	}
-
-	/**
-	 * Validates a basic selector against the policy
-	 * 
-	 * @param selector
-	 *            the object representation of the selector
-	 * @return true if this selector name is valid; false otherwise
-	 */
-	private boolean validateSimpleSelector(SimpleSelector selector) {
-		// ensure the name follows the valid pattern and is not blacklisted
-		// by the exclusion pattern.
-		// NOTE: intentionally using non-short-circuited AND operator to
-		// generate all relevant error messages
-
-        String selectorLowerCase = selector.toString().toLowerCase();
-        return policy.getCommonRegularExpressions("cssElementSelector").matches(selectorLowerCase)
-				&& !policy.getCommonRegularExpressions("cssElementExclusion").matches(selectorLowerCase);
-	}
-
-	/**
-	 * Determines whether the given condition is valid according to this
-	 * validator's policy.
-	 * 
-	 * @param selectorName
-	 *            the name of the selector that contains this condition
-	 * @param condition
-	 *            the object representation of this condition
-	 * @return true if this condition is valid; false otherwise
-	 * @throws ScanException When there is a problem encountered
-	 *         while scanning this condition
-	 */
-	public boolean isValidCondition(String selectorName, Condition condition)
-			throws ScanException {
-		switch (condition.getConditionType()) {
-		case Condition.SAC_AND_CONDITION:
-		case Condition.SAC_OR_CONDITION:
-			// these are compound condition - decompose into simple conditions
-			CombinatorCondition comboCondition = (CombinatorCondition) condition;
-			return isValidCondition(selectorName, comboCondition
-					.getFirstCondition())
-					&& isValidCondition(selectorName, comboCondition
-							.getSecondCondition());
-		case Condition.SAC_CLASS_CONDITION:
-			// this is a basic class condition; compare condition against
-			// valid pattern and is not blacklisted by exclusion pattern
-
-            return validateCondition((AttributeCondition) condition, policy.getCommonRegularExpressions("cssClassSelector"), policy.getCommonRegularExpressions("cssClassExclusion"));
-		case Condition.SAC_ID_CONDITION:
-			// this is a basic ID condition; compare condition against
-			// valid pattern and is not blacklisted by exclusion pattern
-
-            return validateCondition((AttributeCondition) condition, policy.getCommonRegularExpressions("cssIDSelector"), policy.getCommonRegularExpressions("cssIDExclusion"));
-		case Condition.SAC_PSEUDO_CLASS_CONDITION:
-			// this is a basic psuedo element condition; compare condition
-			// against valid pattern and is not blacklisted by exclusion pattern
-
-            return validateCondition((AttributeCondition) condition, policy.getCommonRegularExpressions("cssPseudoElementSelector"), policy.getCommonRegularExpressions("cssPsuedoElementExclusion"));
-		case Condition.SAC_BEGIN_HYPHEN_ATTRIBUTE_CONDITION:
-		case Condition.SAC_ONE_OF_ATTRIBUTE_CONDITION:
-		case Condition.SAC_ATTRIBUTE_CONDITION:
-			// this is a basic class condition; compare condition against
-			// valid pattern and is not blacklisted by exclusion pattern
-
-            return validateCondition((AttributeCondition) condition, policy.getCommonRegularExpressions("cssAttributeSelector"), policy.getCommonRegularExpressions("cssAttributeExclusion"));
-		case Condition.SAC_NEGATIVE_CONDITION:
-			// this is a compound condition; decompose to simple condition
-			return isValidCondition(selectorName,
-					((NegativeCondition) condition).getCondition());
-		case Condition.SAC_ONLY_CHILD_CONDITION:
-		case Condition.SAC_ONLY_TYPE_CONDITION:
-			// :only-child and :only-of-type are constants
-			return true;
-		case Condition.SAC_POSITIONAL_CONDITION:
-		case Condition.SAC_CONTENT_CONDITION:
-		case Condition.SAC_LANG_CONDITION:
-		default:
-		    	throw new UnknownSelectorException(HTMLEntityEncoder.htmlEntityEncode(selectorName));
-		}
-	}
-
-	/**
-	 * Validates a basic condition against the white list pattern and the
-	 * blacklist pattern
-	 * 
-	 * @param condition
-	 *            the object representation of the condition
-	 * @param pattern
-	 *            the positive pattern of valid conditions
-	 * @param exclusionPattern
-	 *            the negative pattern of excluded conditions
-	 * @return true if this selector name is valid; false otherwise
-	 */
-	private boolean validateCondition(AttributeCondition condition,
-			AntiSamyPattern pattern, AntiSamyPattern exclusionPattern) {
-		// check that the name of the condition matches valid pattern and does
-		// not match exclusion pattern
-		// NOTE: intentionally using non-short-circuited AND operator to
-		// generate all relevant error messages
-        String otherLower = condition.toString().toLowerCase();
-        return pattern.matches(otherLower) && !exclusionPattern.matches(otherLower);
-	}
-
-	/**
-	 * Determines whether the given property value is valid according to this
-	 * validator's policy.
-	 * 
-	 * @param property
-	 *            the object representation of the property and its associated
-	 *            policy
-	 * @param value
-	 *            the string representation of the value
-	 * @return true if the property is valid; false otherwise
-	 */
-	private boolean validateValue(Property property, String value) {
-		boolean isValid = false;
-
-		// normalize the value to lowercase
-		value = value.toLowerCase();
-
-		// check if the value matches any of the allowed literal values
-		Iterator<?> allowedValues = property.getAllowedValues().iterator();
-		while (allowedValues.hasNext() && !isValid) {
-			String allowedValue = (String) allowedValues.next();
-
-			if (allowedValue != null && allowedValue.equals(value)) {
-				isValid = true;
-			}
-		}
-
-		// check if the value matches any of the allowed regular expressions
-		Iterator<?> allowedRegexps = property.getAllowedRegExp().iterator();
-		while (allowedRegexps.hasNext() && !isValid) {
-			Pattern pattern = (Pattern) allowedRegexps.next();
-
-			if (pattern != null && pattern.matcher(value).matches()) {
-				isValid = true;
-			}
-		}
-
-		// check if the value matches any of the allowed shorthands
-		Iterator<?> shorthandRefs = property.getShorthandRefs().iterator();
-		while (shorthandRefs.hasNext() && !isValid) {
-			String shorthandRef = (String) shorthandRefs.next();
-			Property shorthand = policy.getPropertyByName(shorthandRef);
-
-			if (shorthand != null) {
-				isValid = validateValue(shorthand, value);
-			}
-		}
-
-		return isValid;
-	}
-
-	/**
-	 * Converts the given lexical unit to a <code>String</code>
-	 * representation. This method does not perform any validation - it is meant
-	 * to be used in conjunction with the validator/logging methods.
-	 * 
-	 * @param lu
-	 *            the lexical unit to convert
-	 * @return a <code>String</code> representation of the given lexical unit
-	 */
-	public String lexicalValueToString(LexicalUnit lu) {
-		switch (lu.getLexicalUnitType()) {
-		case LexicalUnit.SAC_PERCENTAGE:
-		case LexicalUnit.SAC_DIMENSION:
-		case LexicalUnit.SAC_EM:
-		case LexicalUnit.SAC_EX:
-		case LexicalUnit.SAC_PIXEL:
-		case LexicalUnit.SAC_INCH:
-		case LexicalUnit.SAC_CENTIMETER:
-		case LexicalUnit.SAC_MILLIMETER:
-		case LexicalUnit.SAC_POINT:
-		case LexicalUnit.SAC_PICA:
-		case LexicalUnit.SAC_DEGREE:
-		case LexicalUnit.SAC_GRADIAN:
-		case LexicalUnit.SAC_RADIAN:
-		case LexicalUnit.SAC_MILLISECOND:
-		case LexicalUnit.SAC_SECOND:
-		case LexicalUnit.SAC_HERTZ:
-		case LexicalUnit.SAC_KILOHERTZ:
-			// these are all measurements
-			return lu.getFloatValue() + lu.getDimensionUnitText();
-		case LexicalUnit.SAC_INTEGER:
-			// just a number
-			return String.valueOf(lu.getIntegerValue());
-		case LexicalUnit.SAC_REAL:
-			// just a number
-			return String.valueOf(lu.getFloatValue());
-		case LexicalUnit.SAC_STRING_VALUE:
-		case LexicalUnit.SAC_IDENT:
-			// just a string/identifier
-			String stringValue = lu.getStringValue();
-			if(stringValue.indexOf(" ") != -1)
-				stringValue = "\""+stringValue+"\"";
-			return stringValue;
-		case LexicalUnit.SAC_URI:
-			// this is a URL
-			return "url(" + lu.getStringValue() + ")";
-		case LexicalUnit.SAC_RGBCOLOR:
-			// this is a rgb encoded color
-			StringBuffer sb = new StringBuffer("rgb(");
-			LexicalUnit param = lu.getParameters();
-			sb.append(param.getIntegerValue()); // R value
-			sb.append(',');
-			param = param.getNextLexicalUnit(); // comma
-			param = param.getNextLexicalUnit(); // G value
-			sb.append(param.getIntegerValue());
-			sb.append(',');
-			param = param.getNextLexicalUnit(); // comma
-			param = param.getNextLexicalUnit(); // B value
-			sb.append(param.getIntegerValue());
-			sb.append(')');
-
-			return sb.toString();
-		case LexicalUnit.SAC_INHERIT:
-			// constant
-			return "inherit";
-		case LexicalUnit.SAC_OPERATOR_COMMA:
-		    	return ",";
-		case LexicalUnit.SAC_ATTR:
-		case LexicalUnit.SAC_COUNTER_FUNCTION:
-		case LexicalUnit.SAC_COUNTERS_FUNCTION:
-		case LexicalUnit.SAC_FUNCTION:
-		case LexicalUnit.SAC_RECT_FUNCTION:
-		case LexicalUnit.SAC_SUB_EXPRESSION:
-		case LexicalUnit.SAC_UNICODERANGE:
-		default:
-			// these are properties that shouldn't be necessary for most run
-			// of the mill HTML/CSS
-			return null;
-		}
-	}
+  private final Policy policy;
+
+  /**
+   * Constructs a validator for CSS selectors, conditions and properties based on the given policy.
+   *
+   * @param policy the policy file to use in this validator
+   */
+  public CssValidator(Policy policy) {
+    this.policy = policy;
+  }
+
+  /**
+   * Determines whether the given property (both name and value) are valid according to this
+   * validator's policy.
+   *
+   * @param name the name of the property
+   * @param lu the value of the property
+   * @return true if this property name/value is valid; false otherwise
+   */
+  public boolean isValidProperty(String name, LexicalUnit lu) {
+    boolean isValid = false;
+    Property property = null;
+
+    if (name != null) {
+      property = policy.getPropertyByName(name.toLowerCase());
+    }
+
+    // if we were able to find the property by name, validate the value
+    if (property != null) {
+
+      // validate all values attached to this property
+      isValid = true;
+      while (lu != null) {
+        String value = lexicalValueToString(lu);
+
+        if (value == null || !validateValue(property, value)) {
+          isValid = false;
+          break;
+        }
+
+        lu = lu.getNextLexicalUnit();
+      }
+    }
+
+    return isValid;
+  }
+
+  /**
+   * Determines whether the given selector name is valid according to this validator's policy.
+   *
+   * @param selectorName the name of the selector
+   * @param selector the object representation of the selector
+   * @return true if this selector name is valid; false otherwise
+   * @throws ScanException When there is a problem encountered while scanning this selector
+   */
+  public boolean isValidSelector(String selectorName, Selector selector) throws ScanException {
+
+    // determine correct behavior
+    switch (selector.getSelectorType()) {
+      case Selector.SAC_ANY_NODE_SELECTOR:
+      case Selector.SAC_ELEMENT_NODE_SELECTOR:
+      case Selector.SAC_PSEUDO_ELEMENT_SELECTOR:
+      case Selector.SAC_ROOT_NODE_SELECTOR:
+        // these selectors are the most base selectors
+        return validateSimpleSelector((SimpleSelector) selector);
+      case Selector.SAC_CHILD_SELECTOR:
+      case Selector.SAC_DESCENDANT_SELECTOR:
+        // these are compound selectors - decompose into simple selectors
+        DescendantSelector descSelector = (DescendantSelector) selector;
+        return isValidSelector(selectorName, descSelector.getSimpleSelector())
+            && isValidSelector(selectorName, descSelector.getAncestorSelector());
+      case Selector.SAC_CONDITIONAL_SELECTOR:
+        // this is a compound selector - decompose into simple selectors
+        ConditionalSelector condSelector = (ConditionalSelector) selector;
+        return isValidSelector(selectorName, condSelector.getSimpleSelector())
+            && isValidCondition(selectorName, condSelector.getCondition());
+      case Selector.SAC_DIRECT_ADJACENT_SELECTOR:
+        // this is a compound selector - decompose into simple selectors
+        SiblingSelector sibSelector = (SiblingSelector) selector;
+        return isValidSelector(selectorName, sibSelector.getSiblingSelector())
+            && isValidSelector(selectorName, sibSelector.getSelector());
+      case Selector.SAC_NEGATIVE_SELECTOR:
+        // this is a compound selector with one simple selector
+        return validateSimpleSelector((NegativeSelector) selector);
+      case Selector.SAC_CDATA_SECTION_NODE_SELECTOR:
+      case Selector.SAC_COMMENT_NODE_SELECTOR:
+      case Selector.SAC_PROCESSING_INSTRUCTION_NODE_SELECTOR:
+      case Selector.SAC_TEXT_NODE_SELECTOR:
+      default:
+        throw new UnknownSelectorException(HTMLEntityEncoder.htmlEntityEncode(selector.toString()));
+    }
+  }
+
+  /**
+   * Validates a basic selector against the policy
+   *
+   * @param selector the object representation of the selector
+   * @return true if this selector name is valid; false otherwise
+   */
+  private boolean validateSimpleSelector(SimpleSelector selector) {
+    // ensure the name follows the valid pattern and is not blacklisted
+    // by the exclusion pattern.
+    // NOTE: intentionally using non-short-circuited AND operator to
+    // generate all relevant error messages
+
+    String selectorLowerCase = selector.toString().toLowerCase();
+    return policy.getCommonRegularExpressions("cssElementSelector").matches(selectorLowerCase)
+        && !policy.getCommonRegularExpressions("cssElementExclusion").matches(selectorLowerCase);
+  }
+
+  /**
+   * Determines whether the given condition is valid according to this validator's policy.
+   *
+   * @param selectorName the name of the selector that contains this condition
+   * @param condition the object representation of this condition
+   * @return true if this condition is valid; false otherwise
+   * @throws ScanException When there is a problem encountered while scanning this condition
+   */
+  public boolean isValidCondition(String selectorName, Condition condition) throws ScanException {
+    switch (condition.getConditionType()) {
+      case Condition.SAC_AND_CONDITION:
+      case Condition.SAC_OR_CONDITION:
+        // these are compound condition - decompose into simple conditions
+        CombinatorCondition comboCondition = (CombinatorCondition) condition;
+        return isValidCondition(selectorName, comboCondition.getFirstCondition())
+            && isValidCondition(selectorName, comboCondition.getSecondCondition());
+      case Condition.SAC_CLASS_CONDITION:
+        // this is a basic class condition; compare condition against
+        // valid pattern and is not blacklisted by exclusion pattern
+
+        return validateCondition(
+            (AttributeCondition) condition,
+            policy.getCommonRegularExpressions("cssClassSelector"),
+            policy.getCommonRegularExpressions("cssClassExclusion"));
+      case Condition.SAC_ID_CONDITION:
+        // this is a basic ID condition; compare condition against
+        // valid pattern and is not blacklisted by exclusion pattern
+
+        return validateCondition(
+            (AttributeCondition) condition,
+            policy.getCommonRegularExpressions("cssIDSelector"),
+            policy.getCommonRegularExpressions("cssIDExclusion"));
+      case Condition.SAC_PSEUDO_CLASS_CONDITION:
+        // this is a basic psuedo element condition; compare condition
+        // against valid pattern and is not blacklisted by exclusion pattern
+
+        return validateCondition(
+            (AttributeCondition) condition,
+            policy.getCommonRegularExpressions("cssPseudoElementSelector"),
+            policy.getCommonRegularExpressions("cssPsuedoElementExclusion"));
+      case Condition.SAC_BEGIN_HYPHEN_ATTRIBUTE_CONDITION:
+      case Condition.SAC_ONE_OF_ATTRIBUTE_CONDITION:
+      case Condition.SAC_ATTRIBUTE_CONDITION:
+        // this is a basic class condition; compare condition against
+        // valid pattern and is not blacklisted by exclusion pattern
+
+        return validateCondition(
+            (AttributeCondition) condition,
+            policy.getCommonRegularExpressions("cssAttributeSelector"),
+            policy.getCommonRegularExpressions("cssAttributeExclusion"));
+      case Condition.SAC_NEGATIVE_CONDITION:
+        // this is a compound condition; decompose to simple condition
+        return isValidCondition(selectorName, ((NegativeCondition) condition).getCondition());
+      case Condition.SAC_ONLY_CHILD_CONDITION:
+      case Condition.SAC_ONLY_TYPE_CONDITION:
+        // :only-child and :only-of-type are constants
+        return true;
+      case Condition.SAC_POSITIONAL_CONDITION:
+      case Condition.SAC_CONTENT_CONDITION:
+      case Condition.SAC_LANG_CONDITION:
+      default:
+        throw new UnknownSelectorException(HTMLEntityEncoder.htmlEntityEncode(selectorName));
+    }
+  }
+
+  /**
+   * Validates a basic condition against the white list pattern and the blacklist pattern
+   *
+   * @param condition the object representation of the condition
+   * @param pattern the positive pattern of valid conditions
+   * @param exclusionPattern the negative pattern of excluded conditions
+   * @return true if this selector name is valid; false otherwise
+   */
+  private boolean validateCondition(
+      AttributeCondition condition, AntiSamyPattern pattern, AntiSamyPattern exclusionPattern) {
+    // check that the name of the condition matches valid pattern and does
+    // not match exclusion pattern
+    // NOTE: intentionally using non-short-circuited AND operator to
+    // generate all relevant error messages
+    String otherLower = condition.toString().toLowerCase();
+    return pattern.matches(otherLower) && !exclusionPattern.matches(otherLower);
+  }
+
+  /**
+   * Determines whether the given property value is valid according to this validator's policy.
+   *
+   * @param property the object representation of the property and its associated policy
+   * @param value the string representation of the value
+   * @return true if the property is valid; false otherwise
+   */
+  private boolean validateValue(Property property, String value) {
+    boolean isValid = false;
+
+    // normalize the value to lowercase
+    value = value.toLowerCase();
+
+    // check if the value matches any of the allowed literal values
+    Iterator<?> allowedValues = property.getAllowedValues().iterator();
+    while (allowedValues.hasNext() && !isValid) {
+      String allowedValue = (String) allowedValues.next();
+
+      if (allowedValue != null && allowedValue.equals(value)) {
+        isValid = true;
+      }
+    }
+
+    // check if the value matches any of the allowed regular expressions
+    Iterator<?> allowedRegexps = property.getAllowedRegExp().iterator();
+    while (allowedRegexps.hasNext() && !isValid) {
+      Pattern pattern = (Pattern) allowedRegexps.next();
+
+      if (pattern != null && pattern.matcher(value).matches()) {
+        isValid = true;
+      }
+    }
+
+    // check if the value matches any of the allowed shorthands
+    Iterator<?> shorthandRefs = property.getShorthandRefs().iterator();
+    while (shorthandRefs.hasNext() && !isValid) {
+      String shorthandRef = (String) shorthandRefs.next();
+      Property shorthand = policy.getPropertyByName(shorthandRef);
+
+      if (shorthand != null) {
+        isValid = validateValue(shorthand, value);
+      }
+    }
+
+    return isValid;
+  }
+
+  /**
+   * Converts the given lexical unit to a <code>String</code> representation. This method does not
+   * perform any validation - it is meant to be used in conjunction with the validator/logging
+   * methods.
+   *
+   * @param lu the lexical unit to convert
+   * @return a <code>String</code> representation of the given lexical unit
+   */
+  public String lexicalValueToString(LexicalUnit lu) {
+    switch (lu.getLexicalUnitType()) {
+      case LexicalUnit.SAC_PERCENTAGE:
+      case LexicalUnit.SAC_DIMENSION:
+      case LexicalUnit.SAC_EM:
+      case LexicalUnit.SAC_EX:
+      case LexicalUnit.SAC_PIXEL:
+      case LexicalUnit.SAC_INCH:
+      case LexicalUnit.SAC_CENTIMETER:
+      case LexicalUnit.SAC_MILLIMETER:
+      case LexicalUnit.SAC_POINT:
+      case LexicalUnit.SAC_PICA:
+      case LexicalUnit.SAC_DEGREE:
+      case LexicalUnit.SAC_GRADIAN:
+      case LexicalUnit.SAC_RADIAN:
+      case LexicalUnit.SAC_MILLISECOND:
+      case LexicalUnit.SAC_SECOND:
+      case LexicalUnit.SAC_HERTZ:
+      case LexicalUnit.SAC_KILOHERTZ:
+        // these are all measurements
+        return lu.getFloatValue() + lu.getDimensionUnitText();
+      case LexicalUnit.SAC_INTEGER:
+        // just a number
+        return String.valueOf(lu.getIntegerValue());
+      case LexicalUnit.SAC_REAL:
+        // just a number
+        return String.valueOf(lu.getFloatValue());
+      case LexicalUnit.SAC_STRING_VALUE:
+      case LexicalUnit.SAC_IDENT:
+        // just a string/identifier
+        String stringValue = lu.getStringValue();
+        if (stringValue.indexOf(" ") != -1) stringValue = "\"" + stringValue + "\"";
+        return stringValue;
+      case LexicalUnit.SAC_URI:
+        // this is a URL
+        return "url(" + lu.getStringValue() + ")";
+      case LexicalUnit.SAC_RGBCOLOR:
+        // this is a rgb encoded color
+        StringBuffer sb = new StringBuffer("rgb(");
+        LexicalUnit param = lu.getParameters();
+        sb.append(param.getIntegerValue()); // R value
+        sb.append(',');
+        param = param.getNextLexicalUnit(); // comma
+        param = param.getNextLexicalUnit(); // G value
+        sb.append(param.getIntegerValue());
+        sb.append(',');
+        param = param.getNextLexicalUnit(); // comma
+        param = param.getNextLexicalUnit(); // B value
+        sb.append(param.getIntegerValue());
+        sb.append(')');
+
+        return sb.toString();
+      case LexicalUnit.SAC_INHERIT:
+        // constant
+        return "inherit";
+      case LexicalUnit.SAC_OPERATOR_COMMA:
+        return ",";
+      case LexicalUnit.SAC_ATTR:
+      case LexicalUnit.SAC_COUNTER_FUNCTION:
+      case LexicalUnit.SAC_COUNTERS_FUNCTION:
+      case LexicalUnit.SAC_FUNCTION:
+      case LexicalUnit.SAC_RECT_FUNCTION:
+      case LexicalUnit.SAC_SUB_EXPRESSION:
+      case LexicalUnit.SAC_UNICODERANGE:
+      default:
+        // these are properties that shouldn't be necessary for most run
+        // of the mill HTML/CSS
+        return null;
+    }
+  }
 }
diff --git a/src/main/java/org/owasp/validator/css/UnknownSelectorException.java b/src/main/java/org/owasp/validator/css/UnknownSelectorException.java
index 31b7f640..a3f1bf1b 100644
--- a/src/main/java/org/owasp/validator/css/UnknownSelectorException.java
+++ b/src/main/java/org/owasp/validator/css/UnknownSelectorException.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -24,27 +24,24 @@
 package org.owasp.validator.css;
 
 /**
- * This exception gets thrown when there is an unrecognized Selector type parsing
- * the tainted CSS.
- * 
+ * This exception gets thrown when there is an unrecognized Selector type parsing the tainted CSS.
+ *
  * @author Jason Li
  */
 import org.owasp.validator.html.ScanException;
 
 public class UnknownSelectorException extends ScanException {
-    
-    private final String selectorName;
-    
-    public UnknownSelectorException(String selectorName) {
-	super("Unknown selector " + selectorName);
-	
-	this.selectorName = selectorName;
-    }
 
-    /**
-     * @return the selectorName
-     */
-    public String getSelectorName() {
-        return selectorName;
-    }
+  private final String selectorName;
+
+  public UnknownSelectorException(String selectorName) {
+    super("Unknown selector " + selectorName);
+
+    this.selectorName = selectorName;
+  }
+
+  /** @return the selectorName */
+  public String getSelectorName() {
+    return selectorName;
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/AntiSamy.java b/src/main/java/org/owasp/validator/html/AntiSamy.java
index b1803308..3d0d71b8 100644
--- a/src/main/java/org/owasp/validator/html/AntiSamy.java
+++ b/src/main/java/org/owasp/validator/html/AntiSamy.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -24,157 +24,151 @@
 
 package org.owasp.validator.html;
 
-import org.owasp.validator.html.scan.AntiSamyDOMScanner;
-import org.owasp.validator.html.scan.AntiSamySAXScanner;
-
 import java.io.File;
 import java.io.Reader;
 import java.io.Writer;
+import org.owasp.validator.html.scan.AntiSamyDOMScanner;
+import org.owasp.validator.html.scan.AntiSamySAXScanner;
 
 /**
- * This is the only class from which the outside world should be calling. The
- * <code>scan()</code> method holds the meat and potatoes of AntiSamy. The file
- * contains a number of ways for <code>scan()</code>'ing depending on the
- * accessibility of the policy file.
+ * This is the only class from which the outside world should be calling. The <code>scan()</code>
+ * method holds the meat and potatoes of AntiSamy. The file contains a number of ways for <code>
+ * scan()</code>'ing depending on the accessibility of the policy file.
  *
  * @author Arshan Dabirsiaghi
  */
-
 public class AntiSamy {
 
-	public static final int DOM = 0;
-	public static final int SAX = 1;
-
-	private Policy policy = null;
-
-	public AntiSamy() {
-	}
-
-	public AntiSamy(Policy policy) {
-		this.policy = policy;
-	}
-
-	/**
-	 * The meat and potatoes. The <code>scan()</code> family of methods are the
-	 * only methods the outside world should be calling to invoke AntiSamy.
-	 * 
-	 * @param taintedHTML Untrusted HTML which may contain malicious code.
-	 * @return A <code>CleanResults</code> object which contains information
-	 *         about the scan (including the results).
-	 * @throws ScanException When there is a problem encountered
-	 *         while scanning the HTML.
-	 * @throws PolicyException When there is a problem reading the policy file.
-	 */
-	public CleanResults scan(String taintedHTML) throws ScanException, PolicyException {
-		return this.scan(taintedHTML, this.policy, SAX);
-	}
-
-	/**
-	 * This method sets <code>scan()</code> to use the specified scan type.
-	 * 
-	 * @param taintedHTML Untrusted HTML which may contain malicious code.
-	 * @param scanType The type of scan (DOM or SAX).
-	 * @return A <code>CleanResults</code> object which contains information
-	 *         about the scan (including the results).
-	 * @throws ScanException When there is a problem encountered
-	 *         while scanning the HTML.
-	 * @throws PolicyException When there is a problem reading the policy file.
-	 */
-	public CleanResults scan(String taintedHTML, int scanType) throws ScanException, PolicyException {
-
-		return this.scan(taintedHTML, this.policy, scanType);
-	}
-
-	/**
-	 * This method wraps <code>scan()</code> using the Policy object passed in.
-	 * 
-	 * @param taintedHTML Untrusted HTML which may contain malicious code.
-	 * @param policy The custom policy to enforce.
-	 * @return A <code>CleanResults</code> object which contains information
-	 *         about the scan (including the results).
-	 * @throws ScanException When there is a problem encountered
-	 *         while scanning the HTML.
-	 * @throws PolicyException When there is a problem reading the policy file.
-	 */
-	public CleanResults scan(String taintedHTML, Policy policy) throws ScanException, PolicyException {
-		return this.scan(taintedHTML, policy, DOM);
-	}
-
-	/**
-	 * This method wraps <code>scan()</code> using the Policy object passed in and the specified scan type.
-	 * 
-	 * @param taintedHTML Untrusted HTML which may contain malicious code.
-	 * @param policy The custom policy to enforce.
-	 * @param scanType The type of scan (DOM or SAX).
-	 * @return A <code>CleanResults</code> object which contains information
-	 *         about the scan (including the results).
-	 * @throws ScanException When there is a problem encountered
-	 *         while scanning the HTML.
-	 * @throws PolicyException When there is a problem reading the policy file.
-	 */
-	public CleanResults scan(String taintedHTML, Policy policy, int scanType) throws ScanException, PolicyException {
-		if (policy == null) {
-			throw new PolicyException("No policy loaded");
-		}
-
-		if (scanType == DOM) {
-			return new AntiSamyDOMScanner(policy).scan(taintedHTML);
-		} else {
-			return new AntiSamySAXScanner(policy).scan(taintedHTML);
-		}
-	}
-	
-	/**
-	 * Use this method if caller has Streams rather than Strings for I/O
-	 * Useful for servlets where the response is very large and we don't validate, 
-	 * simply encode as bytes are consumed from the stream.
-	 * @param reader Reader that produces the input, possibly a little at a time
-	 * @param writer Writer that receives the cleaned output, possibly a little at a time
-	 * @param policy Policy that directs the scan
-	 * @return CleanResults where the cleanHtml is null. If caller wants the clean HTML, it
-	 *         must capture the writer's contents. When using Streams, caller generally
-	 *         doesn't want to create a single string containing clean HTML.
-	 * @throws ScanException When there is a problem encountered
-	 *         while scanning the HTML.
-	 */
-	public CleanResults scan(Reader reader, Writer writer, Policy policy) throws ScanException {
-	    return (new AntiSamySAXScanner(policy)).scan(reader, writer);
-	}
-
-	/**
-	 * This method wraps <code>scan()</code> using the Policy in the specified file.
-	 * 
-	 * @param taintedHTML Untrusted HTML which may contain malicious code.
-	 * @param filename The file name of the custom policy to enforce.
-	 * @return A <code>CleanResults</code> object which contains information
-	 *         about the scan (including the results).
-	 * @throws ScanException When there is a problem encountered
-	 *         while scanning the HTML.
-	 * @throws PolicyException When there is a problem reading the policy file.
-	 */
-	public CleanResults scan(String taintedHTML, String filename) throws ScanException, PolicyException {
-
-        Policy policy = Policy.getInstance(filename);
-
-        return this.scan(taintedHTML, policy);
-	}
-
-	/**
-	 * This method wraps <code>scan()</code> using the policy File object passed in.
-	 * 
-	 * @param taintedHTML Untrusted HTML which may contain malicious code.
-	 * @param policyFile The File object of the custom policy to enforce.
-	 * @return A <code>CleanResults</code> object which contains information
-	 *         about the scan (including the results).
-	 * @throws ScanException When there is a problem encountered
-	 *         while scanning the HTML.
-	 * @throws PolicyException When there is a problem reading the policy file.
-	 */
-	public CleanResults scan(String taintedHTML, File policyFile) throws ScanException, PolicyException {
-
-        Policy policy = Policy.getInstance(policyFile);
-
-        return this.scan(taintedHTML, policy);
-	}
-
+  public static final int DOM = 0;
+  public static final int SAX = 1;
+
+  private Policy policy = null;
+
+  public AntiSamy() {}
+
+  public AntiSamy(Policy policy) {
+    this.policy = policy;
+  }
+
+  /**
+   * The meat and potatoes. The <code>scan()</code> family of methods are the only methods the
+   * outside world should be calling to invoke AntiSamy.
+   *
+   * @param taintedHTML Untrusted HTML which may contain malicious code.
+   * @return A <code>CleanResults</code> object which contains information about the scan (including
+   *     the results).
+   * @throws ScanException When there is a problem encountered while scanning the HTML.
+   * @throws PolicyException When there is a problem reading the policy file.
+   */
+  public CleanResults scan(String taintedHTML) throws ScanException, PolicyException {
+    return this.scan(taintedHTML, this.policy, SAX);
+  }
+
+  /**
+   * This method sets <code>scan()</code> to use the specified scan type.
+   *
+   * @param taintedHTML Untrusted HTML which may contain malicious code.
+   * @param scanType The type of scan (DOM or SAX).
+   * @return A <code>CleanResults</code> object which contains information about the scan (including
+   *     the results).
+   * @throws ScanException When there is a problem encountered while scanning the HTML.
+   * @throws PolicyException When there is a problem reading the policy file.
+   */
+  public CleanResults scan(String taintedHTML, int scanType) throws ScanException, PolicyException {
+
+    return this.scan(taintedHTML, this.policy, scanType);
+  }
+
+  /**
+   * This method wraps <code>scan()</code> using the Policy object passed in.
+   *
+   * @param taintedHTML Untrusted HTML which may contain malicious code.
+   * @param policy The custom policy to enforce.
+   * @return A <code>CleanResults</code> object which contains information about the scan (including
+   *     the results).
+   * @throws ScanException When there is a problem encountered while scanning the HTML.
+   * @throws PolicyException When there is a problem reading the policy file.
+   */
+  public CleanResults scan(String taintedHTML, Policy policy)
+      throws ScanException, PolicyException {
+    return this.scan(taintedHTML, policy, DOM);
+  }
+
+  /**
+   * This method wraps <code>scan()</code> using the Policy object passed in and the specified scan
+   * type.
+   *
+   * @param taintedHTML Untrusted HTML which may contain malicious code.
+   * @param policy The custom policy to enforce.
+   * @param scanType The type of scan (DOM or SAX).
+   * @return A <code>CleanResults</code> object which contains information about the scan (including
+   *     the results).
+   * @throws ScanException When there is a problem encountered while scanning the HTML.
+   * @throws PolicyException When there is a problem reading the policy file.
+   */
+  public CleanResults scan(String taintedHTML, Policy policy, int scanType)
+      throws ScanException, PolicyException {
+    if (policy == null) {
+      throw new PolicyException("No policy loaded");
+    }
+
+    if (scanType == DOM) {
+      return new AntiSamyDOMScanner(policy).scan(taintedHTML);
+    } else {
+      return new AntiSamySAXScanner(policy).scan(taintedHTML);
+    }
+  }
+
+  /**
+   * Use this method if caller has Streams rather than Strings for I/O Useful for servlets where the
+   * response is very large and we don't validate, simply encode as bytes are consumed from the
+   * stream.
+   *
+   * @param reader Reader that produces the input, possibly a little at a time
+   * @param writer Writer that receives the cleaned output, possibly a little at a time
+   * @param policy Policy that directs the scan
+   * @return CleanResults where the cleanHtml is null. If caller wants the clean HTML, it must
+   *     capture the writer's contents. When using Streams, caller generally doesn't want to create
+   *     a single string containing clean HTML.
+   * @throws ScanException When there is a problem encountered while scanning the HTML.
+   */
+  public CleanResults scan(Reader reader, Writer writer, Policy policy) throws ScanException {
+    return (new AntiSamySAXScanner(policy)).scan(reader, writer);
+  }
+
+  /**
+   * This method wraps <code>scan()</code> using the Policy in the specified file.
+   *
+   * @param taintedHTML Untrusted HTML which may contain malicious code.
+   * @param filename The file name of the custom policy to enforce.
+   * @return A <code>CleanResults</code> object which contains information about the scan (including
+   *     the results).
+   * @throws ScanException When there is a problem encountered while scanning the HTML.
+   * @throws PolicyException When there is a problem reading the policy file.
+   */
+  public CleanResults scan(String taintedHTML, String filename)
+      throws ScanException, PolicyException {
+
+    Policy policy = Policy.getInstance(filename);
+
+    return this.scan(taintedHTML, policy);
+  }
+
+  /**
+   * This method wraps <code>scan()</code> using the policy File object passed in.
+   *
+   * @param taintedHTML Untrusted HTML which may contain malicious code.
+   * @param policyFile The File object of the custom policy to enforce.
+   * @return A <code>CleanResults</code> object which contains information about the scan (including
+   *     the results).
+   * @throws ScanException When there is a problem encountered while scanning the HTML.
+   * @throws PolicyException When there is a problem reading the policy file.
+   */
+  public CleanResults scan(String taintedHTML, File policyFile)
+      throws ScanException, PolicyException {
+
+    Policy policy = Policy.getInstance(policyFile);
+
+    return this.scan(taintedHTML, policy);
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/CleanResults.java b/src/main/java/org/owasp/validator/html/CleanResults.java
index 57498013..0dcb68cd 100644
--- a/src/main/java/org/owasp/validator/html/CleanResults.java
+++ b/src/main/java/org/owasp/validator/html/CleanResults.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -28,136 +28,142 @@
 import java.util.Collections;
 import java.util.List;
 import java.util.concurrent.Callable;
-
 import org.w3c.dom.DocumentFragment;
 
 /**
  * This class contains the results of a scan.
- * 
- * The list of error messages (<code>errorMessages</code>) will let the user
- * know what, if any HTML errors existed, and what, if any, security or
- * validation-related errors existed, and what was done about them.
- * 
+ *
+ * <p>The list of error messages (<code>errorMessages</code>) will let the user know what, if any
+ * HTML errors existed, and what, if any, security or validation-related errors existed, and what
+ * was done about them.
+ *
  * @author Arshan Dabirsiaghi
  */
-
 public class CleanResults {
 
-	private List<String> errorMessages;
-	private Callable<String> cleanHTML;
-	private long startOfScan;
-	private long elapsedScan;
-
-	/*
-	 * A DOM object version of the clean HTML String. May be null even if clean HTML is set.
-	 */
-	private DocumentFragment cleanXMLDocumentFragment;
-
-	/*
-	 * For extension.
-	 */
-	public CleanResults() {
-		this.errorMessages = new ArrayList<String>();
-	}
-
-	/**
-	 * Create a clean set of results.
-	 * @param startOfScan - The time when the scan started.
-	 * @param cleanHTML - The resulting clean HTML produced per the AntiSamy policy.
-	 * @param XMLDocumentFragment - The XML Document fragment version of the clean HTML produced during the sanitzation process.
-	 * @param errorMessages - Messages describing any errors that occurred during sanitization.
-	 */
-	public CleanResults(long startOfScan, final String cleanHTML,
-			DocumentFragment XMLDocumentFragment, List<String> errorMessages) {
-
-		this(startOfScan,
-			new Callable<String>() {
-	            public String call() throws Exception {
-	                return cleanHTML;
-	            }
-	        },
-			XMLDocumentFragment,
-			errorMessages);
-	}
-
-	/**
-	 * Create a clean set of results.
-	 * @param startOfScan - The time when the scan started.
-	 * @param cleanHTML - The resulting clean HTML produced per the AntiSamy policy.
-	 * @param XMLDocumentFragment - The XML Document fragment version of the clean HTML produced during the sanitization process.
-	 * @param errorMessages - Messages describing any errors that occurred during sanitization.
-	 */
-    public CleanResults(long startOfScan, Callable<String> cleanHTML,
-                        DocumentFragment XMLDocumentFragment, List<String> errorMessages) {
-		this.startOfScan = startOfScan;
-        this.elapsedScan = System.currentTimeMillis() - startOfScan;
-        this.cleanXMLDocumentFragment = XMLDocumentFragment;
-        this.cleanHTML = cleanHTML;
-		this.errorMessages = Collections.unmodifiableList(errorMessages);
-    }
-
-	/**
-	 * Return the DOM version of the clean HTML.
-	 * 
-	 * @return The XML Document fragment version of the clean HTML produced during the sanitization process.
-	 *        This may be null, even if the clean HTML String is not null.
-	 */
-	public DocumentFragment getCleanXMLDocumentFragment() {
-		return cleanXMLDocumentFragment;
-	}
-
-	/**
-	 * Return the filtered HTML as a String.
-	 * 
-	 * @return A String object which contains the serialized, safe HTML.
-	 */
-	public String getCleanHTML() {
-        try {
-            return cleanHTML.call();
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
+  private List<String> errorMessages;
+  private Callable<String> cleanHTML;
+  private long startOfScan;
+  private long elapsedScan;
+
+  /*
+   * A DOM object version of the clean HTML String. May be null even if clean HTML is set.
+   */
+  private DocumentFragment cleanXMLDocumentFragment;
+
+  /*
+   * For extension.
+   */
+  public CleanResults() {
+    this.errorMessages = new ArrayList<String>();
+  }
+
+  /**
+   * Create a clean set of results.
+   *
+   * @param startOfScan - The time when the scan started.
+   * @param cleanHTML - The resulting clean HTML produced per the AntiSamy policy.
+   * @param XMLDocumentFragment - The XML Document fragment version of the clean HTML produced
+   *     during the sanitzation process.
+   * @param errorMessages - Messages describing any errors that occurred during sanitization.
+   */
+  public CleanResults(
+      long startOfScan,
+      final String cleanHTML,
+      DocumentFragment XMLDocumentFragment,
+      List<String> errorMessages) {
+
+    this(
+        startOfScan,
+        new Callable<String>() {
+          public String call() throws Exception {
+            return cleanHTML;
+          }
+        },
+        XMLDocumentFragment,
+        errorMessages);
+  }
+
+  /**
+   * Create a clean set of results.
+   *
+   * @param startOfScan - The time when the scan started.
+   * @param cleanHTML - The resulting clean HTML produced per the AntiSamy policy.
+   * @param XMLDocumentFragment - The XML Document fragment version of the clean HTML produced
+   *     during the sanitization process.
+   * @param errorMessages - Messages describing any errors that occurred during sanitization.
+   */
+  public CleanResults(
+      long startOfScan,
+      Callable<String> cleanHTML,
+      DocumentFragment XMLDocumentFragment,
+      List<String> errorMessages) {
+    this.startOfScan = startOfScan;
+    this.elapsedScan = System.currentTimeMillis() - startOfScan;
+    this.cleanXMLDocumentFragment = XMLDocumentFragment;
+    this.cleanHTML = cleanHTML;
+    this.errorMessages = Collections.unmodifiableList(errorMessages);
+  }
+
+  /**
+   * Return the DOM version of the clean HTML.
+   *
+   * @return The XML Document fragment version of the clean HTML produced during the sanitization
+   *     process. This may be null, even if the clean HTML String is not null.
+   */
+  public DocumentFragment getCleanXMLDocumentFragment() {
+    return cleanXMLDocumentFragment;
+  }
+
+  /**
+   * Return the filtered HTML as a String.
+   *
+   * @return A String object which contains the serialized, safe HTML.
+   */
+  public String getCleanHTML() {
+    try {
+      return cleanHTML.call();
+    } catch (Exception e) {
+      throw new RuntimeException(e);
     }
-
-	/**
-	 * Return a list of error messages -- but an empty list returned does not mean there was no attack
-	 * present, due to the serialization and deserialization process automatically cleaning up some
-	 * attacks. See the README for more discussion.
-	 * 
-	 * @return An ArrayList object which contain the error messages after a
-	 *         scan.
-	 */
-	public List<String> getErrorMessages() {
-		return errorMessages;
-	}
-
-    /**
-	 * Return the time elapsed during the scan.
-	 * 
-	 * @return A double primitive indicating the amount of time elapsed between
-	 *         the beginning and end of the scan in seconds.
-	 */
-	public double getScanTime() {
-		return elapsedScan / 1000D;
-	}
-
-	/**
-	 * Return the number of errors encountered during filtering.
-	 * 
-	 * @return The number of errors encountered during filtering.
-	 */
-	public int getNumberOfErrors() {
-		return errorMessages.size();
-	}
-
-	/**
-	 * Get the time the scan started.
-	 * 
-	 * @return time that scan started in milliseconds since epoch.
-	 */
-	public long getStartOfScan()
-	{
-		return startOfScan;
-	}
-
+  }
+
+  /**
+   * Return a list of error messages -- but an empty list returned does not mean there was no attack
+   * present, due to the serialization and deserialization process automatically cleaning up some
+   * attacks. See the README for more discussion.
+   *
+   * @return An ArrayList object which contain the error messages after a scan.
+   */
+  public List<String> getErrorMessages() {
+    return errorMessages;
+  }
+
+  /**
+   * Return the time elapsed during the scan.
+   *
+   * @return A double primitive indicating the amount of time elapsed between the beginning and end
+   *     of the scan in seconds.
+   */
+  public double getScanTime() {
+    return elapsedScan / 1000D;
+  }
+
+  /**
+   * Return the number of errors encountered during filtering.
+   *
+   * @return The number of errors encountered during filtering.
+   */
+  public int getNumberOfErrors() {
+    return errorMessages.size();
+  }
+
+  /**
+   * Get the time the scan started.
+   *
+   * @return time that scan started in milliseconds since epoch.
+   */
+  public long getStartOfScan() {
+    return startOfScan;
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/InternalPolicy.java b/src/main/java/org/owasp/validator/html/InternalPolicy.java
index 96a9efc3..33017f29 100644
--- a/src/main/java/org/owasp/validator/html/InternalPolicy.java
+++ b/src/main/java/org/owasp/validator/html/InternalPolicy.java
@@ -1,168 +1,175 @@
 package org.owasp.validator.html;
 
+import java.util.Map;
 import org.owasp.validator.html.model.Property;
 import org.owasp.validator.html.model.Tag;
 
-import java.util.Map;
-
 /**
  * Contains a bunch of optimized lookups over the regular Policy Class. For internal use only.
  *
- * Not part of any public API and may explode or self-destruct at any given moment, preferably both.
+ * <p>Not part of any public API and may explode or self-destruct at any given moment, preferably
+ * both.
  *
  * @author Kristian Rosenvold
  */
 public class InternalPolicy extends Policy {
-    private final int maxInputSize;
-    private final boolean isNofollowAnchors;
-    private final boolean isNoopenerAndNoreferrerAnchors;
-    private final boolean isValidateParamAsEmbed;
-    private final boolean formatOutput;
-    private final boolean preserveSpace;
-    private final boolean omitXmlDeclaration;
-    private final boolean omitDoctypeDeclaration;
-    private final boolean entityEncodeIntlCharacters;
-    private final Tag embedTag;
-    private final Tag styleTag;
-    private final String onUnknownTag;
-    private final boolean preserveComments;
-    private final boolean embedStyleSheets;
-    private final boolean isEncodeUnknownTag;
-    private final boolean allowDynamicAttributes;
-
-
-    protected InternalPolicy(ParseContext parseContext) {
-        super(parseContext);
-        this.maxInputSize = determineMaxInputSize();
-        this.isNofollowAnchors = isTrue(Policy.ANCHORS_NOFOLLOW);
-        this.isNoopenerAndNoreferrerAnchors = isTrue(Policy.ANCHORS_NOOPENER_NOREFERRER);
-        this.isValidateParamAsEmbed = isTrue(Policy.VALIDATE_PARAM_AS_EMBED);
-        this.formatOutput = isTrue(Policy.FORMAT_OUTPUT);
-        this.preserveSpace = isTrue(Policy.PRESERVE_SPACE);
-        this.omitXmlDeclaration = isTrue(Policy.OMIT_XML_DECLARATION);
-        this.omitDoctypeDeclaration = isTrue(Policy.OMIT_DOCTYPE_DECLARATION);
-        this.entityEncodeIntlCharacters = isTrue(Policy.ENTITY_ENCODE_INTL_CHARS);
-        this.embedTag = getTagByLowercaseName("embed");
-        this.onUnknownTag = getDirective("onUnknownTag");
-        this.isEncodeUnknownTag = "encode".equals(onUnknownTag);
-        this.preserveComments = isTrue(Policy.PRESERVE_COMMENTS);
-        this.styleTag = getTagByLowercaseName("style");
-        this.embedStyleSheets = isTrue(Policy.EMBED_STYLESHEETS);
-        this.allowDynamicAttributes = isTrue(Policy.ALLOW_DYNAMIC_ATTRIBUTES);
-
-        if (!isNoopenerAndNoreferrerAnchors) {
-            logger.warn("The directive \"" + Policy.ANCHORS_NOOPENER_NOREFERRER +
-                    "\" is enabled by default, but disabled in this policy. It is recommended to leave it enabled to prevent reverse tabnabbing attacks.");
-        }
-    }
-
-    protected InternalPolicy(Policy old, Map<String, String> directives, Map<String, Tag> tagRules, Map<String, Property> cssRules) {
-        super(old, directives, tagRules, cssRules);
-        this.maxInputSize = determineMaxInputSize();
-        this.isNofollowAnchors = isTrue(Policy.ANCHORS_NOFOLLOW);
-        this.isNoopenerAndNoreferrerAnchors = isTrue(Policy.ANCHORS_NOOPENER_NOREFERRER);
-        this.isValidateParamAsEmbed = isTrue(Policy.VALIDATE_PARAM_AS_EMBED);
-        this.formatOutput = isTrue(Policy.FORMAT_OUTPUT);
-        this.preserveSpace = isTrue(Policy.PRESERVE_SPACE);
-        this.omitXmlDeclaration = isTrue(Policy.OMIT_XML_DECLARATION);
-        this.omitDoctypeDeclaration = isTrue(Policy.OMIT_DOCTYPE_DECLARATION);
-        this.entityEncodeIntlCharacters = isTrue(Policy.ENTITY_ENCODE_INTL_CHARS);
-        this.embedTag = getTagByLowercaseName("embed");
-        this.onUnknownTag = getDirective("onUnknownTag");
-        this.isEncodeUnknownTag = "encode".equals(onUnknownTag);
-        this.preserveComments = isTrue(Policy.PRESERVE_COMMENTS);
-        this.styleTag = getTagByLowercaseName("style");
-        this.embedStyleSheets = isTrue(Policy.EMBED_STYLESHEETS);
-        this.allowDynamicAttributes = isTrue(Policy.ALLOW_DYNAMIC_ATTRIBUTES);
-
-        if (!isNoopenerAndNoreferrerAnchors) {
-            logger.warn("The directive \"" + Policy.ANCHORS_NOOPENER_NOREFERRER +
-                    "\" is enabled by default, but disabled in this policy. It is recommended to leave it enabled to prevent reverse tabnabbing attacks.");
-        }
-    }
-
-    public Tag getEmbedTag() {
-        return embedTag;
-    }
-
-    public Tag getStyleTag() {
-        return styleTag;
-    }
-
-    public boolean isEmbedStyleSheets() {
-        return embedStyleSheets;
-    }
-
-    public boolean isPreserveComments() {
-        return preserveComments;
-    }
-
-    public int getMaxInputSize() {
-        return maxInputSize;
-    }
-
-    public boolean isEntityEncodeIntlCharacters() {
-        return entityEncodeIntlCharacters;
-    }
-
-    public boolean isNofollowAnchors() {
-        return isNofollowAnchors;
-    }
-
-    public boolean isNoopenerAndNoreferrerAnchors() {
-        return isNoopenerAndNoreferrerAnchors;
-    }
-
-    public boolean isValidateParamAsEmbed() {
-        return isValidateParamAsEmbed;
-    }
-
-    public boolean isFormatOutput() {
-        return formatOutput;
-    }
-
-    public boolean isPreserveSpace() {
-        return preserveSpace;
-    }
-
-    public boolean isOmitXmlDeclaration() {
-        return omitXmlDeclaration;
-    }
-
-    public boolean isOmitDoctypeDeclaration() {
-        return omitDoctypeDeclaration;
-    }
-
-    private boolean isTrue(String anchorsNofollow) {
-        return "true".equals(getDirective(anchorsNofollow));
-    }
-
-    public String getOnUnknownTag() {
-        return onUnknownTag;
-    }
-
-    public boolean isEncodeUnknownTag() {
-        return isEncodeUnknownTag;
-    }
-
-    public boolean isAllowDynamicAttributes() {
-        return allowDynamicAttributes;
-    }
-
-    /**
-     * Returns the maximum input size. If this value is not specified by
-     * the policy, the <code>DEFAULT_MAX_INPUT_SIZE</code> is used.
-     *
-     * @return the maximum input size.
-     */
-    public int determineMaxInputSize() {
-        int maxInputSize = Policy.DEFAULT_MAX_INPUT_SIZE;
-
-        try {
-            maxInputSize = Integer.parseInt(getDirective("maxInputSize"));
-        } catch (NumberFormatException ignore) {
-        }
-
-        return maxInputSize;
-    }
+  private final int maxInputSize;
+  private final boolean isNofollowAnchors;
+  private final boolean isNoopenerAndNoreferrerAnchors;
+  private final boolean isValidateParamAsEmbed;
+  private final boolean formatOutput;
+  private final boolean preserveSpace;
+  private final boolean omitXmlDeclaration;
+  private final boolean omitDoctypeDeclaration;
+  private final boolean entityEncodeIntlCharacters;
+  private final Tag embedTag;
+  private final Tag styleTag;
+  private final String onUnknownTag;
+  private final boolean preserveComments;
+  private final boolean embedStyleSheets;
+  private final boolean isEncodeUnknownTag;
+  private final boolean allowDynamicAttributes;
+
+  protected InternalPolicy(ParseContext parseContext) {
+    super(parseContext);
+    this.maxInputSize = determineMaxInputSize();
+    this.isNofollowAnchors = isTrue(Policy.ANCHORS_NOFOLLOW);
+    this.isNoopenerAndNoreferrerAnchors = isTrue(Policy.ANCHORS_NOOPENER_NOREFERRER);
+    this.isValidateParamAsEmbed = isTrue(Policy.VALIDATE_PARAM_AS_EMBED);
+    this.formatOutput = isTrue(Policy.FORMAT_OUTPUT);
+    this.preserveSpace = isTrue(Policy.PRESERVE_SPACE);
+    this.omitXmlDeclaration = isTrue(Policy.OMIT_XML_DECLARATION);
+    this.omitDoctypeDeclaration = isTrue(Policy.OMIT_DOCTYPE_DECLARATION);
+    this.entityEncodeIntlCharacters = isTrue(Policy.ENTITY_ENCODE_INTL_CHARS);
+    this.embedTag = getTagByLowercaseName("embed");
+    this.onUnknownTag = getDirective("onUnknownTag");
+    this.isEncodeUnknownTag = "encode".equals(onUnknownTag);
+    this.preserveComments = isTrue(Policy.PRESERVE_COMMENTS);
+    this.styleTag = getTagByLowercaseName("style");
+    this.embedStyleSheets = isTrue(Policy.EMBED_STYLESHEETS);
+    this.allowDynamicAttributes = isTrue(Policy.ALLOW_DYNAMIC_ATTRIBUTES);
+
+    if (!isNoopenerAndNoreferrerAnchors) {
+      logger.warn(
+          "The directive \""
+              + Policy.ANCHORS_NOOPENER_NOREFERRER
+              + "\" is enabled by default, but disabled in this policy. It is recommended to leave it enabled to prevent reverse tabnabbing attacks.");
+    }
+  }
+
+  protected InternalPolicy(
+      Policy old,
+      Map<String, String> directives,
+      Map<String, Tag> tagRules,
+      Map<String, Property> cssRules) {
+    super(old, directives, tagRules, cssRules);
+    this.maxInputSize = determineMaxInputSize();
+    this.isNofollowAnchors = isTrue(Policy.ANCHORS_NOFOLLOW);
+    this.isNoopenerAndNoreferrerAnchors = isTrue(Policy.ANCHORS_NOOPENER_NOREFERRER);
+    this.isValidateParamAsEmbed = isTrue(Policy.VALIDATE_PARAM_AS_EMBED);
+    this.formatOutput = isTrue(Policy.FORMAT_OUTPUT);
+    this.preserveSpace = isTrue(Policy.PRESERVE_SPACE);
+    this.omitXmlDeclaration = isTrue(Policy.OMIT_XML_DECLARATION);
+    this.omitDoctypeDeclaration = isTrue(Policy.OMIT_DOCTYPE_DECLARATION);
+    this.entityEncodeIntlCharacters = isTrue(Policy.ENTITY_ENCODE_INTL_CHARS);
+    this.embedTag = getTagByLowercaseName("embed");
+    this.onUnknownTag = getDirective("onUnknownTag");
+    this.isEncodeUnknownTag = "encode".equals(onUnknownTag);
+    this.preserveComments = isTrue(Policy.PRESERVE_COMMENTS);
+    this.styleTag = getTagByLowercaseName("style");
+    this.embedStyleSheets = isTrue(Policy.EMBED_STYLESHEETS);
+    this.allowDynamicAttributes = isTrue(Policy.ALLOW_DYNAMIC_ATTRIBUTES);
+
+    if (!isNoopenerAndNoreferrerAnchors) {
+      logger.warn(
+          "The directive \""
+              + Policy.ANCHORS_NOOPENER_NOREFERRER
+              + "\" is enabled by default, but disabled in this policy. It is recommended to leave it enabled to prevent reverse tabnabbing attacks.");
+    }
+  }
+
+  public Tag getEmbedTag() {
+    return embedTag;
+  }
+
+  public Tag getStyleTag() {
+    return styleTag;
+  }
+
+  public boolean isEmbedStyleSheets() {
+    return embedStyleSheets;
+  }
+
+  public boolean isPreserveComments() {
+    return preserveComments;
+  }
+
+  public int getMaxInputSize() {
+    return maxInputSize;
+  }
+
+  public boolean isEntityEncodeIntlCharacters() {
+    return entityEncodeIntlCharacters;
+  }
+
+  public boolean isNofollowAnchors() {
+    return isNofollowAnchors;
+  }
+
+  public boolean isNoopenerAndNoreferrerAnchors() {
+    return isNoopenerAndNoreferrerAnchors;
+  }
+
+  public boolean isValidateParamAsEmbed() {
+    return isValidateParamAsEmbed;
+  }
+
+  public boolean isFormatOutput() {
+    return formatOutput;
+  }
+
+  public boolean isPreserveSpace() {
+    return preserveSpace;
+  }
+
+  public boolean isOmitXmlDeclaration() {
+    return omitXmlDeclaration;
+  }
+
+  public boolean isOmitDoctypeDeclaration() {
+    return omitDoctypeDeclaration;
+  }
+
+  private boolean isTrue(String anchorsNofollow) {
+    return "true".equals(getDirective(anchorsNofollow));
+  }
+
+  public String getOnUnknownTag() {
+    return onUnknownTag;
+  }
+
+  public boolean isEncodeUnknownTag() {
+    return isEncodeUnknownTag;
+  }
+
+  public boolean isAllowDynamicAttributes() {
+    return allowDynamicAttributes;
+  }
+
+  /**
+   * Returns the maximum input size. If this value is not specified by the policy, the <code>
+   * DEFAULT_MAX_INPUT_SIZE</code> is used.
+   *
+   * @return the maximum input size.
+   */
+  public int determineMaxInputSize() {
+    int maxInputSize = Policy.DEFAULT_MAX_INPUT_SIZE;
+
+    try {
+      maxInputSize = Integer.parseInt(getDirective("maxInputSize"));
+    } catch (NumberFormatException ignore) {
+    }
+
+    return maxInputSize;
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/Policy.java b/src/main/java/org/owasp/validator/html/Policy.java
index 7a373bcd..2a9c2916 100644
--- a/src/main/java/org/owasp/validator/html/Policy.java
+++ b/src/main/java/org/owasp/validator/html/Policy.java
@@ -24,12 +24,13 @@
 
 package org.owasp.validator.html;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import static org.owasp.validator.html.util.XMLUtil.getAttributeValue;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.io.ByteArrayInputStream;
 import java.io.File;
-import java.io.IOException;
 import java.io.FileNotFoundException;
+import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.Reader;
@@ -46,7 +47,6 @@
 import java.util.Set;
 import java.util.concurrent.Callable;
 import java.util.regex.Pattern;
-
 import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
@@ -55,14 +55,12 @@
 import javax.xml.transform.stream.StreamSource;
 import javax.xml.validation.Schema;
 import javax.xml.validation.SchemaFactory;
-
 import org.owasp.validator.html.model.AntiSamyPattern;
 import org.owasp.validator.html.model.Attribute;
 import org.owasp.validator.html.model.Property;
 import org.owasp.validator.html.model.Tag;
 import org.owasp.validator.html.scan.Constants;
 import org.owasp.validator.html.util.URIUtils;
-
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.w3c.dom.Document;
@@ -73,944 +71,1051 @@
 import org.xml.sax.SAXException;
 import org.xml.sax.SAXParseException;
 
-import static org.owasp.validator.html.util.XMLUtil.getAttributeValue;
-
 /**
- * <p>Policy.java - This file holds the model for our policy engine.</p>
- * 
- * <p>## Schema validation behavior change starting with AntiSamy 1.6.0 ##</p>
- * 
- * <p>Prior to v1.6.0 AntiSamy was not actually enforcing it's defined XSD. For all of v1.6.x, by default AntiSamy
- * enforced the schema, and wouldn't continue if the AntiSamy policy was invalid. However, we recognized that it might
- * not be possible for developers to fix their AntiSamy policies right away so we provided two
- * ways to (temporarily!) disable schema validation. Via a direct method call and via a System property.</p>
- * 
- * <p>## Starting with AntiSamy 1.7.0, schema validation is Mandatory.</p>
- * 
- * <p>Logging: The logging introduced in 1.6+ uses slf4j. But AntiSamy doesn't actually include an slf4j implementation
- * library. AntiSamy users must import and properly configure an slf4j logging library if they want to see the very
- * few log messages generated by AntiSamy.</p>
- * 
+ * Policy.java - This file holds the model for our policy engine.
+ *
+ * <p>## Schema validation behavior change starting with AntiSamy 1.6.0 ##
+ *
+ * <p>Prior to v1.6.0 AntiSamy was not actually enforcing it's defined XSD. For all of v1.6.x, by
+ * default AntiSamy enforced the schema, and wouldn't continue if the AntiSamy policy was invalid.
+ * However, we recognized that it might not be possible for developers to fix their AntiSamy
+ * policies right away so we provided two ways to (temporarily!) disable schema validation. Via a
+ * direct method call and via a System property.
+ *
+ * <p>## Starting with AntiSamy 1.7.0, schema validation is Mandatory.
+ *
+ * <p>Logging: The logging introduced in 1.6+ uses slf4j. But AntiSamy doesn't actually include an
+ * slf4j implementation library. AntiSamy users must import and properly configure an slf4j logging
+ * library if they want to see the very few log messages generated by AntiSamy.
+ *
  * @author Arshan Dabirsiaghi
  */
-
 public class Policy {
 
-    protected static final Logger logger = LoggerFactory.getLogger(Policy.class);
-
-    public static final Pattern ANYTHING_REGEXP = Pattern.compile(".*", Pattern.DOTALL);
-
-    private static final String POLICY_SCHEMA_URI = "antisamy.xsd";
-    protected static final String DEFAULT_POLICY_URI = "antisamy.xml";
-    private static final String DEFAULT_ONINVALID = "removeAttribute";
-
-    public static final int DEFAULT_MAX_INPUT_SIZE = 100000;
-    public static final int DEFAULT_MAX_STYLESHEET_IMPORTS = 1;
-
-    public static final String OMIT_XML_DECLARATION = "omitXmlDeclaration";
-    public static final String OMIT_DOCTYPE_DECLARATION = "omitDoctypeDeclaration";
-    public static final String FORMAT_OUTPUT = "formatOutput";
-    public static final String EMBED_STYLESHEETS = "embedStyleSheets";
-    public static final String CONNECTION_TIMEOUT = "connectionTimeout";
-    public static final String ANCHORS_NOFOLLOW = "nofollowAnchors";
-    public static final String ANCHORS_NOOPENER_NOREFERRER = "noopenerAndNoreferrerAnchors";
-    public static final String VALIDATE_PARAM_AS_EMBED = "validateParamAsEmbed";
-    public static final String PRESERVE_SPACE = "preserveSpace";
-    public static final String PRESERVE_COMMENTS = "preserveComments";
-    public static final String ENTITY_ENCODE_INTL_CHARS = "entityEncodeIntlChars";
-    public static final String ALLOW_DYNAMIC_ATTRIBUTES = "allowDynamicAttributes";
-    public static final String MAX_INPUT_SIZE = "maxInputSize";
-    public static final String MAX_STYLESHEET_IMPORTS = "maxStyleSheetImports";
-
-    public static final String EXTERNAL_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities";
-    public static final String EXTERNAL_PARAM_ENTITIES = "http://xml.org/sax/features/external-parameter-entities";
-    public static final String DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";
-    public static final String LOAD_EXTERNAL_DTD = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
-
-    public static final String ACTION_VALIDATE = "validate";
-    public static final String ACTION_FILTER = "filter";
-    public static final String ACTION_TRUNCATE = "truncate";
-
-    private final Map<String, AntiSamyPattern> commonRegularExpressions;
-    protected final Map<String, Tag> tagRules;
-    protected final Map<String, Property> cssRules;
-    protected final Map<String, String> directives;
-    private final Map<String, Attribute> globalAttributes;
-    private final Map<String, Attribute> dynamicAttributes;
-
-    private final TagMatcher allowedEmptyTagsMatcher;
-    private final TagMatcher requiresClosingTagsMatcher;
-
-    /**
-     * XML Schema for policy validation
-     */
-    private static volatile Schema schema = null;
-
-    /**
-     * Get the Tag specified by the provided tag name.
-     *
-     * @param tagName
-     *            The name of the Tag to return.
-     * @return The requested Tag, or null if it doesn't exist.
-     */
-    public Tag getTagByLowercaseName(String tagName) {
-        return tagRules.get(tagName);
-    }
-
-    protected static class ParseContext {
-        Map<String, AntiSamyPattern> commonRegularExpressions = new HashMap<String, AntiSamyPattern>();
-        Map<String, Attribute> commonAttributes = new HashMap<String, Attribute>();
-        Map<String, Tag> tagRules = new HashMap<String, Tag>();
-        Map<String, Property> cssRules = new HashMap<String, Property>();
-        Map<String, String> directives = new HashMap<String, String>();
-        Map<String, Attribute> globalAttributes = new HashMap<String, Attribute>();
-        Map<String, Attribute> dynamicAttributes = new HashMap<String, Attribute>();
-
-        List<String> allowedEmptyTags = new ArrayList<String>();
-        List<String> requireClosingTags = new ArrayList<String>();
-
-        public void resetParamsWhereLastConfigWins() {
-            allowedEmptyTags.clear();
-            requireClosingTags.clear();
-        }
-    }
-
-    /**
-     * Retrieves a CSS Property from the Policy.
-     *
-     * @param propertyName The name of the CSS Property to look up.
-     * @return The CSS Property associated with the name specified, or null if none is found.
-     */
-    public Property getPropertyByName(String propertyName) {
-        return cssRules.get(propertyName.toLowerCase());
+  protected static final Logger logger = LoggerFactory.getLogger(Policy.class);
+
+  public static final Pattern ANYTHING_REGEXP = Pattern.compile(".*", Pattern.DOTALL);
+
+  private static final String POLICY_SCHEMA_URI = "antisamy.xsd";
+  protected static final String DEFAULT_POLICY_URI = "antisamy.xml";
+  private static final String DEFAULT_ONINVALID = "removeAttribute";
+
+  public static final int DEFAULT_MAX_INPUT_SIZE = 100000;
+  public static final int DEFAULT_MAX_STYLESHEET_IMPORTS = 1;
+
+  public static final String OMIT_XML_DECLARATION = "omitXmlDeclaration";
+  public static final String OMIT_DOCTYPE_DECLARATION = "omitDoctypeDeclaration";
+  public static final String FORMAT_OUTPUT = "formatOutput";
+  public static final String EMBED_STYLESHEETS = "embedStyleSheets";
+  public static final String CONNECTION_TIMEOUT = "connectionTimeout";
+  public static final String ANCHORS_NOFOLLOW = "nofollowAnchors";
+  public static final String ANCHORS_NOOPENER_NOREFERRER = "noopenerAndNoreferrerAnchors";
+  public static final String VALIDATE_PARAM_AS_EMBED = "validateParamAsEmbed";
+  public static final String PRESERVE_SPACE = "preserveSpace";
+  public static final String PRESERVE_COMMENTS = "preserveComments";
+  public static final String ENTITY_ENCODE_INTL_CHARS = "entityEncodeIntlChars";
+  public static final String ALLOW_DYNAMIC_ATTRIBUTES = "allowDynamicAttributes";
+  public static final String MAX_INPUT_SIZE = "maxInputSize";
+  public static final String MAX_STYLESHEET_IMPORTS = "maxStyleSheetImports";
+
+  public static final String EXTERNAL_GENERAL_ENTITIES =
+      "http://xml.org/sax/features/external-general-entities";
+  public static final String EXTERNAL_PARAM_ENTITIES =
+      "http://xml.org/sax/features/external-parameter-entities";
+  public static final String DISALLOW_DOCTYPE_DECL =
+      "http://apache.org/xml/features/disallow-doctype-decl";
+  public static final String LOAD_EXTERNAL_DTD =
+      "http://apache.org/xml/features/nonvalidating/load-external-dtd";
+
+  public static final String ACTION_VALIDATE = "validate";
+  public static final String ACTION_FILTER = "filter";
+  public static final String ACTION_TRUNCATE = "truncate";
+
+  private final Map<String, AntiSamyPattern> commonRegularExpressions;
+  protected final Map<String, Tag> tagRules;
+  protected final Map<String, Property> cssRules;
+  protected final Map<String, String> directives;
+  private final Map<String, Attribute> globalAttributes;
+  private final Map<String, Attribute> dynamicAttributes;
+
+  private final TagMatcher allowedEmptyTagsMatcher;
+  private final TagMatcher requiresClosingTagsMatcher;
+
+  /** XML Schema for policy validation */
+  private static volatile Schema schema = null;
+
+  /**
+   * Get the Tag specified by the provided tag name.
+   *
+   * @param tagName The name of the Tag to return.
+   * @return The requested Tag, or null if it doesn't exist.
+   */
+  public Tag getTagByLowercaseName(String tagName) {
+    return tagRules.get(tagName);
+  }
+
+  protected static class ParseContext {
+    Map<String, AntiSamyPattern> commonRegularExpressions = new HashMap<String, AntiSamyPattern>();
+    Map<String, Attribute> commonAttributes = new HashMap<String, Attribute>();
+    Map<String, Tag> tagRules = new HashMap<String, Tag>();
+    Map<String, Property> cssRules = new HashMap<String, Property>();
+    Map<String, String> directives = new HashMap<String, String>();
+    Map<String, Attribute> globalAttributes = new HashMap<String, Attribute>();
+    Map<String, Attribute> dynamicAttributes = new HashMap<String, Attribute>();
+
+    List<String> allowedEmptyTags = new ArrayList<String>();
+    List<String> requireClosingTags = new ArrayList<String>();
+
+    public void resetParamsWhereLastConfigWins() {
+      allowedEmptyTags.clear();
+      requireClosingTags.clear();
     }
-
-    /**
-     * Construct a Policy using the default policy file location ("antisamy.xml").
-     *
-     * @return A populated Policy object based on the XML policy file located in the default location.
-     * @throws PolicyException If the file is not found or there is a problem parsing the file.
-     */
-    public static Policy getInstance() throws PolicyException {
-        return getInstance(Policy.class.getClassLoader().getResource(DEFAULT_POLICY_URI));
-    }
-
-    /**
-     * Construct a Policy based on the file whose name is passed in.
-     *
-     * @param filename The path to the XML policy file.
-     * @return A populated Policy object based on the XML policy file located in the location passed in.
-     * @throws PolicyException If the file is not found or there is a problem parsing the file.
-     */
-    public static Policy getInstance(String filename) throws PolicyException {
-        File file = new File(filename);
-        return getInstance(file);
+  }
+
+  /**
+   * Retrieves a CSS Property from the Policy.
+   *
+   * @param propertyName The name of the CSS Property to look up.
+   * @return The CSS Property associated with the name specified, or null if none is found.
+   */
+  public Property getPropertyByName(String propertyName) {
+    return cssRules.get(propertyName.toLowerCase());
+  }
+
+  /**
+   * Construct a Policy using the default policy file location ("antisamy.xml").
+   *
+   * @return A populated Policy object based on the XML policy file located in the default location.
+   * @throws PolicyException If the file is not found or there is a problem parsing the file.
+   */
+  public static Policy getInstance() throws PolicyException {
+    return getInstance(Policy.class.getClassLoader().getResource(DEFAULT_POLICY_URI));
+  }
+
+  /**
+   * Construct a Policy based on the file whose name is passed in.
+   *
+   * @param filename The path to the XML policy file.
+   * @return A populated Policy object based on the XML policy file located in the location passed
+   *     in.
+   * @throws PolicyException If the file is not found or there is a problem parsing the file.
+   */
+  public static Policy getInstance(String filename) throws PolicyException {
+    File file = new File(filename);
+    return getInstance(file);
+  }
+
+  /**
+   * Construct a Policy from the InputStream object passed in.
+   *
+   * @param inputStream An InputStream which contains the XML policy information.
+   * @return A populated Policy object based on the XML policy file pointed to by the inputStream
+   *     parameter.
+   * @throws PolicyException If there is a problem parsing the input stream.
+   */
+  public static Policy getInstance(InputStream inputStream) throws PolicyException {
+    logger.info("Attempting to load AntiSamy policy from an input stream.");
+    return new InternalPolicy(getSimpleParseContext(getTopLevelElement(inputStream)));
+  }
+
+  /**
+   * Construct a Policy from the File object passed in.
+   *
+   * @param file A File object which contains the XML policy information.
+   * @return A populated Policy object based on the XML policy file pointed to by the File
+   *     parameter.
+   * @throws PolicyException If the file is not found or there is a problem parsing the file.
+   */
+  public static Policy getInstance(File file) throws PolicyException {
+    try {
+      URI uri = file.toURI();
+      return getInstance(uri.toURL());
+    } catch (IOException e) {
+      throw new PolicyException(e);
     }
-
-    /**
-     * Construct a Policy from the InputStream object passed in.
-     *
-     * @param inputStream An InputStream which contains the XML policy information.
-     * @return A populated Policy object based on the XML policy file pointed to by the inputStream parameter.
-     * @throws PolicyException If there is a problem parsing the input stream.
-     */
-    public static Policy getInstance(InputStream inputStream) throws PolicyException {
-        logger.info("Attempting to load AntiSamy policy from an input stream.");
-        return new InternalPolicy(getSimpleParseContext(getTopLevelElement(inputStream)));
+  }
+
+  /**
+   * Construct a Policy from the target of the URL passed in. <br>
+   * <br>
+   * NOTE: This is the only factory method that will work with &lt;include&gt; tags in AntiSamy
+   * policy files. <br>
+   * <br>
+   * For security reasons, the provided URL must point to a local file. Currently only 'file:' and
+   * 'jar:' URL prefixes are allowed. If you want to use a different URL format, and are confident
+   * that the URL points to a safe source, you can open the target of the URL with URL.openStream(),
+   * and use the getInstance(InputStream) constructor instead. For example, Spring has classpath:
+   * and Wildfly/Jboss supports vfs: for accessing local files. Just be aware that this alternate
+   * constructor doesn't support the use of &lt;include&gt; tags, per the NOTE above.
+   *
+   * @param url A URL object which contains the XML policy information.
+   * @return A populated Policy object based on the XML policy file pointed to by the File
+   *     parameter.
+   * @throws PolicyException If the file is not found or there is a problem parsing the file.
+   */
+  public static Policy getInstance(URL url) throws PolicyException {
+    logger.info("Attempting to load AntiSamy policy from URL: " + url.toString());
+    return new InternalPolicy(getParseContext(getTopLevelElement(url), url));
+  }
+
+  protected Policy(ParseContext parseContext) {
+    this.allowedEmptyTagsMatcher = new TagMatcher(parseContext.allowedEmptyTags);
+    this.requiresClosingTagsMatcher = new TagMatcher(parseContext.requireClosingTags);
+    this.commonRegularExpressions =
+        Collections.unmodifiableMap(parseContext.commonRegularExpressions);
+    this.tagRules = Collections.unmodifiableMap(parseContext.tagRules);
+    this.cssRules = Collections.unmodifiableMap(parseContext.cssRules);
+    this.directives = Collections.unmodifiableMap(parseContext.directives);
+    this.globalAttributes = Collections.unmodifiableMap(parseContext.globalAttributes);
+    this.dynamicAttributes = Collections.unmodifiableMap(parseContext.dynamicAttributes);
+  }
+
+  protected Policy(
+      Policy old,
+      Map<String, String> directives,
+      Map<String, Tag> tagRules,
+      Map<String, Property> cssRules) {
+    this.allowedEmptyTagsMatcher = old.allowedEmptyTagsMatcher;
+    this.requiresClosingTagsMatcher = old.requiresClosingTagsMatcher;
+    this.commonRegularExpressions = old.commonRegularExpressions;
+    this.tagRules = tagRules;
+    this.cssRules = cssRules;
+    this.directives = directives;
+    this.globalAttributes = old.globalAttributes;
+    this.dynamicAttributes = old.dynamicAttributes;
+  }
+
+  protected static ParseContext getSimpleParseContext(Element topLevelElement)
+      throws PolicyException {
+    ParseContext parseContext = new ParseContext();
+    if (getByTagName(topLevelElement, "include").iterator().hasNext()) {
+      throw new IllegalArgumentException(
+          "A policy file loaded with an InputStream cannot contain include references");
     }
+    parsePolicy(topLevelElement, parseContext);
+    return parseContext;
+  }
 
-    /**
-     * Construct a Policy from the File object passed in.
-     *
-     * @param file A File object which contains the XML policy information.
-     * @return A populated Policy object based on the XML policy file pointed to by the File parameter.
-     * @throws PolicyException If the file is not found or there is a problem parsing the file.
-     */
-    public static Policy getInstance(File file) throws PolicyException {
-        try {
-            URI uri = file.toURI();
-            return getInstance(uri.toURL());
-        } catch (IOException e) {
-            throw new PolicyException(e);
-        }
-    }
+  protected static ParseContext getParseContext(Element topLevelElement, URL baseUrl)
+      throws PolicyException {
+    ParseContext parseContext = new ParseContext();
 
     /**
-     * Construct a Policy from the target of the URL passed in.
-     * <br><br>
-     * NOTE: This is the only factory method that will work with &lt;include&gt; tags
-     * in AntiSamy policy files.
-     * <br><br>
-     * For security reasons, the provided URL must point to a local file. Currently only 'file:' and 'jar:'
-     * URL prefixes are allowed. If you want to use a different URL format, and are confident that the URL
-     * points to a safe source, you can open the target of the URL with URL.openStream(), and use the
-     * getInstance(InputStream) constructor instead. For example, Spring has classpath: and Wildfly/Jboss
-     * supports vfs: for accessing local files. Just be aware that this alternate constructor doesn't support
-     * the use of &lt;include&gt; tags, per the NOTE above.
+     * Are there any included policies? These are parsed here first so that rules in _this_ policy
+     * file will override included rules.
      *
-     * @param url A URL object which contains the XML policy information.
-     * @return A populated Policy object based on the XML policy file pointed to by the File parameter.
-     * @throws PolicyException If the file is not found or there is a problem parsing the file.
+     * <p>NOTE that by this being here we only support one level of includes. To support recursion,
+     * move this into the parsePolicy method.
      */
-    public static Policy getInstance(URL url) throws PolicyException {
-        logger.info("Attempting to load AntiSamy policy from URL: " + url.toString());
-        return new InternalPolicy(getParseContext(getTopLevelElement(url), url));
-    }
+    for (Element include : getByTagName(topLevelElement, "include")) {
+      String href = getAttributeValue(include, "href");
 
-    protected Policy(ParseContext parseContext) {
-        this.allowedEmptyTagsMatcher = new TagMatcher(parseContext.allowedEmptyTags);
-        this.requiresClosingTagsMatcher = new TagMatcher(parseContext.requireClosingTags);
-        this.commonRegularExpressions = Collections.unmodifiableMap(parseContext.commonRegularExpressions);
-        this.tagRules = Collections.unmodifiableMap(parseContext.tagRules);
-        this.cssRules = Collections.unmodifiableMap(parseContext.cssRules);
-        this.directives = Collections.unmodifiableMap(parseContext.directives);
-        this.globalAttributes = Collections.unmodifiableMap(parseContext.globalAttributes);
-        this.dynamicAttributes = Collections.unmodifiableMap(parseContext.dynamicAttributes);
+      Element includedPolicy = getPolicy(href, baseUrl);
+      parsePolicy(includedPolicy, parseContext);
     }
 
-    protected Policy(Policy old, Map<String, String> directives, Map<String, Tag> tagRules, Map<String, Property> cssRules) {
-        this.allowedEmptyTagsMatcher = old.allowedEmptyTagsMatcher;
-        this.requiresClosingTagsMatcher = old.requiresClosingTagsMatcher;
-        this.commonRegularExpressions = old.commonRegularExpressions;
-        this.tagRules = tagRules;
-        this.cssRules = cssRules;
-        this.directives = directives;
-        this.globalAttributes = old.globalAttributes;
-        this.dynamicAttributes = old.dynamicAttributes;
-    }
-
-    protected static ParseContext getSimpleParseContext(Element topLevelElement) throws PolicyException {
-        ParseContext parseContext = new ParseContext();
-        if (getByTagName(topLevelElement, "include").iterator().hasNext()) {
-            throw new IllegalArgumentException(
-                    "A policy file loaded with an InputStream cannot contain include references");
-        }
-        parsePolicy(topLevelElement, parseContext);
-        return parseContext;
-    }
-
-    protected static ParseContext getParseContext(Element topLevelElement, URL baseUrl) throws PolicyException {
-        ParseContext parseContext = new ParseContext();
-
-        /**
-         * Are there any included policies? These are parsed here first so that
-         * rules in _this_ policy file will override included rules.
-         *
-         * NOTE that by this being here we only support one level of includes.
-         * To support recursion, move this into the parsePolicy method.
-         */
-        for (Element include : getByTagName(topLevelElement, "include")) {
-            String href = getAttributeValue(include, "href");
-
-            Element includedPolicy = getPolicy(href, baseUrl);
-            parsePolicy(includedPolicy, parseContext);
-        }
-
-        parsePolicy(topLevelElement, parseContext);
-        return parseContext;
-    }
-
-    protected static Element getTopLevelElement(final URL baseUrl) throws PolicyException {
-        final InputSource source = getSourceFromUrl(baseUrl);
-        return getTopLevelElement(source, new Callable<InputSource>() {
-            @Override
-            public InputSource call() throws PolicyException {
-                return getSourceFromUrl(baseUrl);
-            }
+    parsePolicy(topLevelElement, parseContext);
+    return parseContext;
+  }
+
+  protected static Element getTopLevelElement(final URL baseUrl) throws PolicyException {
+    final InputSource source = getSourceFromUrl(baseUrl);
+    return getTopLevelElement(
+        source,
+        new Callable<InputSource>() {
+          @Override
+          public InputSource call() throws PolicyException {
+            return getSourceFromUrl(baseUrl);
+          }
         });
+  }
+
+  @SuppressFBWarnings(
+      value = "SECURITY",
+      justification =
+          "Opening a stream to the provided URL is not "
+              + "a vulnerability because it points to a local JAR file.")
+  protected static InputSource getSourceFromUrl(URL baseUrl) throws PolicyException {
+    try {
+      InputSource source = resolveEntity(baseUrl.toExternalForm(), baseUrl);
+      if (source == null) {
+        source = new InputSource(baseUrl.toExternalForm());
+        source.setByteStream(baseUrl.openStream());
+      } else {
+        source.setSystemId(baseUrl.toExternalForm());
+      }
+
+      return source;
+    } catch (SAXException | IOException e) {
+      // SAXException can't actually happen. See JavaDoc for resolveEntity(String, URL)
+      throw new PolicyException(e);
     }
+  }
 
-    @SuppressFBWarnings(value = "SECURITY", justification="Opening a stream to the provided URL is not "
-            + "a vulnerability because it points to a local JAR file.")
-    protected static InputSource getSourceFromUrl(URL baseUrl) throws PolicyException {
-        try {
-            InputSource source = resolveEntity(baseUrl.toExternalForm(), baseUrl);
-            if (source == null) {
-                source = new InputSource(baseUrl.toExternalForm());
-                source.setByteStream(baseUrl.openStream());
-            } else {
-                source.setSystemId(baseUrl.toExternalForm());
-            }
+  private static Element getTopLevelElement(InputStream is) throws PolicyException {
+    final InputSource source = new InputSource(toByteArrayStream(is));
 
+    return getTopLevelElement(
+        source,
+        new Callable<InputSource>() {
+          @Override
+          public InputSource call() throws IOException {
+            source.getByteStream().reset();
             return source;
-        } catch (SAXException | IOException e) {
-            // SAXException can't actually happen. See JavaDoc for resolveEntity(String, URL)
-            throw new PolicyException(e);
-        }
-    }
-
-    private static Element getTopLevelElement(InputStream is) throws PolicyException {
-        final InputSource source = new InputSource(toByteArrayStream(is));
-
-        return getTopLevelElement(source, new Callable<InputSource>() {
-            @Override
-            public InputSource call() throws IOException {
-                source.getByteStream().reset();
-                return source;
-            }
+          }
         });
+  }
+
+  protected static Element getTopLevelElement(
+      InputSource source, Callable<InputSource> getResetSource) throws PolicyException {
+    // Track whether an exception was ever thrown while processing policy file
+    try {
+      return getDocumentElementFromSource(source);
+    } catch (SAXException | ParserConfigurationException | IOException e) {
+      throw new PolicyException(e);
     }
-
-    protected static Element getTopLevelElement(InputSource source, Callable<InputSource> getResetSource) throws PolicyException {
-        // Track whether an exception was ever thrown while processing policy file
-        try {
-            return getDocumentElementFromSource(source);
-        } catch (SAXException | ParserConfigurationException | IOException e) {
-            throw new PolicyException(e);
-        }
+  }
+
+  /*
+   * This method takes an arbitrary input stream, copies its contents into a byte[], then returns it
+   * in a ByteArrayInputStream, closing the provided InputStream in the process. It's purpose is to
+   * ensure that the InputStream we are using can be reset to the beginning, as not all InputStream's properly
+   * allow this. We use this for AntiSamy XML policy files, which we never expect to get that large
+   * (e.g., a few Kb at most).
+   */
+  private static InputStream toByteArrayStream(InputStream in) throws PolicyException {
+    byte[] byteArray;
+    try (Reader reader = new InputStreamReader(in, Charset.forName("UTF8"))) {
+      char[] charArray = new char[8 * 1024];
+      StringBuilder builder = new StringBuilder();
+      int numCharsRead;
+      while ((numCharsRead = reader.read(charArray, 0, charArray.length)) != -1) {
+        builder.append(charArray, 0, numCharsRead);
+      }
+      byteArray = builder.toString().getBytes(Charset.forName("UTF8"));
+    } catch (IOException ioe) {
+      throw new PolicyException(ioe);
     }
 
-    /*
-     * This method takes an arbitrary input stream, copies its contents into a byte[], then returns it
-     * in a ByteArrayInputStream, closing the provided InputStream in the process. It's purpose is to
-     * ensure that the InputStream we are using can be reset to the beginning, as not all InputStream's properly
-     * allow this. We use this for AntiSamy XML policy files, which we never expect to get that large
-     * (e.g., a few Kb at most).
-     */
-    private static InputStream toByteArrayStream(InputStream in) throws PolicyException {
-        byte[] byteArray;
-        try (Reader reader = new InputStreamReader(in, Charset.forName("UTF8"))) {
-            char[] charArray = new char[8 * 1024];
-            StringBuilder builder = new StringBuilder();
-            int numCharsRead;
-            while ((numCharsRead = reader.read(charArray, 0, charArray.length)) != -1) {
-                builder.append(charArray, 0, numCharsRead);
-            }
-            byteArray = builder.toString().getBytes(Charset.forName("UTF8"));
-        } catch (IOException ioe) {
-            throw new PolicyException(ioe);
-        }
-
-        return new ByteArrayInputStream(byteArray);
-    }
-
-    private static Element getDocumentElementFromSource(InputSource source)
-            throws ParserConfigurationException, SAXException, IOException {
-
-        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-
-        /**
-         * Disable external entities, etc.
-         */
-        dbf.setFeature(EXTERNAL_GENERAL_ENTITIES, false);
-        dbf.setFeature(EXTERNAL_PARAM_ENTITIES, false);
-        dbf.setFeature(DISALLOW_DOCTYPE_DECL, true);
-        dbf.setFeature(LOAD_EXTERNAL_DTD, false);
-
-    	// Schema validation is always required now. So turn it on.
-        getPolicySchema();
-        dbf.setNamespaceAware(true);
-        dbf.setSchema(schema);
-
-        DocumentBuilder db = dbf.newDocumentBuilder();
-        db.setErrorHandler(new SAXErrorHandler());
-        Document dom = db.parse(source);
-
-        return dom.getDocumentElement();
+    return new ByteArrayInputStream(byteArray);
+  }
+
+  private static Element getDocumentElementFromSource(InputSource source)
+      throws ParserConfigurationException, SAXException, IOException {
+
+    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+
+    /** Disable external entities, etc. */
+    dbf.setFeature(EXTERNAL_GENERAL_ENTITIES, false);
+    dbf.setFeature(EXTERNAL_PARAM_ENTITIES, false);
+    dbf.setFeature(DISALLOW_DOCTYPE_DECL, true);
+    dbf.setFeature(LOAD_EXTERNAL_DTD, false);
+
+    // Schema validation is always required now. So turn it on.
+    getPolicySchema();
+    dbf.setNamespaceAware(true);
+    dbf.setSchema(schema);
+
+    DocumentBuilder db = dbf.newDocumentBuilder();
+    db.setErrorHandler(new SAXErrorHandler());
+    Document dom = db.parse(source);
+
+    return dom.getDocumentElement();
+  }
+
+  private static void parsePolicy(Element topLevelElement, ParseContext parseContext)
+      throws PolicyException {
+
+    if (topLevelElement == null) return;
+
+    parseContext.resetParamsWhereLastConfigWins();
+
+    parseCommonRegExps(
+        getFirstChild(topLevelElement, "common-regexps"), parseContext.commonRegularExpressions);
+    parseDirectives(getFirstChild(topLevelElement, "directives"), parseContext.directives);
+    parseCommonAttributes(
+        getFirstChild(topLevelElement, "common-attributes"),
+        parseContext.commonAttributes,
+        parseContext.commonRegularExpressions);
+    parseGlobalAttributes(
+        getFirstChild(topLevelElement, "global-tag-attributes"),
+        parseContext.globalAttributes,
+        parseContext.commonAttributes);
+    parseDynamicAttributes(
+        getFirstChild(topLevelElement, "dynamic-tag-attributes"),
+        parseContext.dynamicAttributes,
+        parseContext.commonAttributes);
+    parseTagRules(
+        getFirstChild(topLevelElement, "tag-rules"),
+        parseContext.commonAttributes,
+        parseContext.commonRegularExpressions,
+        parseContext.tagRules);
+    parseCSSRules(
+        getFirstChild(topLevelElement, "css-rules"),
+        parseContext.cssRules,
+        parseContext.commonRegularExpressions);
+
+    parseAllowedEmptyTags(
+        getFirstChild(topLevelElement, "allowed-empty-tags"), parseContext.allowedEmptyTags);
+    parseRequireClosingTags(
+        getFirstChild(topLevelElement, "require-closing-tags"), parseContext.requireClosingTags);
+  }
+
+  /** Returns the top level element of a loaded policy Document */
+  @SuppressFBWarnings(
+      value = "SECURITY",
+      justification =
+          "Opening a stream to the provided URL is not "
+              + "a vulnerability because only local file URLs are allowed.")
+  private static Element getPolicy(String href, URL baseUrl) throws PolicyException {
+    // Track whether an exception was ever thrown while processing policy file
+    try {
+      return getDocumentElementByUrl(href, baseUrl);
+    } catch (SAXException | ParserConfigurationException | IOException e) {
+      throw new PolicyException(e);
     }
+  }
 
-    private static void parsePolicy(Element topLevelElement, ParseContext parseContext)
-            throws PolicyException {
+  // TODO: Add JavaDocs for this new method.
+  @SuppressFBWarnings(
+      value = "SECURITY",
+      justification =
+          "Opening a stream to the provided URL is not "
+              + "a vulnerability because only local file URLs are allowed.")
+  private static Element getDocumentElementByUrl(String href, URL baseUrl)
+      throws IOException, ParserConfigurationException, SAXException {
 
-        if (topLevelElement == null) return;
+    InputSource source = null;
 
-        parseContext.resetParamsWhereLastConfigWins();
+    // Can't resolve public id, but might be able to resolve relative
+    // system id, since we have a base URI.
+    if (href != null && baseUrl != null) {
 
-        parseCommonRegExps(getFirstChild(topLevelElement, "common-regexps"), parseContext.commonRegularExpressions);
-        parseDirectives(getFirstChild(topLevelElement, "directives"), parseContext.directives);
-        parseCommonAttributes(getFirstChild(topLevelElement, "common-attributes"), parseContext.commonAttributes, parseContext.commonRegularExpressions);
-        parseGlobalAttributes(getFirstChild(topLevelElement, "global-tag-attributes"), parseContext.globalAttributes, parseContext.commonAttributes);
-        parseDynamicAttributes(getFirstChild(topLevelElement, "dynamic-tag-attributes"), parseContext.dynamicAttributes, parseContext.commonAttributes);
-        parseTagRules(getFirstChild(topLevelElement, "tag-rules"), parseContext.commonAttributes, parseContext.commonRegularExpressions, parseContext.tagRules);
-        parseCSSRules(getFirstChild(topLevelElement, "css-rules"), parseContext.cssRules, parseContext.commonRegularExpressions);
+      verifyLocalUrl(baseUrl);
 
-        parseAllowedEmptyTags(getFirstChild(topLevelElement, "allowed-empty-tags"), parseContext.allowedEmptyTags);
-        parseRequireClosingTags(getFirstChild(topLevelElement, "require-closing-tags"), parseContext.requireClosingTags);
-    }
+      URL url;
 
-    /**
-     * Returns the top level element of a loaded policy Document
-     */
-    @SuppressFBWarnings(value = "SECURITY", justification="Opening a stream to the provided URL is not "
-          + "a vulnerability because only local file URLs are allowed.")
-    private static Element getPolicy(String href, URL baseUrl) throws PolicyException {
-        // Track whether an exception was ever thrown while processing policy file
+      try {
+        url = new URL(baseUrl, href);
+        logger.info("Attempting to load AntiSamy policy from URL: " + url.toString());
+        source = new InputSource(url.openStream());
+        source.setSystemId(href);
+      } catch (MalformedURLException | FileNotFoundException e) {
         try {
-            return getDocumentElementByUrl(href, baseUrl);
-        } catch (SAXException | ParserConfigurationException | IOException e) {
-            throw new PolicyException(e);
+          String absURL = URIUtils.resolveAsString(href, baseUrl.toString());
+          url = new URL(absURL);
+          source = new InputSource(url.openStream());
+          source.setSystemId(href);
+        } catch (MalformedURLException ex2) {
+          // nothing to do
+          // TODO: Is this true? Or should we at least log the original exception, or
+          // rethrow it?
         }
+      }
     }
 
-    // TODO: Add JavaDocs for this new method.
-    @SuppressFBWarnings(value = "SECURITY", justification="Opening a stream to the provided URL is not "
-            + "a vulnerability because only local file URLs are allowed.")
-    private static Element getDocumentElementByUrl(String href, URL baseUrl)
-            throws IOException, ParserConfigurationException, SAXException {
-
-        InputSource source = null;
-
-        // Can't resolve public id, but might be able to resolve relative
-        // system id, since we have a base URI.
-        if (href != null && baseUrl != null) {
-
-            verifyLocalUrl(baseUrl);
-
-            URL url;
-
-            try {
-                url = new URL(baseUrl, href);
-                logger.info("Attempting to load AntiSamy policy from URL: " + url.toString());
-                source = new InputSource(url.openStream());
-                source.setSystemId(href);
-            } catch (MalformedURLException | FileNotFoundException e) {
-                try {
-                    String absURL = URIUtils.resolveAsString(href, baseUrl.toString());
-                    url = new URL(absURL);
-                    source = new InputSource(url.openStream());
-                    source.setSystemId(href);
-                } catch (MalformedURLException ex2) {
-                    // nothing to do
-                    // TODO: Is this true? Or should we at least log the original exception, or
-                    // rethrow it?
-                }
-            }
-        }
-
-        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-
-        /**
-         * Disable external entities, etc.
-         */
-        dbf.setFeature(EXTERNAL_GENERAL_ENTITIES, false);
-        dbf.setFeature(EXTERNAL_PARAM_ENTITIES, false);
-        dbf.setFeature(DISALLOW_DOCTYPE_DECL, true);
-        dbf.setFeature(LOAD_EXTERNAL_DTD, false);
+    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
 
-        // This code doesn't have the retry logic if schema validation fails. It is up to the caller to try again,
-        // if this fails the first time (if they want to).
-        getPolicySchema();
-        dbf.setNamespaceAware(true);
-        dbf.setSchema(schema);
+    /** Disable external entities, etc. */
+    dbf.setFeature(EXTERNAL_GENERAL_ENTITIES, false);
+    dbf.setFeature(EXTERNAL_PARAM_ENTITIES, false);
+    dbf.setFeature(DISALLOW_DOCTYPE_DECL, true);
+    dbf.setFeature(LOAD_EXTERNAL_DTD, false);
 
-        DocumentBuilder db = dbf.newDocumentBuilder();
-        db.setErrorHandler(new SAXErrorHandler());
+    // This code doesn't have the retry logic if schema validation fails. It is up to the caller
+    // to try again,
+    // if this fails the first time (if they want to).
+    getPolicySchema();
+    dbf.setNamespaceAware(true);
+    dbf.setSchema(schema);
 
-        // Load and parse the file.
-        if (source != null) {
-            Document dom = db.parse(source);
+    DocumentBuilder db = dbf.newDocumentBuilder();
+    db.setErrorHandler(new SAXErrorHandler());
 
-            // Get the policy information out of it!
-            return dom.getDocumentElement();
-        }
+    // Load and parse the file.
+    if (source != null) {
+      Document dom = db.parse(source);
 
-        return null;
+      // Get the policy information out of it!
+      return dom.getDocumentElement();
     }
 
-    /**
-     * Creates a copy of this policy with an added/changed directive.
-     * @param name The directive to add/modify
-     * @param value The value
-     * @return A clone of the policy with the updated directive
-     */
-    public Policy cloneWithDirective(String name, String value) {
-        Map<String, String> directives = new HashMap<String, String>(this.directives);
-        directives.put(name, value);
-        return new InternalPolicy(this, Collections.unmodifiableMap(directives), tagRules, cssRules);
+    return null;
+  }
+
+  /**
+   * Creates a copy of this policy with an added/changed directive.
+   *
+   * @param name The directive to add/modify
+   * @param value The value
+   * @return A clone of the policy with the updated directive
+   */
+  public Policy cloneWithDirective(String name, String value) {
+    Map<String, String> directives = new HashMap<String, String>(this.directives);
+    directives.put(name, value);
+    return new InternalPolicy(this, Collections.unmodifiableMap(directives), tagRules, cssRules);
+  }
+
+  /**
+   * Go through <directives> section of the policy file.
+   *
+   * @param root Top level of <directives>
+   * @param directives The directives map to update
+   */
+  private static void parseDirectives(Element root, Map<String, String> directives) {
+    for (Element ele : getByTagName(root, "directive")) {
+      String name = getAttributeValue(ele, "name");
+      String value = getAttributeValue(ele, "value");
+      directives.put(name, value);
     }
-
-    /**
-     * Go through <directives> section of the policy file.
-     *
-     * @param root       Top level of <directives>
-     * @param directives The directives map to update
-     */
-    private static void parseDirectives(Element root, Map<String, String> directives) {
-        for (Element ele : getByTagName(root, "directive")) {
-            String name = getAttributeValue(ele, "name");
-            String value = getAttributeValue(ele, "value");
-            directives.put(name, value);
+  }
+
+  /**
+   * Go through <allowed-empty-tags> section of the policy file.
+   *
+   * @param allowedEmptyTagsListNode Top level of <allowed-empty-tags>
+   * @param allowedEmptyTags The tags that can be empty
+   */
+  private static void parseAllowedEmptyTags(
+      Element allowedEmptyTagsListNode, List<String> allowedEmptyTags) {
+    if (allowedEmptyTagsListNode != null) {
+      for (Element literalNode :
+          getGrandChildrenByTagName(allowedEmptyTagsListNode, "literal-list", "literal")) {
+
+        String value = getAttributeValue(literalNode, "value");
+        if (value != null && value.length() > 0) {
+          allowedEmptyTags.add(value);
         }
-    }
-
-    /**
-     * Go through <allowed-empty-tags> section of the policy file.
-     *
-     * @param allowedEmptyTagsListNode Top level of <allowed-empty-tags>
-     * @param allowedEmptyTags         The tags that can be empty
-     */
-    private static void parseAllowedEmptyTags(Element allowedEmptyTagsListNode,
-                                              List<String> allowedEmptyTags) {
-        if (allowedEmptyTagsListNode != null) {
-            for (Element literalNode :
-                    getGrandChildrenByTagName(allowedEmptyTagsListNode, "literal-list", "literal")) {
-
-                String value = getAttributeValue(literalNode, "value");
-                if (value != null && value.length() > 0) {
-                    allowedEmptyTags.add(value);
-                }
-            }
-        } else allowedEmptyTags.addAll(Constants.defaultAllowedEmptyTags);
-    }
-
-    /**
-     * Go through <require-closing-tags> section of the policy file.
-     *
-     * @param requireClosingTagsListNode Top level of <require-closing-tags>
-     * @param requireClosingTags         The list of tags that require closing
-     */
-    private static void parseRequireClosingTags(Element requireClosingTagsListNode,
-                                                 List<String> requireClosingTags) {
-        if (requireClosingTagsListNode != null) {
-            for (Element literalNode :
-                    getGrandChildrenByTagName(requireClosingTagsListNode, "literal-list", "literal")) {
-
-                String value = getAttributeValue(literalNode, "value");
-                if (value != null && value.length() > 0) {
-                    requireClosingTags.add(value);
-                }
-            }
-        } else requireClosingTags.addAll(Constants.defaultRequireClosingTags);
-    }
-
-    /**
-     * Go through <global-tag-attributes> section of the policy file.
-     *
-     * @param root              Top level of <global-tag-attributes>
-     * @param globalAttributes1 A HashMap of global Attributes that need validation for every tag.
-     * @param commonAttributes  The common attributes
-     * @throws PolicyException
-     */
-    private static void parseGlobalAttributes(Element root, Map<String, Attribute> globalAttributes1, Map<String, Attribute> commonAttributes) throws PolicyException {
-        for (Element ele : getByTagName(root, "attribute")) {
-
-            String name = getAttributeValue(ele, "name");
-            Attribute toAdd = commonAttributes.get(name.toLowerCase());
-
-            if (toAdd != null) globalAttributes1.put(name.toLowerCase(), toAdd);
-              else throw new PolicyException("Global attribute '" + name
-                                             + "' was not defined in <common-attributes>");
+      }
+    } else allowedEmptyTags.addAll(Constants.defaultAllowedEmptyTags);
+  }
+
+  /**
+   * Go through <require-closing-tags> section of the policy file.
+   *
+   * @param requireClosingTagsListNode Top level of <require-closing-tags>
+   * @param requireClosingTags The list of tags that require closing
+   */
+  private static void parseRequireClosingTags(
+      Element requireClosingTagsListNode, List<String> requireClosingTags) {
+    if (requireClosingTagsListNode != null) {
+      for (Element literalNode :
+          getGrandChildrenByTagName(requireClosingTagsListNode, "literal-list", "literal")) {
+
+        String value = getAttributeValue(literalNode, "value");
+        if (value != null && value.length() > 0) {
+          requireClosingTags.add(value);
         }
+      }
+    } else requireClosingTags.addAll(Constants.defaultRequireClosingTags);
+  }
+
+  /**
+   * Go through <global-tag-attributes> section of the policy file.
+   *
+   * @param root Top level of <global-tag-attributes>
+   * @param globalAttributes1 A HashMap of global Attributes that need validation for every tag.
+   * @param commonAttributes The common attributes
+   * @throws PolicyException
+   */
+  private static void parseGlobalAttributes(
+      Element root,
+      Map<String, Attribute> globalAttributes1,
+      Map<String, Attribute> commonAttributes)
+      throws PolicyException {
+    for (Element ele : getByTagName(root, "attribute")) {
+
+      String name = getAttributeValue(ele, "name");
+      Attribute toAdd = commonAttributes.get(name.toLowerCase());
+
+      if (toAdd != null) globalAttributes1.put(name.toLowerCase(), toAdd);
+      else
+        throw new PolicyException(
+            "Global attribute '" + name + "' was not defined in <common-attributes>");
     }
-
-    /**
-     * Go through <dynamic-tag-attributes> section of the policy file.
-     *
-     * @param root              Top level of <dynamic-tag-attributes>
-     * @param dynamicAttributes A HashMap of dynamic Attributes that need validation for every tag.
-     * @param commonAttributes  The common attributes
-     * @throws PolicyException
-     */
-    private static void parseDynamicAttributes(Element root, Map<String, Attribute> dynamicAttributes, Map<String, Attribute> commonAttributes) throws PolicyException {
-        for (Element ele : getByTagName(root, "attribute")) {
-
-            String name = getAttributeValue(ele, "name");
-            Attribute toAdd = commonAttributes.get(name.toLowerCase());
-
-            if (toAdd != null) {
-                String attrName = name.toLowerCase().substring(0, name.length() - 1);
-                dynamicAttributes.put(attrName, toAdd);
-            } else throw new PolicyException("Dynamic attribute '" + name
-                                             + "' was not defined in <common-attributes>");
-        }
+  }
+
+  /**
+   * Go through <dynamic-tag-attributes> section of the policy file.
+   *
+   * @param root Top level of <dynamic-tag-attributes>
+   * @param dynamicAttributes A HashMap of dynamic Attributes that need validation for every tag.
+   * @param commonAttributes The common attributes
+   * @throws PolicyException
+   */
+  private static void parseDynamicAttributes(
+      Element root,
+      Map<String, Attribute> dynamicAttributes,
+      Map<String, Attribute> commonAttributes)
+      throws PolicyException {
+    for (Element ele : getByTagName(root, "attribute")) {
+
+      String name = getAttributeValue(ele, "name");
+      Attribute toAdd = commonAttributes.get(name.toLowerCase());
+
+      if (toAdd != null) {
+        String attrName = name.toLowerCase().substring(0, name.length() - 1);
+        dynamicAttributes.put(attrName, toAdd);
+      } else
+        throw new PolicyException(
+            "Dynamic attribute '" + name + "' was not defined in <common-attributes>");
     }
-
-    /**
-     * Go through the <common-regexps> section of the policy file.
-     *
-     * @param root                      Top level of <common-regexps>
-     * @param commonRegularExpressions1 the antisamy pattern objects
-     */
-    private static void parseCommonRegExps(Element root, Map<String, AntiSamyPattern> commonRegularExpressions1) {
-        for (Element ele : getByTagName(root, "regexp")) {
-
-            String name = getAttributeValue(ele, "name");
-            Pattern pattern = Pattern.compile(getAttributeValue(ele, "value"), Pattern.DOTALL);
-            commonRegularExpressions1.put(name, new AntiSamyPattern(pattern));
-        }
+  }
+
+  /**
+   * Go through the <common-regexps> section of the policy file.
+   *
+   * @param root Top level of <common-regexps>
+   * @param commonRegularExpressions1 the antisamy pattern objects
+   */
+  private static void parseCommonRegExps(
+      Element root, Map<String, AntiSamyPattern> commonRegularExpressions1) {
+    for (Element ele : getByTagName(root, "regexp")) {
+
+      String name = getAttributeValue(ele, "name");
+      Pattern pattern = Pattern.compile(getAttributeValue(ele, "value"), Pattern.DOTALL);
+      commonRegularExpressions1.put(name, new AntiSamyPattern(pattern));
     }
-
-    private static void parseCommonAttributes(Element root, Map<String, Attribute> commonAttributes1,
-                                              Map<String, AntiSamyPattern> commonRegularExpressions1) {
-
-        for (Element ele : getByTagName(root, "attribute")) {
-            String onInvalid = getAttributeValue(ele, "onInvalid");
-            String name = getAttributeValue(ele, "name");
-
-            List<Pattern> allowedRegexps = getAllowedRegexps(commonRegularExpressions1, ele);
-            List<String> allowedValues = getAllowedLiterals(ele);
-
-            final String onInvalidStr;
-            if (onInvalid != null && onInvalid.length() > 0) {
-                onInvalidStr = onInvalid;
-            } else onInvalidStr = DEFAULT_ONINVALID;
-
-            String description = getAttributeValue(ele, "description");
-            Attribute attribute = new Attribute(getAttributeValue(ele, "name"), allowedRegexps,
-                                                allowedValues, onInvalidStr, description);
-            commonAttributes1.put(name.toLowerCase(), attribute);
-        }
+  }
+
+  private static void parseCommonAttributes(
+      Element root,
+      Map<String, Attribute> commonAttributes1,
+      Map<String, AntiSamyPattern> commonRegularExpressions1) {
+
+    for (Element ele : getByTagName(root, "attribute")) {
+      String onInvalid = getAttributeValue(ele, "onInvalid");
+      String name = getAttributeValue(ele, "name");
+
+      List<Pattern> allowedRegexps = getAllowedRegexps(commonRegularExpressions1, ele);
+      List<String> allowedValues = getAllowedLiterals(ele);
+
+      final String onInvalidStr;
+      if (onInvalid != null && onInvalid.length() > 0) {
+        onInvalidStr = onInvalid;
+      } else onInvalidStr = DEFAULT_ONINVALID;
+
+      String description = getAttributeValue(ele, "description");
+      Attribute attribute =
+          new Attribute(
+              getAttributeValue(ele, "name"),
+              allowedRegexps,
+              allowedValues,
+              onInvalidStr,
+              description);
+      commonAttributes1.put(name.toLowerCase(), attribute);
     }
-
-    private static List<String> getAllowedLiterals(Element ele) {
-        List<String> allowedValues = new ArrayList<String>();
-        for (Element literalNode : getGrandChildrenByTagName(ele, "literal-list", "literal")) {
-            String value = getAttributeValue(literalNode, "value");
-
-            if (value != null && value.length() > 0) {
-                allowedValues.add(value);
-            } else if (literalNode.getNodeValue() != null) {
-                allowedValues.add(literalNode.getNodeValue());
-            }
-        }
-        return allowedValues;
+  }
+
+  private static List<String> getAllowedLiterals(Element ele) {
+    List<String> allowedValues = new ArrayList<String>();
+    for (Element literalNode : getGrandChildrenByTagName(ele, "literal-list", "literal")) {
+      String value = getAttributeValue(literalNode, "value");
+
+      if (value != null && value.length() > 0) {
+        allowedValues.add(value);
+      } else if (literalNode.getNodeValue() != null) {
+        allowedValues.add(literalNode.getNodeValue());
+      }
     }
-
-    private static List<Pattern> getAllowedRegexps(Map<String, AntiSamyPattern> commonRegularExpressions1, Element ele) {
-        List<Pattern> allowedRegExp = new ArrayList<Pattern>();
-        for (Element regExpNode : getGrandChildrenByTagName(ele, "regexp-list", "regexp")) {
-            String regExpName = getAttributeValue(regExpNode, "name");
-            String value = getAttributeValue(regExpNode, "value");
-
-            if (regExpName != null && regExpName.length() > 0) {
-                allowedRegExp.add(commonRegularExpressions1.get(regExpName).getPattern());
-            } else allowedRegExp.add(Pattern.compile(value, Pattern.DOTALL));
-        }
-        return allowedRegExp;
+    return allowedValues;
+  }
+
+  private static List<Pattern> getAllowedRegexps(
+      Map<String, AntiSamyPattern> commonRegularExpressions1, Element ele) {
+    List<Pattern> allowedRegExp = new ArrayList<Pattern>();
+    for (Element regExpNode : getGrandChildrenByTagName(ele, "regexp-list", "regexp")) {
+      String regExpName = getAttributeValue(regExpNode, "name");
+      String value = getAttributeValue(regExpNode, "value");
+
+      if (regExpName != null && regExpName.length() > 0) {
+        allowedRegExp.add(commonRegularExpressions1.get(regExpName).getPattern());
+      } else allowedRegExp.add(Pattern.compile(value, Pattern.DOTALL));
     }
-
-    private static List<Pattern> getAllowedRegexps2(Map<String, AntiSamyPattern> commonRegularExpressions1,
-                                                    Element attributeNode, String tagName) throws PolicyException {
-        List<Pattern> allowedRegexps = new ArrayList<Pattern>();
-        for (Element regExpNode : getGrandChildrenByTagName(attributeNode, "regexp-list", "regexp")) {
-            String regExpName = getAttributeValue(regExpNode, "name");
-            String value = getAttributeValue(regExpNode, "value");
-
-           /*
-            * Look up common regular expression specified
-            * by the "name" field. They can put a common
-            * name in the "name" field or provide a custom
-            * value in the "value" field. They must choose
-            * one or the other, not both.
-            */
-            if (regExpName != null && regExpName.length() > 0) {
-                AntiSamyPattern pattern = commonRegularExpressions1.get(regExpName);
-                if (pattern != null) {
-                    allowedRegexps.add(pattern.getPattern());
-                } else throw new PolicyException("Regular expression '" + regExpName +
-                      "' was referenced as a common regexp in definition of '" + tagName +
-                      "', but does not exist in <common-regexp>");
-            } else if (value != null && value.length() > 0) {
-                allowedRegexps.add(Pattern.compile(value, Pattern.DOTALL));
-            }
-        }
-        return allowedRegexps;
+    return allowedRegExp;
+  }
+
+  private static List<Pattern> getAllowedRegexps2(
+      Map<String, AntiSamyPattern> commonRegularExpressions1, Element attributeNode, String tagName)
+      throws PolicyException {
+    List<Pattern> allowedRegexps = new ArrayList<Pattern>();
+    for (Element regExpNode : getGrandChildrenByTagName(attributeNode, "regexp-list", "regexp")) {
+      String regExpName = getAttributeValue(regExpNode, "name");
+      String value = getAttributeValue(regExpNode, "value");
+
+      /*
+       * Look up common regular expression specified
+       * by the "name" field. They can put a common
+       * name in the "name" field or provide a custom
+       * value in the "value" field. They must choose
+       * one or the other, not both.
+       */
+      if (regExpName != null && regExpName.length() > 0) {
+        AntiSamyPattern pattern = commonRegularExpressions1.get(regExpName);
+        if (pattern != null) {
+          allowedRegexps.add(pattern.getPattern());
+        } else
+          throw new PolicyException(
+              "Regular expression '"
+                  + regExpName
+                  + "' was referenced as a common regexp in definition of '"
+                  + tagName
+                  + "', but does not exist in <common-regexp>");
+      } else if (value != null && value.length() > 0) {
+        allowedRegexps.add(Pattern.compile(value, Pattern.DOTALL));
+      }
     }
-
-    private static List<Pattern> getAllowedRegexp3(Map<String, AntiSamyPattern> commonRegularExpressions1,
-            Element ele, String name) throws PolicyException {
-
-        List<Pattern> allowedRegExp = new ArrayList<Pattern>();
-        for (Element regExpNode : getGrandChildrenByTagName(ele, "regexp-list", "regexp")) {
-            String regExpName = getAttributeValue(regExpNode, "name");
-            String value = getAttributeValue(regExpNode, "value");
-
-            AntiSamyPattern pattern = commonRegularExpressions1.get(regExpName);
-
-            if (pattern != null) {
-                allowedRegExp.add(pattern.getPattern());
-            } else if (value != null) {
-                allowedRegExp.add(Pattern.compile(value, Pattern.DOTALL));
-            } else throw new PolicyException("Regular expression '" + regExpName +
-                  "' was referenced as a common regexp in definition of '" + name +
-                  "', but does not exist in <common-regexp>");
-        }
-        return allowedRegExp;
+    return allowedRegexps;
+  }
+
+  private static List<Pattern> getAllowedRegexp3(
+      Map<String, AntiSamyPattern> commonRegularExpressions1, Element ele, String name)
+      throws PolicyException {
+
+    List<Pattern> allowedRegExp = new ArrayList<Pattern>();
+    for (Element regExpNode : getGrandChildrenByTagName(ele, "regexp-list", "regexp")) {
+      String regExpName = getAttributeValue(regExpNode, "name");
+      String value = getAttributeValue(regExpNode, "value");
+
+      AntiSamyPattern pattern = commonRegularExpressions1.get(regExpName);
+
+      if (pattern != null) {
+        allowedRegExp.add(pattern.getPattern());
+      } else if (value != null) {
+        allowedRegExp.add(Pattern.compile(value, Pattern.DOTALL));
+      } else
+        throw new PolicyException(
+            "Regular expression '"
+                + regExpName
+                + "' was referenced as a common regexp in definition of '"
+                + name
+                + "', but does not exist in <common-regexp>");
     }
+    return allowedRegExp;
+  }
 
-    private static void parseTagRules(Element root, Map<String, Attribute> commonAttributes1, Map<String,
-             AntiSamyPattern> commonRegularExpressions1, Map<String, Tag> tagRules1) throws PolicyException {
+  private static void parseTagRules(
+      Element root,
+      Map<String, Attribute> commonAttributes1,
+      Map<String, AntiSamyPattern> commonRegularExpressions1,
+      Map<String, Tag> tagRules1)
+      throws PolicyException {
 
-        if (root == null) return;
+    if (root == null) return;
 
-        for (Element tagNode : getByTagName(root, "tag")) {
-            String name = getAttributeValue(tagNode, "name");
-            String action = getAttributeValue(tagNode, "action");
+    for (Element tagNode : getByTagName(root, "tag")) {
+      String name = getAttributeValue(tagNode, "name");
+      String action = getAttributeValue(tagNode, "action");
 
-            NodeList attributeList = tagNode.getElementsByTagName("attribute");
-            Map<String, Attribute> tagAttributes = getTagAttributes(commonAttributes1, commonRegularExpressions1, attributeList, name);
-            Tag tag = new Tag(name, tagAttributes, action);
+      NodeList attributeList = tagNode.getElementsByTagName("attribute");
+      Map<String, Attribute> tagAttributes =
+          getTagAttributes(commonAttributes1, commonRegularExpressions1, attributeList, name);
+      Tag tag = new Tag(name, tagAttributes, action);
 
-            tagRules1.put(name.toLowerCase(), tag);
-        }
+      tagRules1.put(name.toLowerCase(), tag);
     }
-
-    private static Map<String, Attribute> getTagAttributes(Map<String, Attribute> commonAttributes1, Map<String,
-       AntiSamyPattern> commonRegularExpressions1, NodeList attributeList, String tagName) throws PolicyException {
-
-        Map<String,Attribute> tagAttributes = new HashMap<String, Attribute>();
-        for (int j = 0; j < attributeList.getLength(); j++) {
-            Element attributeNode = (Element) attributeList.item(j);
-
-            String attrName = getAttributeValue(attributeNode, "name").toLowerCase();
-            if (!attributeNode.hasChildNodes()) {
-                Attribute attribute = commonAttributes1.get(attrName);
-
-                // All they provided was the name, so they must want a common attribute.
-                if (attribute != null) {
-                    /*
-                     * If they provide onInvalid/description values here they will
-                     * override the common values.
-                     */
-
-                    String onInvalid = getAttributeValue(attributeNode, "onInvalid");
-                    String description = getAttributeValue(attributeNode, "description");
-                    Attribute changed = attribute.mutate(onInvalid, description);
-                    commonAttributes1.put(attrName, changed);
-                    tagAttributes.put(attrName, changed);
-
-                } else throw new PolicyException("Attribute '" + getAttributeValue(attributeNode, "name") +
-                       "' was referenced as a common attribute in definition of '" + tagName +
-                       "', but does not exist in <common-attributes>");
-
-            } else {
-                List<Pattern> allowedRegexps2 = getAllowedRegexps2(commonRegularExpressions1, attributeNode, tagName);
-                List<String> allowedValues2 = getAllowedLiterals(attributeNode);
-                String onInvalid = getAttributeValue(attributeNode, "onInvalid");
-                String description = getAttributeValue(attributeNode, "description");
-                Attribute attribute = new Attribute(getAttributeValue(attributeNode, "name"), allowedRegexps2, allowedValues2, onInvalid, description);
-
-                // Add fully built attribute.
-                tagAttributes.put(attrName, attribute);
-            }
-        }
-        return tagAttributes;
+  }
+
+  private static Map<String, Attribute> getTagAttributes(
+      Map<String, Attribute> commonAttributes1,
+      Map<String, AntiSamyPattern> commonRegularExpressions1,
+      NodeList attributeList,
+      String tagName)
+      throws PolicyException {
+
+    Map<String, Attribute> tagAttributes = new HashMap<String, Attribute>();
+    for (int j = 0; j < attributeList.getLength(); j++) {
+      Element attributeNode = (Element) attributeList.item(j);
+
+      String attrName = getAttributeValue(attributeNode, "name").toLowerCase();
+      if (!attributeNode.hasChildNodes()) {
+        Attribute attribute = commonAttributes1.get(attrName);
+
+        // All they provided was the name, so they must want a common attribute.
+        if (attribute != null) {
+          /*
+           * If they provide onInvalid/description values here they will
+           * override the common values.
+           */
+
+          String onInvalid = getAttributeValue(attributeNode, "onInvalid");
+          String description = getAttributeValue(attributeNode, "description");
+          Attribute changed = attribute.mutate(onInvalid, description);
+          commonAttributes1.put(attrName, changed);
+          tagAttributes.put(attrName, changed);
+
+        } else
+          throw new PolicyException(
+              "Attribute '"
+                  + getAttributeValue(attributeNode, "name")
+                  + "' was referenced as a common attribute in definition of '"
+                  + tagName
+                  + "', but does not exist in <common-attributes>");
+
+      } else {
+        List<Pattern> allowedRegexps2 =
+            getAllowedRegexps2(commonRegularExpressions1, attributeNode, tagName);
+        List<String> allowedValues2 = getAllowedLiterals(attributeNode);
+        String onInvalid = getAttributeValue(attributeNode, "onInvalid");
+        String description = getAttributeValue(attributeNode, "description");
+        Attribute attribute =
+            new Attribute(
+                getAttributeValue(attributeNode, "name"),
+                allowedRegexps2,
+                allowedValues2,
+                onInvalid,
+                description);
+
+        // Add fully built attribute.
+        tagAttributes.put(attrName, attribute);
+      }
     }
-
-    private static void parseCSSRules(Element root, Map<String, Property> cssRules1, Map<String, AntiSamyPattern> commonRegularExpressions1) throws PolicyException {
-
-        for (Element ele : getByTagName(root, "property")) {
-            String name = getAttributeValue(ele, "name");
-            String description = getAttributeValue(ele, "description");
-
-            List<Pattern> allowedRegexp3 = getAllowedRegexp3(commonRegularExpressions1, ele, name);
-
-            List<String> allowedValue = new ArrayList<String>();
-            for (Element literalNode : getGrandChildrenByTagName(ele, "literal-list", "literal")) {
-                allowedValue.add(getAttributeValue(literalNode, "value"));
-            }
-
-            List<String> shortHandRefs = new ArrayList<String>();
-            for (Element shorthandNode : getGrandChildrenByTagName(ele, "shorthand-list", "shorthand")) {
-                shortHandRefs.add(getAttributeValue(shorthandNode, "name"));
-            }
-
-            String onInvalid = getAttributeValue(ele, "onInvalid");
-            final String onInvalidStr;
-            if (onInvalid != null && onInvalid.length() > 0) {
-                onInvalidStr = onInvalid;
-            } else onInvalidStr = DEFAULT_ONINVALID;
-
-            Property property = new Property(name,allowedRegexp3, allowedValue, shortHandRefs, description, onInvalidStr);
-            cssRules1.put(name.toLowerCase(), property);
-        }
+    return tagAttributes;
+  }
+
+  private static void parseCSSRules(
+      Element root,
+      Map<String, Property> cssRules1,
+      Map<String, AntiSamyPattern> commonRegularExpressions1)
+      throws PolicyException {
+
+    for (Element ele : getByTagName(root, "property")) {
+      String name = getAttributeValue(ele, "name");
+      String description = getAttributeValue(ele, "description");
+
+      List<Pattern> allowedRegexp3 = getAllowedRegexp3(commonRegularExpressions1, ele, name);
+
+      List<String> allowedValue = new ArrayList<String>();
+      for (Element literalNode : getGrandChildrenByTagName(ele, "literal-list", "literal")) {
+        allowedValue.add(getAttributeValue(literalNode, "value"));
+      }
+
+      List<String> shortHandRefs = new ArrayList<String>();
+      for (Element shorthandNode : getGrandChildrenByTagName(ele, "shorthand-list", "shorthand")) {
+        shortHandRefs.add(getAttributeValue(shorthandNode, "name"));
+      }
+
+      String onInvalid = getAttributeValue(ele, "onInvalid");
+      final String onInvalidStr;
+      if (onInvalid != null && onInvalid.length() > 0) {
+        onInvalidStr = onInvalid;
+      } else onInvalidStr = DEFAULT_ONINVALID;
+
+      Property property =
+          new Property(
+              name, allowedRegexp3, allowedValue, shortHandRefs, description, onInvalidStr);
+      cssRules1.put(name.toLowerCase(), property);
     }
-
-    /**
-     * A simple method for returning on of the &lt;global-attribute&gt; entries by
-     * name.
-     *
-     * @param name The name of the global-attribute we want to look up.
-     * @return An Attribute associated with the global-attribute lookup name specified.
-     */
-    public Attribute getGlobalAttributeByName(String name) {
-        return globalAttributes.get(name.toLowerCase());
-    }
-
-    /**
-     * A method for returning one of the dynamic &lt;global-attribute&gt; entries by name.
-     *
-     * @param name The name of the dynamic global-attribute we want to look up.
-     * @return An Attribute associated with the global-attribute lookup name specified,
-     * or null if not found.
-     */
-    public Attribute getDynamicAttributeByName(String name) {
-        Attribute dynamicAttribute = null;
-        Set<Map.Entry<String, Attribute>> entries = dynamicAttributes.entrySet();
-        for (Map.Entry<String, Attribute> entry : entries) {
-          if (name.startsWith(entry.getKey())) {
-              dynamicAttribute = entry.getValue();
-              break;
-          }
-        }
-        return dynamicAttribute;
-    }
-
-    /**
-     * Return all the allowed empty tags configured in the Policy.
-     *
-     * @return A String array of all the he allowed empty tags configured in the Policy.
-     */
-    public TagMatcher getAllowedEmptyTags() {
-        return allowedEmptyTagsMatcher;
-    }
-
-    /**
-     * Return all the tags that are required to be closed with an end tag, even if they have no child content.
-     *
-     * @return A String array of all the tags that are required to be closed with an end tag, even if they have no child content.
-     */
-    public TagMatcher getRequiresClosingTags() {
-        return requiresClosingTagsMatcher;
+  }
+
+  /**
+   * A simple method for returning on of the &lt;global-attribute&gt; entries by name.
+   *
+   * @param name The name of the global-attribute we want to look up.
+   * @return An Attribute associated with the global-attribute lookup name specified.
+   */
+  public Attribute getGlobalAttributeByName(String name) {
+    return globalAttributes.get(name.toLowerCase());
+  }
+
+  /**
+   * A method for returning one of the dynamic &lt;global-attribute&gt; entries by name.
+   *
+   * @param name The name of the dynamic global-attribute we want to look up.
+   * @return An Attribute associated with the global-attribute lookup name specified, or null if not
+   *     found.
+   */
+  public Attribute getDynamicAttributeByName(String name) {
+    Attribute dynamicAttribute = null;
+    Set<Map.Entry<String, Attribute>> entries = dynamicAttributes.entrySet();
+    for (Map.Entry<String, Attribute> entry : entries) {
+      if (name.startsWith(entry.getKey())) {
+        dynamicAttribute = entry.getValue();
+        break;
+      }
     }
-
-    /**
-     * Return a directive value based on a lookup name.
-     *
-     * @param name The name of the directive we want to look up.
-     * @return A String object containing the directive associated with the lookup name, or null if none is found.
-     */
-    public String getDirective(String name) {
-        return directives.get(name);
-    }
-
-    /**
-     * Resolves public and system IDs to files stored within the JAR.
-     *
-     * @param systemId The name of the entity we want to look up.
-     * @param baseUrl The base location of the entity.
-     * @return A String object containing the directive associated with the lookup name, or null if none is found.
-     * @throws IOException if the specified URL can't be opened.
-     * @throws SAXException This exception can't actually be thrown, but left in the method signature for
-     *                API compatibility reasons.
-     */
-    @SuppressFBWarnings(value = "SECURITY", justification="Opening a stream to the provided URL is not "
-          + "a vulnerability because only local file URLs are allowed.")
-    public static InputSource resolveEntity(final String systemId, URL baseUrl) throws IOException, SAXException {
-
-        InputSource source;
-
-        // Can't resolve public id, but might be able to resolve relative
-        // system id, since we have a base URI.
-        if (systemId != null && baseUrl != null) {
-
-            verifyLocalUrl(baseUrl);
-
-            URL url;
-
-            try {
-                url = new URL(baseUrl, systemId);
-                source = new InputSource(url.openStream());
-                source.setSystemId(systemId);
-                return source;
-            } catch (MalformedURLException | FileNotFoundException e) {
-                try {
-                    String absURL = URIUtils.resolveAsString(systemId, baseUrl.toString());
-                    url = new URL(absURL);
-                    source = new InputSource(url.openStream());
-                    source.setSystemId(systemId);
-                    return source;
-                } catch (MalformedURLException ex2) {
-                    // nothing to do
-                }
-            }
-            return null;
-        }
-
-        // No resolving.
-        return null;
-    }
-
-    /**
-     * Verify that the target of the URL is a local file only. Currently, we allow file: and jar: URLs.
-     * The target of the URL is typically an AntiSamy policy file.
-     * @param url The URL to verify.
-     * @throws MalformedURLException If the supplied URL does not reference a local file directly, or one inside
-     * a local JAR file.
-     */
-    private static void verifyLocalUrl(URL url) throws MalformedURLException {
-
-        switch (url.getProtocol()) {
-            case "file":
-            case "jar" : break; // These are OK.
-
-            default: throw new MalformedURLException(
-                "Only local files can be accessed with a policy URL. Illegal value supplied was: " + url);
+    return dynamicAttribute;
+  }
+
+  /**
+   * Return all the allowed empty tags configured in the Policy.
+   *
+   * @return A String array of all the he allowed empty tags configured in the Policy.
+   */
+  public TagMatcher getAllowedEmptyTags() {
+    return allowedEmptyTagsMatcher;
+  }
+
+  /**
+   * Return all the tags that are required to be closed with an end tag, even if they have no child
+   * content.
+   *
+   * @return A String array of all the tags that are required to be closed with an end tag, even if
+   *     they have no child content.
+   */
+  public TagMatcher getRequiresClosingTags() {
+    return requiresClosingTagsMatcher;
+  }
+
+  /**
+   * Return a directive value based on a lookup name.
+   *
+   * @param name The name of the directive we want to look up.
+   * @return A String object containing the directive associated with the lookup name, or null if
+   *     none is found.
+   */
+  public String getDirective(String name) {
+    return directives.get(name);
+  }
+
+  /**
+   * Resolves public and system IDs to files stored within the JAR.
+   *
+   * @param systemId The name of the entity we want to look up.
+   * @param baseUrl The base location of the entity.
+   * @return A String object containing the directive associated with the lookup name, or null if
+   *     none is found.
+   * @throws IOException if the specified URL can't be opened.
+   * @throws SAXException This exception can't actually be thrown, but left in the method signature
+   *     for API compatibility reasons.
+   */
+  @SuppressFBWarnings(
+      value = "SECURITY",
+      justification =
+          "Opening a stream to the provided URL is not "
+              + "a vulnerability because only local file URLs are allowed.")
+  public static InputSource resolveEntity(final String systemId, URL baseUrl)
+      throws IOException, SAXException {
+
+    InputSource source;
+
+    // Can't resolve public id, but might be able to resolve relative
+    // system id, since we have a base URI.
+    if (systemId != null && baseUrl != null) {
+
+      verifyLocalUrl(baseUrl);
+
+      URL url;
+
+      try {
+        url = new URL(baseUrl, systemId);
+        source = new InputSource(url.openStream());
+        source.setSystemId(systemId);
+        return source;
+      } catch (MalformedURLException | FileNotFoundException e) {
+        try {
+          String absURL = URIUtils.resolveAsString(systemId, baseUrl.toString());
+          url = new URL(absURL);
+          source = new InputSource(url.openStream());
+          source.setSystemId(systemId);
+          return source;
+        } catch (MalformedURLException ex2) {
+          // nothing to do
         }
+      }
+      return null;
     }
 
-    private static Element getFirstChild(Element element, String tagName) {
-        if (element == null) return null;
-        NodeList elementsByTagName = element.getElementsByTagName(tagName);
-        if (elementsByTagName != null && elementsByTagName.getLength() > 0)
-            return (Element) elementsByTagName.item(0);
-        else return null;
+    // No resolving.
+    return null;
+  }
+
+  /**
+   * Verify that the target of the URL is a local file only. Currently, we allow file: and jar:
+   * URLs. The target of the URL is typically an AntiSamy policy file.
+   *
+   * @param url The URL to verify.
+   * @throws MalformedURLException If the supplied URL does not reference a local file directly, or
+   *     one inside a local JAR file.
+   */
+  private static void verifyLocalUrl(URL url) throws MalformedURLException {
+
+    switch (url.getProtocol()) {
+      case "file":
+      case "jar":
+        break; // These are OK.
+
+      default:
+        throw new MalformedURLException(
+            "Only local files can be accessed with a policy URL. Illegal value supplied was: "
+                + url);
     }
+  }
+
+  private static Element getFirstChild(Element element, String tagName) {
+    if (element == null) return null;
+    NodeList elementsByTagName = element.getElementsByTagName(tagName);
+    if (elementsByTagName != null && elementsByTagName.getLength() > 0)
+      return (Element) elementsByTagName.item(0);
+    else return null;
+  }
+
+  private static Iterable<Element> getGrandChildrenByTagName(
+      Element parent, String immediateChildName, String subChild) {
+    NodeList elementsByTagName = parent.getElementsByTagName(immediateChildName);
+    if (elementsByTagName.getLength() == 0) return Collections.emptyList();
+    Element regExpListNode = (Element) elementsByTagName.item(0);
+    return getByTagName(regExpListNode, subChild);
+  }
+
+  private static Iterable<Element> getByTagName(Element parent, String tagName) {
+    if (parent == null) return Collections.emptyList();
+
+    final NodeList nodes = parent.getElementsByTagName(tagName);
+    return new Iterable<Element>() {
+      public Iterator<Element> iterator() {
+        return new Iterator<Element>() {
+          int pos = 0;
+          int len = nodes.getLength();
+
+          public boolean hasNext() {
+            return pos < len;
+          }
 
-    private static Iterable<Element>  getGrandChildrenByTagName(Element parent, String immediateChildName, String subChild){
-        NodeList elementsByTagName = parent.getElementsByTagName(immediateChildName);
-        if (elementsByTagName.getLength() == 0) return Collections.emptyList();
-        Element regExpListNode = (Element) elementsByTagName.item(0);
-        return getByTagName( regExpListNode, subChild);
-    }
+          public Element next() {
+            return (Element) nodes.item(pos++);
+          }
 
-    private static Iterable<Element> getByTagName(Element parent, String tagName) {
-        if (parent == null) return Collections.emptyList();
-
-        final NodeList nodes = parent.getElementsByTagName(tagName);
-        return new Iterable<Element>() {
-            public Iterator<Element> iterator() {
-                return new Iterator<Element>() {
-                    int pos = 0;
-                    int len = nodes.getLength();
-
-                    public boolean hasNext() {
-                        return pos < len;
-                    }
-
-                    public Element next() {
-                        return (Element) nodes.item(pos++);
-                    }
-
-                    public void remove() {
-                        throw new UnsupportedOperationException("Cant remove");
-                    }
-                };
-            }
+          public void remove() {
+            throw new UnsupportedOperationException("Cant remove");
+          }
         };
+      }
+    };
+  }
+
+  public AntiSamyPattern getCommonRegularExpressions(String name) {
+    return commonRegularExpressions.get(name);
+  }
+
+  private static void getPolicySchema() throws SAXException {
+    if (schema == null) {
+      InputStream schemaStream =
+          Policy.class.getClassLoader().getResourceAsStream(POLICY_SCHEMA_URI);
+      Source schemaSource = new StreamSource(schemaStream);
+      schema =
+          SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI).newSchema(schemaSource);
     }
-
-    public AntiSamyPattern getCommonRegularExpressions(String name) {
-        return commonRegularExpressions.get(name);
+  }
+
+  /**
+   * This class is implemented to just throw an exception when validating the policy schema while
+   * parsing the document.
+   */
+  static class SAXErrorHandler implements ErrorHandler {
+    @Override
+    public void error(SAXParseException arg0) throws SAXException {
+      throw arg0;
     }
 
-    private static void getPolicySchema() throws SAXException {
-        if (schema == null) {
-            InputStream schemaStream = Policy.class.getClassLoader().getResourceAsStream(POLICY_SCHEMA_URI);
-            Source schemaSource = new StreamSource(schemaStream);
-            schema = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI)
-                    .newSchema(schemaSource);
-        }
+    @Override
+    public void fatalError(SAXParseException arg0) throws SAXException {
+      throw arg0;
     }
 
-    /**
-     * This class is implemented to just throw an exception when
-     * validating the policy schema while parsing the document.
-     */
-    static class SAXErrorHandler implements ErrorHandler {
-        @Override
-        public void error(SAXParseException arg0) throws SAXException {
-            throw arg0;
-        }
-
-        @Override
-        public void fatalError(SAXParseException arg0) throws SAXException {
-            throw arg0;
-        }
-
-        @Override
-        public void warning(SAXParseException arg0) throws SAXException {
-            throw arg0;
-        }
+    @Override
+    public void warning(SAXParseException arg0) throws SAXException {
+      throw arg0;
     }
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/PolicyException.java b/src/main/java/org/owasp/validator/html/PolicyException.java
index be840913..ab61c0fd 100644
--- a/src/main/java/org/owasp/validator/html/PolicyException.java
+++ b/src/main/java/org/owasp/validator/html/PolicyException.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -25,27 +25,21 @@
 package org.owasp.validator.html;
 
 /**
- * This exception gets thrown when there is a problem validating or parsing
- * the policy file. Any validation errors not caught by the XML validation
- * will be thrown with this exception.
- * 
- * @author Arshan Dabirsiaghi
+ * This exception gets thrown when there is a problem validating or parsing the policy file. Any
+ * validation errors not caught by the XML validation will be thrown with this exception.
  *
+ * @author Arshan Dabirsiaghi
  */
-
 public class PolicyException extends Exception {
 
-	/**
-	 * 
-	 */
-	private static final long serialVersionUID = 1L;
-
-	public PolicyException(Exception e) {
-		super(e);
-	}
+  /** */
+  private static final long serialVersionUID = 1L;
 
-	public PolicyException(String string) {
-		super(string);
-	}
+  public PolicyException(Exception e) {
+    super(e);
+  }
 
+  public PolicyException(String string) {
+    super(string);
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/ScanException.java b/src/main/java/org/owasp/validator/html/ScanException.java
index 71e7ce6d..fd41edb9 100644
--- a/src/main/java/org/owasp/validator/html/ScanException.java
+++ b/src/main/java/org/owasp/validator/html/ScanException.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -25,28 +25,22 @@
 package org.owasp.validator.html;
 
 /**
- * 
- * This exception gets thrown when there is an unexpected error parsing
- * the tainted HTML. The code is sturdy, but the unlikely <code>IOException</code> or
- * SAX exceptions are always theoretically possible.
- * 
- * @author Arshan Dabirsiaghi
+ * This exception gets thrown when there is an unexpected error parsing the tainted HTML. The code
+ * is sturdy, but the unlikely <code>IOException</code> or SAX exceptions are always theoretically
+ * possible.
  *
+ * @author Arshan Dabirsiaghi
  */
-
 public class ScanException extends Exception {
 
-	/**
-	 * 
-	 */
-	private static final long serialVersionUID = 1L;
+  /** */
+  private static final long serialVersionUID = 1L;
 
-	public ScanException(Exception e) { 
-		super(e);
-	}
-	
-	public ScanException(String s) {
-		super(s);
-	}
+  public ScanException(Exception e) {
+    super(e);
+  }
 
+  public ScanException(String s) {
+    super(s);
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/TagMatcher.java b/src/main/java/org/owasp/validator/html/TagMatcher.java
index 0695efc6..195c2fd9 100644
--- a/src/main/java/org/owasp/validator/html/TagMatcher.java
+++ b/src/main/java/org/owasp/validator/html/TagMatcher.java
@@ -32,26 +32,27 @@
  * @author Kristian Rosenvold
  */
 public class TagMatcher {
-    private final Set<String> allowedLowercase = new HashSet<String>();
+  private final Set<String> allowedLowercase = new HashSet<String>();
 
-    public TagMatcher(Iterable<String> allowedValues) {
-        for (String item : allowedValues) {
-            allowedLowercase.add(item.toLowerCase());
-        }
+  public TagMatcher(Iterable<String> allowedValues) {
+    for (String item : allowedValues) {
+      allowedLowercase.add(item.toLowerCase());
     }
+  }
 
-    /**
-     * Examines if this tag matches the values in this matcher.
-     *
-     * Please note that this is case-insensitive, which is OK for HTML, but not really for XML
-     * @param tagName The tag name to look for
-     * @return true if the tag name matches this matcher
-     */
-    public boolean matches(String tagName) {
-        return allowedLowercase.contains(tagName.toLowerCase());
-    }
+  /**
+   * Examines if this tag matches the values in this matcher.
+   *
+   * <p>Please note that this is case-insensitive, which is OK for HTML, but not really for XML
+   *
+   * @param tagName The tag name to look for
+   * @return true if the tag name matches this matcher
+   */
+  public boolean matches(String tagName) {
+    return allowedLowercase.contains(tagName.toLowerCase());
+  }
 
-    public int size() {
-        return allowedLowercase.size();
-    }
+  public int size() {
+    return allowedLowercase.size();
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/model/AntiSamyPattern.java b/src/main/java/org/owasp/validator/html/model/AntiSamyPattern.java
index 7a5d9bd8..1d7e662e 100644
--- a/src/main/java/org/owasp/validator/html/model/AntiSamyPattern.java
+++ b/src/main/java/org/owasp/validator/html/model/AntiSamyPattern.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -28,35 +28,33 @@
 import java.util.regex.Pattern;
 
 /**
- * An extension of the Pattern  with helper methods.
+ * An extension of the Pattern with helper methods.
  *
  * @author Arshan Dabirsiaghi
  */
 public class AntiSamyPattern {
 
-    private final Pattern pattern;
-
-    /**
-     * Constructor for AntiSamyPattern.
-     *
-     * @param pattern The Pattern to lookup based on the "name".
-     */
-    public AntiSamyPattern(Pattern pattern) {
-        this.pattern = pattern;
-    }
-
-    /**
-     * @return Return the Pattern of the <code>AntiSamyPattern</code>.
-     */
-    public Pattern getPattern() {
-        return pattern;
-    }
-
-    public Matcher matcher(CharSequence input) {
-        return pattern.matcher(input);
-    }
-
-    public boolean matches(String other) {
-        return matcher(other).matches();
-    }
+  private final Pattern pattern;
+
+  /**
+   * Constructor for AntiSamyPattern.
+   *
+   * @param pattern The Pattern to lookup based on the "name".
+   */
+  public AntiSamyPattern(Pattern pattern) {
+    this.pattern = pattern;
+  }
+
+  /** @return Return the Pattern of the <code>AntiSamyPattern</code>. */
+  public Pattern getPattern() {
+    return pattern;
+  }
+
+  public Matcher matcher(CharSequence input) {
+    return pattern.matcher(input);
+  }
+
+  public boolean matches(String other) {
+    return matcher(other).matches();
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/model/Attribute.java b/src/main/java/org/owasp/validator/html/model/Attribute.java
index cfd70d1f..32bcbf58 100644
--- a/src/main/java/org/owasp/validator/html/model/Attribute.java
+++ b/src/main/java/org/owasp/validator/html/model/Attribute.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li, Kristian Rosenvold
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -38,155 +38,171 @@
 import java.util.regex.Pattern;
 
 /**
- * A model for HTML attributes and the "rules" they must follow (either literals or regular expressions) in
- * order to be considered valid.
- * 
+ * A model for HTML attributes and the "rules" they must follow (either literals or regular
+ * expressions) in order to be considered valid.
+ *
  * @author Arshan Dabirsiaghi
  * @author Kristian Rosenvold
  */
-
-public class Attribute  {
-
-	private final String name;
-	private final String description;
-	private final String onInvalid;
-    private final List<String> allowedValues;
-    private final Pattern[] allowedRegExps;
-    private final Set<String> allowedValuesLower;
-
-    public Attribute(String name, List<Pattern> allowedRegexps, List<String> allowedValues, String onInvalidStr, String description) {
-        this.name = name;
-        this.allowedRegExps = allowedRegexps.toArray(new Pattern[ allowedRegexps.size()]);
-        this.allowedValues = Collections.unmodifiableList( allowedValues);
-        Set<String> allowedValuesLower = new HashSet<String>();
-        for (String allowedValue : allowedValues) {
-            allowedValuesLower.add( allowedValue.toLowerCase());
-        }
-
-        this.allowedValuesLower = allowedValuesLower;
-        this.onInvalid = onInvalidStr;
-        this.description = description;
+public class Attribute {
+
+  private final String name;
+  private final String description;
+  private final String onInvalid;
+  private final List<String> allowedValues;
+  private final Pattern[] allowedRegExps;
+  private final Set<String> allowedValuesLower;
+
+  public Attribute(
+      String name,
+      List<Pattern> allowedRegexps,
+      List<String> allowedValues,
+      String onInvalidStr,
+      String description) {
+    this.name = name;
+    this.allowedRegExps = allowedRegexps.toArray(new Pattern[allowedRegexps.size()]);
+    this.allowedValues = Collections.unmodifiableList(allowedValues);
+    Set<String> allowedValuesLower = new HashSet<String>();
+    for (String allowedValue : allowedValues) {
+      allowedValuesLower.add(allowedValue.toLowerCase());
     }
 
-    public boolean matchesAllowedExpression(String value){
-        String input = value.toLowerCase();
-        for (Pattern pattern : allowedRegExps) {
-            if (pattern != null && pattern.matcher(input).matches()) {
-                return true;
-            }
-        }
-        return false;
+    this.allowedValuesLower = allowedValuesLower;
+    this.onInvalid = onInvalidStr;
+    this.description = description;
+  }
+
+  public boolean matchesAllowedExpression(String value) {
+    String input = value.toLowerCase();
+    for (Pattern pattern : allowedRegExps) {
+      if (pattern != null && pattern.matcher(input).matches()) {
+        return true;
+      }
     }
+    return false;
+  }
+
+  public boolean containsAllowedValue(String valueInLowerCase) {
+    return allowedValuesLower.contains(valueInLowerCase);
+  }
+
+  public String getName() {
+    return name;
+  }
+
+  /**
+   * @return The <code>onInvalid</code> value a tag could have, from the list of "filterTag",
+   *     "removeTag" and "removeAttribute"
+   */
+  public String getOnInvalid() {
+    return onInvalid;
+  }
+
+  public Attribute mutate(String onInvalid, String description) {
+    return new Attribute(
+        name,
+        Arrays.asList(allowedRegExps),
+        allowedValues,
+        onInvalid != null && onInvalid.length() != 0 ? onInvalid : this.onInvalid,
+        description != null && description.length() != 0 ? description : this.description);
+  }
+
+  public String matcherRegEx(boolean hasNext) {
+    // <p (id=#([0-9.*{6})|sdf).*>
+
+    StringBuilder regExp = new StringBuilder();
+    regExp
+        .append(this.getName())
+        .append(ANY_NORMAL_WHITESPACES)
+        .append("=")
+        .append(ANY_NORMAL_WHITESPACES)
+        .append("\"")
+        .append(Tag.OPEN_ATTRIBUTE);
+
+    boolean hasRegExps = allowedRegExps.length > 0;
+
+    if (allowedRegExps.length + allowedValues.size() > 0) {
+
+      /*
+       * Go through and add static values to the regular expression.
+       */
+      Iterator<String> allowedValues = this.allowedValues.iterator();
+      while (allowedValues.hasNext()) {
+        String allowedValue = allowedValues.next();
+
+        regExp.append(Tag.escapeRegularExpressionCharacters(allowedValue));
+
+        if (allowedValues.hasNext() || hasRegExps) {
+          regExp.append(ATTRIBUTE_DIVIDER);
+        }
+      }
+
+      /*
+       * Add the regular expressions for this attribute value to the mother regular expression.
+       */
+      Iterator<Pattern> allowedRegExps = Arrays.asList(this.allowedRegExps).iterator();
+      while (allowedRegExps.hasNext()) {
+        Pattern allowedRegExp = allowedRegExps.next();
+        regExp.append(allowedRegExp.pattern());
+
+        if (allowedRegExps.hasNext()) {
+          regExp.append(ATTRIBUTE_DIVIDER);
+        }
+      }
 
-    public boolean containsAllowedValue(String valueInLowerCase){
-        return allowedValuesLower.contains(valueInLowerCase);
-    }
-
-	public String getName() {
-		return name;
-	}
-
-    /**
-	 * 
-	 * @return The <code>onInvalid</code> value a tag could have, from the list of "filterTag", "removeTag" and "removeAttribute" 
-	 */
-	public String getOnInvalid() {
-		return onInvalid;
-	}
+      if (this.allowedRegExps.length + this.allowedValues.size() > 0) {
+        regExp.append(CLOSE_ATTRIBUTE);
+      }
 
+      regExp.append("\"" + ANY_NORMAL_WHITESPACES);
 
-    public Attribute mutate(String onInvalid, String description)  {
-        return new Attribute(name, Arrays.asList(allowedRegExps), allowedValues, onInvalid != null && onInvalid.length() != 0 ? onInvalid : this.onInvalid,
-                description != null && description.length() != 0 ? description : this.description);
+      if (hasNext) {
+        regExp.append(ATTRIBUTE_DIVIDER);
+      }
     }
-
-    public String matcherRegEx(boolean hasNext){
-        // <p (id=#([0-9.*{6})|sdf).*>
-
-        StringBuilder regExp = new StringBuilder();
-        regExp.append(this.getName()).append(ANY_NORMAL_WHITESPACES).append("=").append(ANY_NORMAL_WHITESPACES).append("\"").append(Tag.OPEN_ATTRIBUTE);
-
-        boolean hasRegExps = allowedRegExps.length > 0;
-
-        if (allowedRegExps.length + allowedValues.size() > 0) {
-
-            /*
-            * Go through and add static values to the regular expression.
-            */
-            Iterator<String> allowedValues = this.allowedValues.iterator();
-            while (allowedValues.hasNext()) {
-                String allowedValue = allowedValues.next();
-
-                regExp.append(Tag.escapeRegularExpressionCharacters(allowedValue));
-
-                if (allowedValues.hasNext() || hasRegExps) {
-                    regExp.append(ATTRIBUTE_DIVIDER);
-                }
-            }
-
-            /*
-            * Add the regular expressions for this attribute value to the mother regular expression.
-            */
-            Iterator<Pattern> allowedRegExps = Arrays.asList(this.allowedRegExps).iterator();
-            while (allowedRegExps.hasNext()) {
-                Pattern allowedRegExp = allowedRegExps.next();
-                regExp.append(allowedRegExp.pattern());
-
-                if (allowedRegExps.hasNext()) {
-                    regExp.append(ATTRIBUTE_DIVIDER);
-                }
-            }
-
-            if (this.allowedRegExps.length + this.allowedValues.size() > 0) {
-                regExp.append(CLOSE_ATTRIBUTE);
-            }
-
-            regExp.append("\"" + ANY_NORMAL_WHITESPACES);
-
-            if (hasNext) {
-                regExp.append(ATTRIBUTE_DIVIDER);
-            }
+    return regExp.toString();
+  }
+
+  /**
+   * This method takes the current <code>rel</code> attribute values and, depending on which ones to
+   * add, appends the corresponding values if they are not already present. It is meant to be used
+   * with anchor tags.
+   *
+   * @param addNofollow Specifies if <code>"nofollow"</code> value should be added in case it is not
+   *     present.
+   * @param addNoopenerAndNoreferrer Specifies if <code>"noopener noreferrer"</code> value should be
+   *     added in case it is not present.
+   * @param currentRelValue Current <code>rel</code> attribute value, it will be merged with the
+   *     values specified from the previous parameters.
+   * @return The new <code>rel</code> attribute value to replace in an anchor tag.
+   */
+  public static String mergeRelValuesInAnchor(
+      boolean addNofollow, boolean addNoopenerAndNoreferrer, String currentRelValue) {
+    String newRelValue = "";
+    if (currentRelValue == null || currentRelValue.isEmpty()) {
+      if (addNofollow) newRelValue = "nofollow";
+      if (addNoopenerAndNoreferrer) newRelValue += " noopener noreferrer";
+    } else {
+      ArrayList<String> relTokens = new ArrayList<>();
+      newRelValue = currentRelValue;
+      for (String value : currentRelValue.split(" ")) {
+        relTokens.add(value.toLowerCase());
+      }
+
+      if (addNofollow && !relTokens.contains("nofollow")) {
+        newRelValue += " nofollow";
+      }
+
+      if (addNoopenerAndNoreferrer) {
+        if (!relTokens.contains("noopener")) {
+          newRelValue += " noopener";
         }
-        return regExp.toString();
-    }
-
-    /**
-     * This method takes the current <code>rel</code> attribute values and, depending on which ones to add,
-     * appends the corresponding values if they are not already present. It is meant to be used with anchor tags.
-     *
-     * @param addNofollow Specifies if <code>"nofollow"</code> value should be added in case it is not present.
-     * @param addNoopenerAndNoreferrer Specifies if <code>"noopener noreferrer"</code> value should be added in case
-     *                                 it is not present.
-     * @param currentRelValue Current <code>rel</code> attribute value, it will be merged with the values specified
-     *                        from the previous parameters.
-     * @return The new <code>rel</code> attribute value to replace in an anchor tag.
-     */
-    public static String mergeRelValuesInAnchor(boolean addNofollow, boolean addNoopenerAndNoreferrer, String currentRelValue) {
-        String newRelValue = "";
-        if (currentRelValue == null || currentRelValue.isEmpty()) {
-            if (addNofollow) newRelValue = "nofollow";
-            if (addNoopenerAndNoreferrer) newRelValue += " noopener noreferrer";
-        } else {
-            ArrayList<String> relTokens = new ArrayList<>();
-            newRelValue = currentRelValue;
-            for (String value: currentRelValue.split(" ")) {
-                relTokens.add(value.toLowerCase());
-            }
-
-            if (addNofollow && !relTokens.contains("nofollow")) {
-                newRelValue += " nofollow";
-            }
-
-            if (addNoopenerAndNoreferrer) {
-                if (!relTokens.contains("noopener")){
-                    newRelValue += " noopener";
-                }
-                if (!relTokens.contains("noreferrer")){
-                    newRelValue += " noreferrer";
-                }
-            }
+        if (!relTokens.contains("noreferrer")) {
+          newRelValue += " noreferrer";
         }
-
-        return newRelValue.trim();
+      }
     }
+
+    return newRelValue.trim();
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/model/Property.java b/src/main/java/org/owasp/validator/html/model/Property.java
index 1f752b32..7dfed870 100644
--- a/src/main/java/org/owasp/validator/html/model/Property.java
+++ b/src/main/java/org/owasp/validator/html/model/Property.java
@@ -1,11 +1,11 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without 
+ *
+ * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
- * - Redistributions of source code must retain the above copyright notice, 
+ * - Redistributions of source code must retain the above copyright notice,
  * 	 this list of conditions and the following disclaimer.
  * - Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
@@ -33,57 +33,66 @@
 import java.util.regex.Pattern;
 
 /**
- * A model for CSS properties and the "rules" they must follow (either literals
- * or regular expressions) in order to be considered valid.
- * 
+ * A model for CSS properties and the "rules" they must follow (either literals or regular
+ * expressions) in order to be considered valid.
+ *
  * @author Jason Li
  */
 public class Property {
-	private final String name;
-
-	private final List<Pattern> allowedRegExp;
+  private final String name;
 
-    private final List<String> allowedValues;
+  private final List<Pattern> allowedRegExp;
 
-	private final List<String> shorthandRefs;
+  private final List<String> allowedValues;
 
-    public Property(String name, List<Pattern> allowedRegexp3, List<String> allowedValue, List<String> shortHandRefs, String description, String onInvalidStr) {
-        this.name = name;
-        this.allowedRegExp  = Collections.unmodifiableList(allowedRegexp3);
-        this.allowedValues = Collections.unmodifiableList(allowedValue);
-        this.shorthandRefs = Collections.unmodifiableList(shortHandRefs);
-    }
+  private final List<String> shorthandRefs;
 
-	/**
-	 * Return a <code>List</code> of allowed regular expressions
-	 * @return The List of allowed regular expressions.
-	 */
-	public List<Pattern> getAllowedRegExp() {
-		return allowedRegExp;
-	}
+  public Property(
+      String name,
+      List<Pattern> allowedRegexp3,
+      List<String> allowedValue,
+      List<String> shortHandRefs,
+      String description,
+      String onInvalidStr) {
+    this.name = name;
+    this.allowedRegExp = Collections.unmodifiableList(allowedRegexp3);
+    this.allowedValues = Collections.unmodifiableList(allowedValue);
+    this.shorthandRefs = Collections.unmodifiableList(shortHandRefs);
+  }
 
-	/**
-	 * Return a <code>List</code> of allowed literal values
-	 * @return The List of allowed literal values.
-	 */
-	public List<String> getAllowedValues() {
-		return allowedValues;
-	}
+  /**
+   * Return a <code>List</code> of allowed regular expressions
+   *
+   * @return The List of allowed regular expressions.
+   */
+  public List<Pattern> getAllowedRegExp() {
+    return allowedRegExp;
+  }
 
-	/**
-	 * Return a <code>List</code> of allowed shorthand references
-	 * @return The List of allowed shorthand references.
-	 */
-	public List<String> getShorthandRefs() {
-		return shorthandRefs;
-	}
+  /**
+   * Return a <code>List</code> of allowed literal values
+   *
+   * @return The List of allowed literal values.
+   */
+  public List<String> getAllowedValues() {
+    return allowedValues;
+  }
 
-	/**
-	 * Get the name of the property.
-	 * @return The name of the property.
-	 */
-	public String getName() {
-		return name;
-	}
+  /**
+   * Return a <code>List</code> of allowed shorthand references
+   *
+   * @return The List of allowed shorthand references.
+   */
+  public List<String> getShorthandRefs() {
+    return shorthandRefs;
+  }
 
+  /**
+   * Get the name of the property.
+   *
+   * @return The name of the property.
+   */
+  public String getName() {
+    return name;
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/model/Tag.java b/src/main/java/org/owasp/validator/html/model/Tag.java
index e6643a17..fef0af6c 100644
--- a/src/main/java/org/owasp/validator/html/model/Tag.java
+++ b/src/main/java/org/owasp/validator/html/model/Tag.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -27,129 +27,131 @@
 import java.util.*;
 
 /**
- * A model for HTML "tags" and the rules dictating their validation/filtration. Also contains information
- * about their allowed attributes.
- * <br><br>
- * There is also some experimental (unused) code in here for generating a valid regular expression according to a policy
- * file on a per-tag basis.
+ * A model for HTML "tags" and the rules dictating their validation/filtration. Also contains
+ * information about their allowed attributes. <br>
+ * <br>
+ * There is also some experimental (unused) code in here for generating a valid regular expression
+ * according to a policy file on a per-tag basis.
  *
  * @author Arshan Dabirsiaghi
  */
 public class Tag {
 
-    /*
-     * These are the fields pulled from the policy XML.
-     */
-    private final Map<String, Attribute> allowedAttributes;
-    private final String name;
-    private final String action;
-
+  /*
+   * These are the fields pulled from the policy XML.
+   */
+  private final Map<String, Attribute> allowedAttributes;
+  private final String name;
+  private final String action;
+
+  public Tag(String name, Map<String, Attribute> tagAttributes, String action) {
+    this.name = name;
+    this.allowedAttributes = Collections.unmodifiableMap(tagAttributes);
+    this.action = action;
+  }
+
+  /**
+   * @return The action for this tag which is one of <code>filter</code>, <code>validate</code> or
+   *     <code>remove</code>.
+   */
+  public String getAction() {
+    return action;
+  }
+
+  /**
+   * Indicates if the action for this tag matches the supplied action
+   *
+   * @param action The action to match against
+   * @return True if it matches
+   */
+  public boolean isAction(String action) {
+    return action.equals(this.action);
+  }
+
+  public Tag mutateAction(String action) {
+    return new Tag(this.name, this.allowedAttributes, action);
+  }
+
+  /* --------------------------------------------------------------------------------------------------*/
+
+  /**
+   * Returns a regular expression for validating individual tags. Not used by the AntiSamy scanner,
+   * but you might find some use for this.
+   *
+   * @return A regular expression for the tag, i.e., <code>"^&lt;b&gt;$"</code> or <code>
+   *     "&lt;hr(\s)*(width='((\w){2,3}(\%)*)'&gt;"</code>
+   */
+  public String getRegularExpression() {
 
-    public Tag(String name, Map<String, Attribute> tagAttributes, String action) {
-        this.name = name;
-        this.allowedAttributes = Collections.unmodifiableMap(tagAttributes);
-        this.action = action;
-    }
-
-    /**
-     * @return The action for this tag which is one of <code>filter</code>, <code>validate</code> or <code>remove</code>.
+    /*
+     * For such tags as <b>, <i>, <u>
      */
-    public String getAction() {
-        return action;
+    if (allowedAttributes.size() == 0) {
+      return "^<" + name + ">$";
     }
 
-    /** Indicates if the action for this tag matches the supplied action
-     * @param action The action to match against
-     * @return True if it matches
-     */
-    public boolean isAction(String action){
-        return action.equals( this.action);
+    StringBuilder regExp =
+        new StringBuilder("<" + ANY_NORMAL_WHITESPACES + name + OPEN_TAG_ATTRIBUTES);
+
+    List<Attribute> values = new ArrayList<Attribute>(allowedAttributes.values());
+    Collections.sort(
+        values,
+        new Comparator<Attribute>() {
+          public int compare(Attribute o1, Attribute o2) {
+            return o1.getName().compareTo(o2.getName());
+          }
+        });
+    Iterator<Attribute> attributes = values.iterator();
+    while (attributes.hasNext()) {
+      Attribute attr = attributes.next();
+      regExp.append(attr.matcherRegEx(attributes.hasNext()));
     }
 
-    public Tag mutateAction(String action) {
-        return new Tag(this.name, this.allowedAttributes, action);
-    }
+    regExp.append(CLOSE_TAG_ATTRIBUTES + ANY_NORMAL_WHITESPACES + ">");
 
+    return regExp.toString();
+  }
 
-    /* --------------------------------------------------------------------------------------------------*/
+  static String escapeRegularExpressionCharacters(String allowedValue) {
 
+    String toReturn = allowedValue;
 
-    /**
-     * Returns a regular expression for validating individual tags. Not used by the AntiSamy scanner, but you might find some use for this.
-     *
-     * @return A regular expression for the tag, i.e., 
-     * <code>"^&lt;b&gt;$"</code> 
-     * or <code>"&lt;hr(\s)*(width='((\w){2,3}(\%)*)'&gt;"</code>
-     */
-    public String getRegularExpression() {
-
-        /*
-           * For such tags as <b>, <i>, <u>
-           */
-        if (allowedAttributes.size() == 0) {
-            return "^<" + name + ">$";
-        }
-
-        StringBuilder regExp = new StringBuilder("<" + ANY_NORMAL_WHITESPACES + name + OPEN_TAG_ATTRIBUTES);
-
-        List<Attribute> values = new ArrayList<Attribute>(allowedAttributes.values());
-        Collections.sort(values, new Comparator<Attribute>() {
-            public int compare(Attribute o1, Attribute o2) {
-                return o1.getName().compareTo(o2.getName());
-            }
-        } );
-        Iterator<Attribute> attributes = values.iterator();
-        while (attributes.hasNext()) {
-            Attribute attr = attributes.next();
-            regExp.append( attr.matcherRegEx(attributes.hasNext()));
-        }
-
-        regExp.append(CLOSE_TAG_ATTRIBUTES + ANY_NORMAL_WHITESPACES + ">");
-
-        return regExp.toString();
+    if (toReturn == null) {
+      return null;
     }
 
-    static String escapeRegularExpressionCharacters(String allowedValue) {
-
-        String toReturn = allowedValue;
-
-        if (toReturn == null) {
-            return null;
-        }
-
-        for (int i = 0; i < REGEXP_CHARACTERS.length(); i++) {
-            toReturn = toReturn.replaceAll("\\" + String.valueOf(REGEXP_CHARACTERS.charAt(i)), "\\" + REGEXP_CHARACTERS.charAt(i));
-        }
-
-        return toReturn;
+    for (int i = 0; i < REGEXP_CHARACTERS.length(); i++) {
+      toReturn =
+          toReturn.replaceAll(
+              "\\" + String.valueOf(REGEXP_CHARACTERS.charAt(i)),
+              "\\" + REGEXP_CHARACTERS.charAt(i));
     }
 
-    /**
-     * Begin Variables Needed For Generating Regular Expressions *
-     */
-    final static String ANY_NORMAL_WHITESPACES = "(\\s)*";
-    final static String OPEN_ATTRIBUTE = "(";
-    final static String ATTRIBUTE_DIVIDER = "|";
-    final static String CLOSE_ATTRIBUTE = ")";
-    private final static String OPEN_TAG_ATTRIBUTES = ANY_NORMAL_WHITESPACES + OPEN_ATTRIBUTE;
-    private final static String CLOSE_TAG_ATTRIBUTES = ")*";
-    private final static String REGEXP_CHARACTERS = "\\(){}.*?$^-+";
-
-    /**
-     * @return The String name of the tag.
-     */
-    public String getName() {
-        return name;
-    }
-
-
-    /**
-     * Returns an <code>Attribute</code> associated with a lookup name.
-     *
-     * @param name The name of the allowed attribute by name.
-     * @return The <code>Attribute</code> object associated with the name, or
-     */
-    public Attribute getAttributeByName(String name) {
-        return allowedAttributes.get(name);
-    }
+    return toReturn;
+  }
+
+  /** Begin Variables Needed For Generating Regular Expressions * */
+  static final String ANY_NORMAL_WHITESPACES = "(\\s)*";
+
+  static final String OPEN_ATTRIBUTE = "(";
+  static final String ATTRIBUTE_DIVIDER = "|";
+  static final String CLOSE_ATTRIBUTE = ")";
+  private static final String OPEN_TAG_ATTRIBUTES = ANY_NORMAL_WHITESPACES + OPEN_ATTRIBUTE;
+  private static final String CLOSE_TAG_ATTRIBUTES = ")*";
+  private static final String REGEXP_CHARACTERS = "\\(){}.*?$^-+";
+
+  /** @return The String name of the tag. */
+  public String getName() {
+    return name;
+  }
+
+  /**
+   * Returns an <code>Attribute</code> associated with a lookup name.
+   *
+   * @param name The name of the allowed attribute by name.
+   * @return The <code>Attribute</code> object associated with the name, or
+   */
+  public Attribute getAttributeByName(String name) {
+    return allowedAttributes.get(name);
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java b/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java
index f0a2ff69..a7ba50ee 100644
--- a/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java
+++ b/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java
@@ -1,5 +1,7 @@
 package org.owasp.validator.html.scan;
 
+import java.io.IOException;
+import java.io.Writer;
 import org.apache.xml.serialize.ElementState;
 import org.apache.xml.serialize.HTMLdtd;
 import org.apache.xml.serialize.OutputFormat;
@@ -7,82 +9,72 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import java.io.IOException;
-import java.io.Writer;
-
 @SuppressWarnings("deprecation")
 public class ASHTMLSerializer extends org.apache.xml.serialize.HTMLSerializer {
 
-	private static final Logger logger = LoggerFactory.getLogger(ASHTMLSerializer.class);
-	private boolean encodeAllPossibleEntities;
+  private static final Logger logger = LoggerFactory.getLogger(ASHTMLSerializer.class);
+  private boolean encodeAllPossibleEntities;
+
+  public ASHTMLSerializer(Writer w, OutputFormat format, InternalPolicy policy) {
+    super(w, format);
+    this.encodeAllPossibleEntities = policy.isEntityEncodeIntlCharacters();
+  }
+
+  protected String getEntityRef(int charToPrint) {
+    if (encodeAllPossibleEntities || Constants.big5CharsToEncode.indexOf(charToPrint) != -1)
+      return super.getEntityRef(charToPrint);
+    return null;
+  }
 
-    public ASHTMLSerializer(Writer w, OutputFormat format, InternalPolicy policy) {
-		super(w, format);
-		this.encodeAllPossibleEntities = policy.isEntityEncodeIntlCharacters();
-	}
-	
-	protected String getEntityRef(int charToPrint) {
-		if(encodeAllPossibleEntities || Constants.big5CharsToEncode.indexOf(charToPrint) != -1)
-			return super.getEntityRef(charToPrint);
-		return null;
-	}
+  public void endElementIO(String namespaceURI, String localName, String rawName)
+      throws IOException {
 
-	public void endElementIO(String namespaceURI, String localName,
-			String rawName) throws IOException {
-		
-		ElementState state;
+    ElementState state;
 
-		// Works much like content() with additions for closing
-		// an element. Note the different checks for the closed
-		// element's state and the parent element's state.
-		_printer.unindent();
-		state = getElementState();
+    // Works much like content() with additions for closing
+    // an element. Note the different checks for the closed
+    // element's state and the parent element's state.
+    _printer.unindent();
+    state = getElementState();
 
-        if (state.empty)
-			_printer.printText('>');
-		// This element is not empty and that last content was
-		// another element, so print a line break before that
-		// last element and this element's closing tag.
-		// [keith] Provided this is not an anchor.
-		// HTML: some elements do not print closing tag (e.g. LI)
-		if (rawName == null || !HTMLdtd.isOnlyOpening(rawName) || HTMLdtd.isOptionalClosing(rawName)) {
-			if (_indenting && !state.preserveSpace && state.afterElement)
-				_printer.breakLine();
-			// Must leave CData section first (Illegal in HTML, but still)
-			if (state.inCData)
-				_printer.printText("]]>");
-			_printer.printText("</");
-			_printer.printText(state.rawName);
-			_printer.printText('>');
-		}
-		
-		// Leave the element state and update that of the parent
-		// (if we're not root) to not empty and after element.
-		state = leaveElementState();
-		// Temporary hack to prevent line breaks inside A/TD
-		if (rawName == null
-				|| (!rawName.equalsIgnoreCase("A") && !rawName
-						.equalsIgnoreCase("TD")))
+    if (state.empty) _printer.printText('>');
+    // This element is not empty and that last content was
+    // another element, so print a line break before that
+    // last element and this element's closing tag.
+    // [keith] Provided this is not an anchor.
+    // HTML: some elements do not print closing tag (e.g. LI)
+    if (rawName == null || !HTMLdtd.isOnlyOpening(rawName) || HTMLdtd.isOptionalClosing(rawName)) {
+      if (_indenting && !state.preserveSpace && state.afterElement) _printer.breakLine();
+      // Must leave CData section first (Illegal in HTML, but still)
+      if (state.inCData) _printer.printText("]]>");
+      _printer.printText("</");
+      _printer.printText(state.rawName);
+      _printer.printText('>');
+    }
 
-			state.afterElement = true;
-		state.empty = false;
-		if (isDocumentState())
-			_printer.flush();
-	}
+    // Leave the element state and update that of the parent
+    // (if we're not root) to not empty and after element.
+    state = leaveElementState();
+    // Temporary hack to prevent line breaks inside A/TD
+    if (rawName == null || (!rawName.equalsIgnoreCase("A") && !rawName.equalsIgnoreCase("TD")))
+      state.afterElement = true;
+    state.empty = false;
+    if (isDocumentState()) _printer.flush();
+  }
 
-	/*
-		The override is to use printEscaped() which already escapes entity references
-		 and writes them in the final serialized string. As escapeURI() is called like
-		 "printer.printText(escapeURI(value))", if the URI is returned here it would
-		 be double-printed and that is why the return value is an empty string.
-	 */
-	@Override
-	protected String escapeURI(String uri) {
-		try {
-			printEscaped(uri);
-		} catch (IOException e) {
-			logger.error("URI escaping failed for value: " + uri);
-		}
-		return "";
-	}
+  /*
+  The override is to use printEscaped() which already escapes entity references
+   and writes them in the final serialized string. As escapeURI() is called like
+   "printer.printText(escapeURI(value))", if the URI is returned here it would
+   be double-printed and that is why the return value is an empty string.
+  */
+  @Override
+  protected String escapeURI(String uri) {
+    try {
+      printEscaped(uri);
+    } catch (IOException e) {
+      logger.error("URI escaping failed for value: " + uri);
+    }
+    return "";
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java b/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java
index cd81e5a3..df53199b 100644
--- a/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AbstractAntiSamyScanner.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -30,9 +30,7 @@
 import java.util.Locale;
 import java.util.MissingResourceException;
 import java.util.ResourceBundle;
-
 import org.apache.xml.serialize.OutputFormat;
-
 import org.owasp.validator.html.CleanResults;
 import org.owasp.validator.html.InternalPolicy;
 import org.owasp.validator.html.Policy;
@@ -42,74 +40,75 @@
 
 public abstract class AbstractAntiSamyScanner {
 
-    protected final InternalPolicy policy;
-    protected final List<String> errorMessages = new ArrayList<String>();
+  protected final InternalPolicy policy;
+  protected final List<String> errorMessages = new ArrayList<String>();
 
-    protected static final ResourceBundle messages = getResourceBundle();
-    protected final Locale locale = Locale.getDefault();
+  protected static final ResourceBundle messages = getResourceBundle();
+  protected final Locale locale = Locale.getDefault();
 
-    protected boolean isNofollowAnchors = false;
-    protected boolean isNoopenerAndNoreferrerAnchors = false;
-    protected boolean isValidateParamAsEmbed = false;
+  protected boolean isNofollowAnchors = false;
+  protected boolean isNoopenerAndNoreferrerAnchors = false;
+  protected boolean isValidateParamAsEmbed = false;
 
-    public abstract CleanResults scan(String html) throws ScanException;
+  public abstract CleanResults scan(String html) throws ScanException;
 
-    public abstract CleanResults getResults();
+  public abstract CleanResults getResults();
 
-    public AbstractAntiSamyScanner(Policy policy) {
-        assert policy instanceof InternalPolicy : policy.getClass();
-        this.policy = (InternalPolicy) policy;
-    }
+  public AbstractAntiSamyScanner(Policy policy) {
+    assert policy instanceof InternalPolicy : policy.getClass();
+    this.policy = (InternalPolicy) policy;
+  }
 
-    public AbstractAntiSamyScanner() throws PolicyException {
-        policy = (InternalPolicy) Policy.getInstance();
-    }
+  public AbstractAntiSamyScanner() throws PolicyException {
+    policy = (InternalPolicy) Policy.getInstance();
+  }
 
-    private static ResourceBundle getResourceBundle() {
-        try {
-            return ResourceBundle.getBundle("AntiSamy", Locale.getDefault());
-        } catch (MissingResourceException mre) {
-            return  ResourceBundle.getBundle("AntiSamy", new Locale(Constants.DEFAULT_LOCALE_LANG,
-                        Constants.DEFAULT_LOCALE_LOC));
-        }
+  private static ResourceBundle getResourceBundle() {
+    try {
+      return ResourceBundle.getBundle("AntiSamy", Locale.getDefault());
+    } catch (MissingResourceException mre) {
+      return ResourceBundle.getBundle(
+          "AntiSamy", new Locale(Constants.DEFAULT_LOCALE_LANG, Constants.DEFAULT_LOCALE_LOC));
     }
+  }
 
-    protected void addError(String errorKey, Object[] objs) {
-        errorMessages.add(ErrorMessageUtil.getMessage(messages, errorKey, objs));
-    }
-
-    protected OutputFormat getOutputFormat() {
+  protected void addError(String errorKey, Object[] objs) {
+    errorMessages.add(ErrorMessageUtil.getMessage(messages, errorKey, objs));
+  }
 
-        OutputFormat format = new OutputFormat();
-        format.setOmitXMLDeclaration(policy.isOmitXmlDeclaration());
-        format.setOmitDocumentType(policy.isOmitDoctypeDeclaration());
-        format.setPreserveEmptyAttributes(true);
-        format.setPreserveSpace(policy.isPreserveSpace());
+  protected OutputFormat getOutputFormat() {
 
-        if (policy.isFormatOutput()) {
-            format.setLineWidth(80);
-            format.setIndenting(true);
-            format.setIndent(2);
-        }
+    OutputFormat format = new OutputFormat();
+    format.setOmitXMLDeclaration(policy.isOmitXmlDeclaration());
+    format.setOmitDocumentType(policy.isOmitDoctypeDeclaration());
+    format.setPreserveEmptyAttributes(true);
+    format.setPreserveSpace(policy.isPreserveSpace());
 
-        return format;
+    if (policy.isFormatOutput()) {
+      format.setLineWidth(80);
+      format.setIndenting(true);
+      format.setIndent(2);
     }
 
-    protected org.apache.xml.serialize.HTMLSerializer getHTMLSerializer(Writer w, OutputFormat format) {
-        return new ASHTMLSerializer(w, format, policy);
-    }
-
-    protected String trim(String original, String cleaned) {
-        if (cleaned.endsWith("\n")) {
-            if (!original.endsWith("\n")) {
-                if (cleaned.endsWith("\r\n")) {
-                    cleaned = cleaned.substring(0, cleaned.length() - 2);
-                } else if (cleaned.endsWith("\n")) {
-                    cleaned = cleaned.substring(0, cleaned.length() - 1);
-                }
-            }
+    return format;
+  }
+
+  protected org.apache.xml.serialize.HTMLSerializer getHTMLSerializer(
+      Writer w, OutputFormat format) {
+    return new ASHTMLSerializer(w, format, policy);
+  }
+
+  protected String trim(String original, String cleaned) {
+    if (cleaned.endsWith("\n")) {
+      if (!original.endsWith("\n")) {
+        if (cleaned.endsWith("\r\n")) {
+          cleaned = cleaned.substring(0, cleaned.length() - 2);
+        } else if (cleaned.endsWith("\n")) {
+          cleaned = cleaned.substring(0, cleaned.length() - 1);
         }
-
-        return cleaned;
+      }
     }
+
+    return cleaned;
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java b/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
index 6c25ad4c..66812ae6 100644
--- a/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
@@ -23,9 +23,18 @@
  */
 package org.owasp.validator.html.scan;
 
+import java.io.IOException;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.util.List;
+import java.util.Queue;
+import java.util.concurrent.Callable;
+import java.util.concurrent.ConcurrentLinkedQueue;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import net.sourceforge.htmlunit.cyberneko.parsers.DOMFragmentParser;
 import org.apache.batik.css.parser.ParseException;
 import org.apache.xerces.dom.DocumentImpl;
-import net.sourceforge.htmlunit.cyberneko.parsers.DOMFragmentParser;
 import org.owasp.validator.css.CssScanner;
 import org.owasp.validator.html.CleanResults;
 import org.owasp.validator.html.Policy;
@@ -50,747 +59,801 @@
 import org.xml.sax.SAXNotRecognizedException;
 import org.xml.sax.SAXNotSupportedException;
 
-import java.io.IOException;
-import java.io.StringReader;
-import java.io.StringWriter;
-import java.util.List;
-import java.util.Queue;
-import java.util.concurrent.Callable;
-import java.util.concurrent.ConcurrentLinkedQueue;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
 /**
- * This is where the magic lives. All the scanning/filtration logic resides
- * here, but it should not be called directly. All scanning should be done
- * through an <code>AntiSamy.scan()</code> method.
- * 
+ * This is where the magic lives. All the scanning/filtration logic resides here, but it should not
+ * be called directly. All scanning should be done through an <code>AntiSamy.scan()</code> method.
+ *
  * @author Arshan Dabirsiaghi
  */
 public class AntiSamyDOMScanner extends AbstractAntiSamyScanner {
-    private Document document = new DocumentImpl();
-    private DocumentFragment dom = document.createDocumentFragment();
-    private CleanResults results = null;
-    private static final int maxDepth = 250;
-    private static final Pattern invalidXmlCharacters =
-            Pattern.compile("[\\u0000-\\u001F\\uD800-\\uDFFF\\uFFFE-\\uFFFF&&[^\\u0009\\u000A\\u000D]]");
-    private static final Pattern conditionalDirectives = Pattern.compile("<?!?\\[\\s*(?:end)?if[^]]*\\]>?");
-
-    private static final Queue<CachedItem> cachedItems = new ConcurrentLinkedQueue<CachedItem>();
-
-    static class CachedItem {
-        private final DOMFragmentParser parser;
-        private final Matcher invalidXmlCharMatcher = invalidXmlCharacters.matcher("");
-
-
-        CachedItem() throws SAXNotSupportedException, SAXNotRecognizedException {
-            this.parser = getDomParser();
-        }
-
-        DOMFragmentParser getDomFragmentParser()  {
-            return parser;
-        }
+  private Document document = new DocumentImpl();
+  private DocumentFragment dom = document.createDocumentFragment();
+  private CleanResults results = null;
+  private static final int maxDepth = 250;
+  private static final Pattern invalidXmlCharacters =
+      Pattern.compile("[\\u0000-\\u001F\\uD800-\\uDFFF\\uFFFE-\\uFFFF&&[^\\u0009\\u000A\\u000D]]");
+  private static final Pattern conditionalDirectives =
+      Pattern.compile("<?!?\\[\\s*(?:end)?if[^]]*\\]>?");
+
+  private static final Queue<CachedItem> cachedItems = new ConcurrentLinkedQueue<CachedItem>();
+
+  static class CachedItem {
+    private final DOMFragmentParser parser;
+    private final Matcher invalidXmlCharMatcher = invalidXmlCharacters.matcher("");
+
+    CachedItem() throws SAXNotSupportedException, SAXNotRecognizedException {
+      this.parser = getDomParser();
     }
 
-    public AntiSamyDOMScanner(Policy policy) {
-        super(policy);
+    DOMFragmentParser getDomFragmentParser() {
+      return parser;
     }
-
-    /* UnusedDeclaration TODO Investigate */
-    public AntiSamyDOMScanner() throws PolicyException {
-        super();
+  }
+
+  public AntiSamyDOMScanner(Policy policy) {
+    super(policy);
+  }
+
+  /* UnusedDeclaration TODO Investigate */
+  public AntiSamyDOMScanner() throws PolicyException {
+    super();
+  }
+
+  /**
+   * This is where the magic lives.
+   *
+   * @param html A String whose contents we want to scan.
+   * @return A <code>CleanResults</code> object with an <code>XMLDocumentFragment</code> object and
+   *     its String representation, as well as some scan statistics.
+   * @throws ScanException When there is a problem encountered while scanning the HTML.
+   */
+  @Override
+  public CleanResults scan(String html) throws ScanException {
+
+    if (html == null) {
+      throw new ScanException(new NullPointerException("Null HTML input"));
     }
 
-    /**
-     * This is where the magic lives.
-     *
-     * @param html A String whose contents we want to scan.
-     * @return A <code>CleanResults</code> object with an
-     *         <code>XMLDocumentFragment</code> object and its String
-     *         representation, as well as some scan statistics.
-     * @throws ScanException When there is a problem encountered
-	 *         while scanning the HTML.
-	 */
-    @Override
-    public CleanResults scan(String html) throws ScanException {
-
-        if (html == null) {
-            throw new ScanException(new NullPointerException("Null HTML input"));
-        }
+    errorMessages.clear();
+    int maxInputSize = policy.getMaxInputSize();
 
-        errorMessages.clear();
-        int maxInputSize = policy.getMaxInputSize();
+    if (maxInputSize < html.length()) {
+      addError(ErrorMessageUtil.ERROR_INPUT_SIZE, new Object[] {html.length(), maxInputSize});
+      throw new ScanException(errorMessages.get(0));
+    }
 
-        if (maxInputSize < html.length()) {
-            addError(ErrorMessageUtil.ERROR_INPUT_SIZE, new Object[]{html.length(), maxInputSize});
-            throw new ScanException(errorMessages.get(0));
-        }
+    isNofollowAnchors = policy.isNofollowAnchors();
+    isNoopenerAndNoreferrerAnchors = policy.isNoopenerAndNoreferrerAnchors();
+    isValidateParamAsEmbed = policy.isValidateParamAsEmbed();
 
-        isNofollowAnchors = policy.isNofollowAnchors();
-        isNoopenerAndNoreferrerAnchors = policy.isNoopenerAndNoreferrerAnchors();
-        isValidateParamAsEmbed = policy.isValidateParamAsEmbed();
+    long startOfScan = System.currentTimeMillis();
 
-        long startOfScan = System.currentTimeMillis();
+    try {
 
-        try {
+      CachedItem cachedItem;
+      cachedItem = cachedItems.poll();
+      if (cachedItem == null) {
+        cachedItem = new CachedItem();
+      }
 
-            CachedItem cachedItem;
-            cachedItem = cachedItems.poll();
-            if (cachedItem == null){
-                cachedItem = new CachedItem();
-            }
+      /*
+       * We have to replace any invalid XML characters to prevent NekoHTML
+       * from breaking when it gets passed encodings like %21.
+       */
 
-            /*
-             * We have to replace any invalid XML characters to prevent NekoHTML
-             * from breaking when it gets passed encodings like %21.
-             */
+      html = stripNonValidXMLCharacters(html, cachedItem.invalidXmlCharMatcher);
 
-            html = stripNonValidXMLCharacters(html, cachedItem.invalidXmlCharMatcher);
+      /*
+       * First thing we do is call the HTML cleaner ("NekoHTML") on it
+       * with the appropriate options. We choose not to omit tags due to
+       * the fallibility of our own listing in the ever changing world of
+       * W3C.
+       */
 
-            /*
-             * First thing we do is call the HTML cleaner ("NekoHTML") on it
-             * with the appropriate options. We choose not to omit tags due to
-             * the fallibility of our own listing in the ever changing world of
-             * W3C.
-             */
+      DOMFragmentParser parser = cachedItem.getDomFragmentParser();
 
-            DOMFragmentParser parser = cachedItem.getDomFragmentParser();
+      try {
+        parser.parse(new InputSource(new StringReader(html)), dom);
+      } catch (Exception e) {
+        throw new ScanException(e);
+      }
 
-            try {
-                parser.parse(new InputSource(new StringReader(html)), dom);
-            } catch (Exception e) {
-                throw new ScanException(e);
-            }
+      processChildren(dom, 0);
 
-            processChildren(dom, 0);
+      /*
+       * Serialize the output and then return the resulting DOM object and
+       * its string representation.
+       */
 
-            /*
-             * Serialize the output and then return the resulting DOM object and
-             * its string representation.
-             */
-
-            final String trimmedHtml = html;
-
-            StringWriter out = new StringWriter();
+      final String trimmedHtml = html;
 
-            @SuppressWarnings("deprecation")
-            org.apache.xml.serialize.OutputFormat format = getOutputFormat();
+      StringWriter out = new StringWriter();
 
-            //noinspection deprecation
-            org.apache.xml.serialize.HTMLSerializer serializer = getHTMLSerializer(out, format);
-            serializer.serialize(dom);
+      @SuppressWarnings("deprecation")
+      org.apache.xml.serialize.OutputFormat format = getOutputFormat();
 
-            /*
-             * Get the String out of the StringWriter and rip out the XML
-             * declaration if the Policy says we should.
-             */
-            final String trimmed = trim( trimmedHtml, out.getBuffer().toString() );
+      //noinspection deprecation
+      org.apache.xml.serialize.HTMLSerializer serializer = getHTMLSerializer(out, format);
+      serializer.serialize(dom);
 
-            Callable<String> cleanHtml = new Callable<String>() {
-                public String call() throws Exception {
-                    return trimmed;
-                }
-            };
+      /*
+       * Get the String out of the StringWriter and rip out the XML
+       * declaration if the Policy says we should.
+       */
+      final String trimmed = trim(trimmedHtml, out.getBuffer().toString());
 
-            /*
-             * Return the DOM object as well as string HTML.
-             */
-            results = new CleanResults(startOfScan, cleanHtml, dom, errorMessages);
+      Callable<String> cleanHtml =
+          new Callable<String>() {
+            public String call() throws Exception {
+              return trimmed;
+            }
+          };
 
-            cachedItems.add( cachedItem);
-            return results;
+      /*
+       * Return the DOM object as well as string HTML.
+       */
+      results = new CleanResults(startOfScan, cleanHtml, dom, errorMessages);
 
-        } catch (SAXException | IOException e) {
-            throw new ScanException(e);
-        }
+      cachedItems.add(cachedItem);
+      return results;
 
+    } catch (SAXException | IOException e) {
+      throw new ScanException(e);
     }
+  }
 
-    static DOMFragmentParser getDomParser()
-            throws SAXNotRecognizedException, SAXNotSupportedException {
-        DOMFragmentParser parser = new DOMFragmentParser();
-        parser.setProperty("http://cyberneko.org/html/properties/names/elems", "lower");
+  static DOMFragmentParser getDomParser()
+      throws SAXNotRecognizedException, SAXNotSupportedException {
+    DOMFragmentParser parser = new DOMFragmentParser();
+    parser.setProperty("http://cyberneko.org/html/properties/names/elems", "lower");
 
-        parser.setFeature("http://cyberneko.org/html/features/scanner/style/strip-cdata-delims", false);
-        parser.setFeature("http://cyberneko.org/html/features/scanner/cdata-sections", true);
+    parser.setFeature("http://cyberneko.org/html/features/scanner/style/strip-cdata-delims", false);
+    parser.setFeature("http://cyberneko.org/html/features/scanner/cdata-sections", true);
 
-        try {
-            parser.setFeature("http://cyberneko.org/html/features/enforce-strict-attribute-names", true);
-        } catch (SAXNotRecognizedException se) {
-            // this indicates that the patched nekohtml is not on the
-            // classpath
-        }
-        return parser;
+    try {
+      parser.setFeature("http://cyberneko.org/html/features/enforce-strict-attribute-names", true);
+    } catch (SAXNotRecognizedException se) {
+      // this indicates that the patched nekohtml is not on the
+      // classpath
     }
+    return parser;
+  }
 
-    /**
-     * The workhorse of the scanner. Recursively scans document elements
-     * according to the policy. This should be called implicitly through the
-     * AntiSamy.scan() method.
-     *
-     * @param node The node to validate.
-     */
-    private void recursiveValidateTag(final Node node, int currentStackDepth) throws ScanException {
-
-        currentStackDepth++;
-
-        if(currentStackDepth > maxDepth) {
-            throw new ScanException("Too many nested tags");
-        }
-
-        if (node instanceof Comment) {
-            processCommentNode(node);
-            return;
-        }
-
-        boolean isElement = node instanceof Element;
-        NodeList eleChildNodes = node.getChildNodes();
-        if (isElement && eleChildNodes.getLength() == 0) {
-            if (removeDisallowedEmpty(node)){
-                return;
-            }
-        }
-
-        if (node instanceof Text && Node.CDATA_SECTION_NODE == node.getNodeType()) {
-            stripCData(node);
-            return;
-        }
-
-        if (node instanceof ProcessingInstruction) {
-            removePI(node);
-        }
-
-        if (!isElement) {
-            return;
-        }
-
-        final Element ele = (Element) node;
-        final Node parentNode = ele.getParentNode();
+  /**
+   * The workhorse of the scanner. Recursively scans document elements according to the policy. This
+   * should be called implicitly through the AntiSamy.scan() method.
+   *
+   * @param node The node to validate.
+   */
+  private void recursiveValidateTag(final Node node, int currentStackDepth) throws ScanException {
 
-        final String tagName = ele.getNodeName();
-        final String tagNameLowerCase = tagName.toLowerCase();
-        Tag tagRule = policy.getTagByLowercaseName(tagNameLowerCase);
+    currentStackDepth++;
 
-        /*
-         * If <param> and no policy and isValidateParamAsEmbed and policy in
-         * place for <embed> and <embed> policy is to validate, use custom
-         * policy to get the tag through to the validator.
-         */
-        Tag embedTag = policy.getEmbedTag();
-        boolean masqueradingParam = isMasqueradingParam(tagRule, embedTag, tagNameLowerCase);
-        if (masqueradingParam){
-            tagRule = Constants.BASIC_PARAM_TAG_RULE;
-        }
-
-        if ((tagRule == null && policy.isEncodeUnknownTag()) || (tagRule != null && tagRule.isAction( "encode"))) {
-            encodeTag(currentStackDepth, ele, tagName, eleChildNodes);
-        } else if (tagRule == null || tagRule.isAction( Policy.ACTION_FILTER)) {
-            actionFilter(currentStackDepth, ele, tagName, tagRule, eleChildNodes);
-        } else if (tagRule.isAction( Policy.ACTION_VALIDATE)) {
-            actionValidate(currentStackDepth, ele, parentNode, tagName, tagNameLowerCase, tagRule, masqueradingParam, embedTag, eleChildNodes);
-        } else if (tagRule.isAction( Policy.ACTION_TRUNCATE)) {
-            actionTruncate(ele, tagName, eleChildNodes);
-        } else {
-            /*
-             * If we reached this that means that the tag's action is "remove",
-             * which means to remove the tag (including its contents).
-             */
-            addError(ErrorMessageUtil.ERROR_TAG_DISALLOWED, new Object[]{HTMLEntityEncoder.htmlEntityEncode(tagName)});
-            removeNode(ele);
-        }
+    if (currentStackDepth > maxDepth) {
+      throw new ScanException("Too many nested tags");
     }
 
-    private boolean isMasqueradingParam(Tag tagRule, Tag embedTag, String tagNameLowerCase){
-        if (tagRule == null && isValidateParamAsEmbed && "param".equals(tagNameLowerCase)) {
-            return embedTag != null && embedTag.isAction(Policy.ACTION_VALIDATE);
-        }
-        return false;
+    if (node instanceof Comment) {
+      processCommentNode(node);
+      return;
     }
 
-    private void encodeTag(int currentStackDepth, Element ele, String tagName, NodeList eleChildNodes) throws ScanException {
-        addError(ErrorMessageUtil.ERROR_TAG_ENCODED, new Object[]{HTMLEntityEncoder.htmlEntityEncode(tagName)});
-        processChildren(eleChildNodes, currentStackDepth);
-
-   /*
-    * Transform the tag to text, HTML-encode it and promote the
-    * children. The tag will be kept in the fragment as one or two text
-    * Nodes located before and after the children; representing how the
-    * tag used to wrap them.
-    */
-
-        encodeAndPromoteChildren(ele);
+    boolean isElement = node instanceof Element;
+    NodeList eleChildNodes = node.getChildNodes();
+    if (isElement && eleChildNodes.getLength() == 0) {
+      if (removeDisallowedEmpty(node)) {
+        return;
+      }
     }
 
-    private void actionFilter(int currentStackDepth, Element ele, String tagName, Tag tag, NodeList eleChildNodes) throws ScanException {
-        if (tag == null) {
-            addError(ErrorMessageUtil.ERROR_TAG_NOT_IN_POLICY, new Object[]{HTMLEntityEncoder.htmlEntityEncode(tagName)});
-        } else {
-            addError(ErrorMessageUtil.ERROR_TAG_FILTERED, new Object[]{HTMLEntityEncoder.htmlEntityEncode(tagName)});
-        }
-
-        processChildren(eleChildNodes, currentStackDepth);
-        promoteChildren(ele);
-    }
-
-    private void actionValidate(int currentStackDepth, Element ele, Node parentNode, String tagName, String tagNameLowerCase, Tag tag, boolean masqueradingParam, Tag embedTag, NodeList eleChildNodes) throws ScanException {
-   /*
-    * If doing <param> as <embed>, now is the time to convert it.
-    */
-        String nameValue = null;
-        if (masqueradingParam) {
-            nameValue = ele.getAttribute("name");
-            if (nameValue != null && !"".equals(nameValue)) {
-                String valueValue = ele.getAttribute("value");
-                ele.setAttribute(nameValue, valueValue);
-                ele.removeAttribute("name");
-                ele.removeAttribute("value");
-                tag = embedTag;
-            }
-        }
-
-   /*
-    * Check to see if it's a <style> tag. We have to special case this
-    * tag so we can hand it off to the custom style sheet validating
-    * parser.
-    */
-
-        if ("style".equals(tagNameLowerCase) && policy.getStyleTag() != null) {
-            if (processStyleTag(ele, parentNode)) return;
-        }
-
-   /*
-    * Go through the attributes in the tainted tag and validate them
-    * against the values we have for them.
-    *
-    * If we don't have a rule for the attribute we remove the
-    * attribute.
-    */
-
-        if (processAttributes(ele, tagName, tag, currentStackDepth)) return; // can't process any more if we
-
-        if ("a".equals(tagNameLowerCase)) {
-            boolean addNofollow = isNofollowAnchors;
-            boolean addNoopenerAndNoreferrer = false;
-
-            if (isNoopenerAndNoreferrerAnchors) {
-                Node targetAttribute = ele.getAttributes().getNamedItem("target");
-                if (targetAttribute != null && targetAttribute.getNodeValue().equalsIgnoreCase("_blank")) {
-                    addNoopenerAndNoreferrer = true;
-                }
-            }
-
-            Node relAttribute = ele.getAttributes().getNamedItem("rel");
-            String relValue = Attribute.mergeRelValuesInAnchor(addNofollow, addNoopenerAndNoreferrer, relAttribute == null ? "" : relAttribute.getNodeValue());
-            if (!relValue.isEmpty()){
-                ele.setAttribute("rel", relValue.trim());
-            }
-        }
-
-        processChildren(eleChildNodes, currentStackDepth);
-
-   /*
-    * If we have been dealing with a <param> that has been converted to
-    * an <embed>, convert it back
-    */
-        if (masqueradingParam && nameValue != null && !"".equals(nameValue)) {
-            String valueValue = ele.getAttribute(nameValue);
-            ele.setAttribute("name", nameValue);
-            ele.setAttribute("value", valueValue);
-            ele.removeAttribute(nameValue);
-        }
+    if (node instanceof Text && Node.CDATA_SECTION_NODE == node.getNodeType()) {
+      stripCData(node);
+      return;
     }
 
-    private boolean processStyleTag(Element ele, Node parentNode) {
-        /*
-         * Invoke the css parser on this element.
-         */
-        CssScanner styleScanner = new CssScanner(policy, messages, policy.isEmbedStyleSheets());
-
-        try {
-            int childNodesCount = ele.getChildNodes().getLength();
-            if (childNodesCount > 0) {
-                StringBuffer toScan = new StringBuffer();
-
-                for (int i = 0; i < ele.getChildNodes().getLength(); i++) {
-                    Node childNode = ele.getChildNodes().item(i);
-                    if (toScan.length() > 0) {
-                        toScan.append("\n");
-                    }
-                    toScan.append(childNode.getTextContent());
-                }
-
-                CleanResults cr = styleScanner.scanStyleSheet(toScan.toString(), policy.getMaxInputSize());
-                errorMessages.addAll(cr.getErrorMessages());
-
-                /*
-                 * If IE gets an empty style tag, i.e. <style/> it will
-                 * break all CSS on the page. I wish I was kidding. So,
-                 * if after validation no CSS properties are left, we
-                 * would normally be left with an empty style tag and
-                 * break all CSS. To prevent that, we have this check.
-                 */
-                String cleanHTML = cr.getCleanHTML();
-                cleanHTML = cleanHTML == null || cleanHTML.equals("") ? "/* */" : cleanHTML;
-
-                ele.getFirstChild().setNodeValue(cleanHTML);
-                /*
-                 * Remove every other node after cleaning CSS, there will
-                 * be only one node in the end, as it always should have.
-                 * Starting from the end due to list updating on the fly.
-                 */
-                for (int i = childNodesCount - 1; i >= 1; i--) {
-                    Node childNode = ele.getChildNodes().item(i);
-                    ele.removeChild(childNode);
-                }
-            }
-        } catch (DOMException | ScanException | ParseException | NumberFormatException e) {
-            /*
-             * ParseException shouldn't be possible anymore, but we'll leave it
-             * here because I (Arshan) am hilariously dumb sometimes.
-             * Batik can throw NumberFormatExceptions (see bug #48).
-             */
-            addError(ErrorMessageUtil.ERROR_CSS_TAG_MALFORMED, new Object[]{HTMLEntityEncoder.htmlEntityEncode(ele.getFirstChild().getNodeValue())});
-            parentNode.removeChild(ele);
-            return true;
-        }
-        return false;
+    if (node instanceof ProcessingInstruction) {
+      removePI(node);
     }
 
-    private void actionTruncate(Element ele, String tagName, NodeList eleChildNodes) {
-   /*
-    * Remove all attributes. This is for tags like i, b, u, etc. Purely
-    * formatting without any need for attributes. It also removes any
-    * children.
-    */
-
-        NamedNodeMap nnmap = ele.getAttributes();
-        while (nnmap.getLength() > 0) {
-            addError(ErrorMessageUtil.ERROR_ATTRIBUTE_NOT_IN_POLICY,
-                new Object[]{tagName, HTMLEntityEncoder.htmlEntityEncode(nnmap.item(0).getNodeName())});
-            ele.removeAttribute(nnmap.item(0).getNodeName());
-        }
-
-        int i = 0;
-        int j = 0;
-        int length = eleChildNodes.getLength();
-
-        while (i < length) {
-            Node nodeToRemove = eleChildNodes.item(j);
-            if (nodeToRemove.getNodeType() != Node.TEXT_NODE) {
-                ele.removeChild(nodeToRemove);
-            } else {
-                j++;
-            }
-            i++;
-        }
+    if (!isElement) {
+      return;
     }
 
-    private boolean processAttributes(Element ele, String tagName, Tag tag, int currentStackDepth) throws ScanException {
-        Node attribute;
+    final Element ele = (Element) node;
+    final Node parentNode = ele.getParentNode();
 
-        NamedNodeMap attributes = ele.getAttributes();
-        for (int currentAttributeIndex = 0; currentAttributeIndex < attributes.getLength(); currentAttributeIndex++) {
+    final String tagName = ele.getNodeName();
+    final String tagNameLowerCase = tagName.toLowerCase();
+    Tag tagRule = policy.getTagByLowercaseName(tagNameLowerCase);
 
-            attribute = attributes.item(currentAttributeIndex);
+    /*
+     * If <param> and no policy and isValidateParamAsEmbed and policy in
+     * place for <embed> and <embed> policy is to validate, use custom
+     * policy to get the tag through to the validator.
+     */
+    Tag embedTag = policy.getEmbedTag();
+    boolean masqueradingParam = isMasqueradingParam(tagRule, embedTag, tagNameLowerCase);
+    if (masqueradingParam) {
+      tagRule = Constants.BASIC_PARAM_TAG_RULE;
+    }
 
-            String name = attribute.getNodeName();
-            String value = attribute.getNodeValue();
+    if ((tagRule == null && policy.isEncodeUnknownTag())
+        || (tagRule != null && tagRule.isAction("encode"))) {
+      encodeTag(currentStackDepth, ele, tagName, eleChildNodes);
+    } else if (tagRule == null || tagRule.isAction(Policy.ACTION_FILTER)) {
+      actionFilter(currentStackDepth, ele, tagName, tagRule, eleChildNodes);
+    } else if (tagRule.isAction(Policy.ACTION_VALIDATE)) {
+      actionValidate(
+          currentStackDepth,
+          ele,
+          parentNode,
+          tagName,
+          tagNameLowerCase,
+          tagRule,
+          masqueradingParam,
+          embedTag,
+          eleChildNodes);
+    } else if (tagRule.isAction(Policy.ACTION_TRUNCATE)) {
+      actionTruncate(ele, tagName, eleChildNodes);
+    } else {
+      /*
+       * If we reached this that means that the tag's action is "remove",
+       * which means to remove the tag (including its contents).
+       */
+      addError(
+          ErrorMessageUtil.ERROR_TAG_DISALLOWED,
+          new Object[] {HTMLEntityEncoder.htmlEntityEncode(tagName)});
+      removeNode(ele);
+    }
+  }
 
-            Attribute attr = tag.getAttributeByName(name.toLowerCase());
+  private boolean isMasqueradingParam(Tag tagRule, Tag embedTag, String tagNameLowerCase) {
+    if (tagRule == null && isValidateParamAsEmbed && "param".equals(tagNameLowerCase)) {
+      return embedTag != null && embedTag.isAction(Policy.ACTION_VALIDATE);
+    }
+    return false;
+  }
+
+  private void encodeTag(int currentStackDepth, Element ele, String tagName, NodeList eleChildNodes)
+      throws ScanException {
+    addError(
+        ErrorMessageUtil.ERROR_TAG_ENCODED,
+        new Object[] {HTMLEntityEncoder.htmlEntityEncode(tagName)});
+    processChildren(eleChildNodes, currentStackDepth);
+
+    /*
+     * Transform the tag to text, HTML-encode it and promote the
+     * children. The tag will be kept in the fragment as one or two text
+     * Nodes located before and after the children; representing how the
+     * tag used to wrap them.
+     */
 
-            /*
-             * If we there isn't an attribute by that name in our policy
-             * check to see if it's a globally defined attribute. Validate
-             * against that if so.
-             */
-            if (attr == null) {
-                attr = policy.getGlobalAttributeByName(name);
-                if (attr == null && policy.isAllowDynamicAttributes()) {
-                    // not a global attribute, perhaps it is a dynamic attribute, if allowed
-                    attr = policy.getDynamicAttributeByName(name);
-                }
-            }
+    encodeAndPromoteChildren(ele);
+  }
+
+  private void actionFilter(
+      int currentStackDepth, Element ele, String tagName, Tag tag, NodeList eleChildNodes)
+      throws ScanException {
+    if (tag == null) {
+      addError(
+          ErrorMessageUtil.ERROR_TAG_NOT_IN_POLICY,
+          new Object[] {HTMLEntityEncoder.htmlEntityEncode(tagName)});
+    } else {
+      addError(
+          ErrorMessageUtil.ERROR_TAG_FILTERED,
+          new Object[] {HTMLEntityEncoder.htmlEntityEncode(tagName)});
+    }
 
-            /*
-             * We have to special case the "style" attribute since it's
-             * validated quite differently.
-             */
-            if ("style".equals(name.toLowerCase()) && attr != null) {
+    processChildren(eleChildNodes, currentStackDepth);
+    promoteChildren(ele);
+  }
+
+  private void actionValidate(
+      int currentStackDepth,
+      Element ele,
+      Node parentNode,
+      String tagName,
+      String tagNameLowerCase,
+      Tag tag,
+      boolean masqueradingParam,
+      Tag embedTag,
+      NodeList eleChildNodes)
+      throws ScanException {
+    /*
+     * If doing <param> as <embed>, now is the time to convert it.
+     */
+    String nameValue = null;
+    if (masqueradingParam) {
+      nameValue = ele.getAttribute("name");
+      if (nameValue != null && !"".equals(nameValue)) {
+        String valueValue = ele.getAttribute("value");
+        ele.setAttribute(nameValue, valueValue);
+        ele.removeAttribute("name");
+        ele.removeAttribute("value");
+        tag = embedTag;
+      }
+    }
 
-                /*
-                 * Invoke the CSS parser on this element.
-                 */
-                CssScanner styleScanner = new CssScanner(policy, messages, false);
+    /*
+     * Check to see if it's a <style> tag. We have to special case this
+     * tag so we can hand it off to the custom style sheet validating
+     * parser.
+     */
 
-                try {
-                    CleanResults cr = styleScanner.scanInlineStyle(value, tagName, policy.getMaxInputSize());
-                    attribute.setNodeValue(cr.getCleanHTML());
-                    List<String> cssScanErrorMessages = cr.getErrorMessages();
-                    errorMessages.addAll(cssScanErrorMessages);
+    if ("style".equals(tagNameLowerCase) && policy.getStyleTag() != null) {
+      if (processStyleTag(ele, parentNode)) return;
+    }
 
-                } catch (DOMException | ScanException e) {
+    /*
+     * Go through the attributes in the tainted tag and validate them
+     * against the values we have for them.
+     *
+     * If we don't have a rule for the attribute we remove the
+     * attribute.
+     */
 
-                    addError(ErrorMessageUtil.ERROR_CSS_ATTRIBUTE_MALFORMED,
-                        new Object[]{tagName, HTMLEntityEncoder.htmlEntityEncode(ele.getNodeValue())});
-                    ele.removeAttribute(attribute.getNodeName());
-                    currentAttributeIndex--;
-                }
+    if (processAttributes(ele, tagName, tag, currentStackDepth))
+      return; // can't process any more if we
+
+    if ("a".equals(tagNameLowerCase)) {
+      boolean addNofollow = isNofollowAnchors;
+      boolean addNoopenerAndNoreferrer = false;
+
+      if (isNoopenerAndNoreferrerAnchors) {
+        Node targetAttribute = ele.getAttributes().getNamedItem("target");
+        if (targetAttribute != null && targetAttribute.getNodeValue().equalsIgnoreCase("_blank")) {
+          addNoopenerAndNoreferrer = true;
+        }
+      }
+
+      Node relAttribute = ele.getAttributes().getNamedItem("rel");
+      String relValue =
+          Attribute.mergeRelValuesInAnchor(
+              addNofollow,
+              addNoopenerAndNoreferrer,
+              relAttribute == null ? "" : relAttribute.getNodeValue());
+      if (!relValue.isEmpty()) {
+        ele.setAttribute("rel", relValue.trim());
+      }
+    }
 
-            } else {
+    processChildren(eleChildNodes, currentStackDepth);
 
-                if (attr != null) {
+    /*
+     * If we have been dealing with a <param> that has been converted to
+     * an <embed>, convert it back
+     */
+    if (masqueradingParam && nameValue != null && !"".equals(nameValue)) {
+      String valueValue = ele.getAttribute(nameValue);
+      ele.setAttribute("name", nameValue);
+      ele.setAttribute("value", valueValue);
+      ele.removeAttribute(nameValue);
+    }
+  }
 
-                    // See if attribute is invalid
-                    if (!(attr.containsAllowedValue( value.toLowerCase()) ||
-                         (attr.matchesAllowedExpression( value ))) ) {
+  private boolean processStyleTag(Element ele, Node parentNode) {
+    /*
+     * Invoke the css parser on this element.
+     */
+    CssScanner styleScanner = new CssScanner(policy, messages, policy.isEmbedStyleSheets());
 
-                        /*
-                         * Attribute is NOT valid, so: Document transgression and perform the
-                         * "onInvalid" action. The default action is to
-                         * strip the attribute and leave the rest intact.
-                         */
+    try {
+      int childNodesCount = ele.getChildNodes().getLength();
+      if (childNodesCount > 0) {
+        StringBuffer toScan = new StringBuffer();
 
-                        String onInvalidAction = attr.getOnInvalid();
+        for (int i = 0; i < ele.getChildNodes().getLength(); i++) {
+          Node childNode = ele.getChildNodes().item(i);
+          if (toScan.length() > 0) {
+            toScan.append("\n");
+          }
+          toScan.append(childNode.getTextContent());
+        }
 
-                        if ("removeTag".equals(onInvalidAction)) {
+        CleanResults cr = styleScanner.scanStyleSheet(toScan.toString(), policy.getMaxInputSize());
+        errorMessages.addAll(cr.getErrorMessages());
 
-                            /*
-                             * Remove the tag and its contents.
-                             */
+        /*
+         * If IE gets an empty style tag, i.e. <style/> it will
+         * break all CSS on the page. I wish I was kidding. So,
+         * if after validation no CSS properties are left, we
+         * would normally be left with an empty style tag and
+         * break all CSS. To prevent that, we have this check.
+         */
+        String cleanHTML = cr.getCleanHTML();
+        cleanHTML = cleanHTML == null || cleanHTML.equals("") ? "/* */" : cleanHTML;
 
-                            removeNode(ele);
+        ele.getFirstChild().setNodeValue(cleanHTML);
+        /*
+         * Remove every other node after cleaning CSS, there will
+         * be only one node in the end, as it always should have.
+         * Starting from the end due to list updating on the fly.
+         */
+        for (int i = childNodesCount - 1; i >= 1; i--) {
+          Node childNode = ele.getChildNodes().item(i);
+          ele.removeChild(childNode);
+        }
+      }
+    } catch (DOMException | ScanException | ParseException | NumberFormatException e) {
+      /*
+       * ParseException shouldn't be possible anymore, but we'll leave it
+       * here because I (Arshan) am hilariously dumb sometimes.
+       * Batik can throw NumberFormatExceptions (see bug #48).
+       */
+      addError(
+          ErrorMessageUtil.ERROR_CSS_TAG_MALFORMED,
+          new Object[] {HTMLEntityEncoder.htmlEntityEncode(ele.getFirstChild().getNodeValue())});
+      parentNode.removeChild(ele);
+      return true;
+    }
+    return false;
+  }
+
+  private void actionTruncate(Element ele, String tagName, NodeList eleChildNodes) {
+    /*
+     * Remove all attributes. This is for tags like i, b, u, etc. Purely
+     * formatting without any need for attributes. It also removes any
+     * children.
+     */
 
-                            addError(ErrorMessageUtil.ERROR_ATTRIBUTE_INVALID_REMOVED,
-                              new Object[]{tagName, HTMLEntityEncoder.htmlEntityEncode(name), HTMLEntityEncoder.htmlEntityEncode(value)});
-                            return true;
+    NamedNodeMap nnmap = ele.getAttributes();
+    while (nnmap.getLength() > 0) {
+      addError(
+          ErrorMessageUtil.ERROR_ATTRIBUTE_NOT_IN_POLICY,
+          new Object[] {tagName, HTMLEntityEncoder.htmlEntityEncode(nnmap.item(0).getNodeName())});
+      ele.removeAttribute(nnmap.item(0).getNodeName());
+    }
 
-                        } else if ("filterTag".equals(onInvalidAction)) {
+    int i = 0;
+    int j = 0;
+    int length = eleChildNodes.getLength();
+
+    while (i < length) {
+      Node nodeToRemove = eleChildNodes.item(j);
+      if (nodeToRemove.getNodeType() != Node.TEXT_NODE) {
+        ele.removeChild(nodeToRemove);
+      } else {
+        j++;
+      }
+      i++;
+    }
+  }
 
-                            /*
-                             * Remove the attribute and keep the rest of the tag.
-                             */
+  private boolean processAttributes(Element ele, String tagName, Tag tag, int currentStackDepth)
+      throws ScanException {
+    Node attribute;
 
-                            processChildren(ele, currentStackDepth);
-                            promoteChildren(ele);
-                            addError(ErrorMessageUtil.ERROR_ATTRIBUTE_CAUSE_FILTER,
-                              new Object[]{tagName, HTMLEntityEncoder.htmlEntityEncode(name), HTMLEntityEncoder.htmlEntityEncode(value)});
-                            return true;
-                        } else if ("encodeTag".equals(onInvalidAction)) {
+    NamedNodeMap attributes = ele.getAttributes();
+    for (int currentAttributeIndex = 0;
+        currentAttributeIndex < attributes.getLength();
+        currentAttributeIndex++) {
 
-                            /*
-                             * Remove the attribute and keep the rest of the tag.
-                             */
+      attribute = attributes.item(currentAttributeIndex);
 
-                            processChildren(ele, currentStackDepth);
-                            encodeAndPromoteChildren(ele);
-                            addError(ErrorMessageUtil.ERROR_ATTRIBUTE_CAUSE_ENCODE,
-                              new Object[]{tagName, HTMLEntityEncoder.htmlEntityEncode(name), HTMLEntityEncoder.htmlEntityEncode(value)});
-                            return true;
-                        } else {
+      String name = attribute.getNodeName();
+      String value = attribute.getNodeValue();
 
-                            /*
-                             * onInvalidAction = "removeAttribute"
-                             */
+      Attribute attr = tag.getAttributeByName(name.toLowerCase());
 
-                            ele.removeAttribute(attribute.getNodeName());
-                            currentAttributeIndex--;
-                            addError(ErrorMessageUtil.ERROR_ATTRIBUTE_INVALID,
-                              new Object[]{tagName, HTMLEntityEncoder.htmlEntityEncode(name), HTMLEntityEncoder.htmlEntityEncode(value)});
-                            
-                        }
-                    }
+      /*
+       * If we there isn't an attribute by that name in our policy
+       * check to see if it's a globally defined attribute. Validate
+       * against that if so.
+       */
+      if (attr == null) {
+        attr = policy.getGlobalAttributeByName(name);
+        if (attr == null && policy.isAllowDynamicAttributes()) {
+          // not a global attribute, perhaps it is a dynamic attribute, if allowed
+          attr = policy.getDynamicAttributeByName(name);
+        }
+      }
 
-                } else {
-                    /*
-                     * the attribute they specified isn't in our policy
-                     * - remove it (whitelisting!)
-                     */
+      /*
+       * We have to special case the "style" attribute since it's
+       * validated quite differently.
+       */
+      if ("style".equals(name.toLowerCase()) && attr != null) {
 
-                    addError(ErrorMessageUtil.ERROR_ATTRIBUTE_NOT_IN_POLICY,
-                      new Object[]{tagName, HTMLEntityEncoder.htmlEntityEncode(name), HTMLEntityEncoder.htmlEntityEncode(value)});
-                    ele.removeAttribute(attribute.getNodeName());
-                    currentAttributeIndex--;
+        /*
+         * Invoke the CSS parser on this element.
+         */
+        CssScanner styleScanner = new CssScanner(policy, messages, false);
 
-                } // end if attribute is found in policy file
+        try {
+          CleanResults cr = styleScanner.scanInlineStyle(value, tagName, policy.getMaxInputSize());
+          attribute.setNodeValue(cr.getCleanHTML());
+          List<String> cssScanErrorMessages = cr.getErrorMessages();
+          errorMessages.addAll(cssScanErrorMessages);
 
-            } // end while loop through attributes
+        } catch (DOMException | ScanException e) {
 
-        } // loop through each attribute
-        return false;
-    }
+          addError(
+              ErrorMessageUtil.ERROR_CSS_ATTRIBUTE_MALFORMED,
+              new Object[] {tagName, HTMLEntityEncoder.htmlEntityEncode(ele.getNodeValue())});
+          ele.removeAttribute(attribute.getNodeName());
+          currentAttributeIndex--;
+        }
 
-    private void processChildren(Node ele, int currentStackDepth) throws ScanException {
-        processChildren(ele.getChildNodes(), currentStackDepth);
-    }
+      } else {
 
-    private void processChildren(NodeList childNodes, int currentStackDepth ) throws ScanException {
-        Node tmp;
-        for (int i = 0; i < childNodes.getLength(); i++) {
+        if (attr != null) {
 
-            tmp = childNodes.item(i);
-            recursiveValidateTag(tmp, currentStackDepth);
+          // See if attribute is invalid
+          if (!(attr.containsAllowedValue(value.toLowerCase())
+              || (attr.matchesAllowedExpression(value)))) {
 
             /*
-             * This indicates the node was removed/failed validation.
+             * Attribute is NOT valid, so: Document transgression and perform the
+             * "onInvalid" action. The default action is to
+             * strip the attribute and leave the rest intact.
              */
-            if (tmp.getParentNode() == null) {
-                i--;
-            }
-        }
-    }
 
-    private void removePI(Node node) {
-        addError(ErrorMessageUtil.ERROR_PI_FOUND, new Object[]{HTMLEntityEncoder.htmlEntityEncode(node.getTextContent())});
-        removeNode(node);
-    }
+            String onInvalidAction = attr.getOnInvalid();
+
+            if ("removeTag".equals(onInvalidAction)) {
+
+              /*
+               * Remove the tag and its contents.
+               */
+
+              removeNode(ele);
+
+              addError(
+                  ErrorMessageUtil.ERROR_ATTRIBUTE_INVALID_REMOVED,
+                  new Object[] {
+                    tagName,
+                    HTMLEntityEncoder.htmlEntityEncode(name),
+                    HTMLEntityEncoder.htmlEntityEncode(value)
+                  });
+              return true;
+
+            } else if ("filterTag".equals(onInvalidAction)) {
+
+              /*
+               * Remove the attribute and keep the rest of the tag.
+               */
+
+              processChildren(ele, currentStackDepth);
+              promoteChildren(ele);
+              addError(
+                  ErrorMessageUtil.ERROR_ATTRIBUTE_CAUSE_FILTER,
+                  new Object[] {
+                    tagName,
+                    HTMLEntityEncoder.htmlEntityEncode(name),
+                    HTMLEntityEncoder.htmlEntityEncode(value)
+                  });
+              return true;
+            } else if ("encodeTag".equals(onInvalidAction)) {
+
+              /*
+               * Remove the attribute and keep the rest of the tag.
+               */
+
+              processChildren(ele, currentStackDepth);
+              encodeAndPromoteChildren(ele);
+              addError(
+                  ErrorMessageUtil.ERROR_ATTRIBUTE_CAUSE_ENCODE,
+                  new Object[] {
+                    tagName,
+                    HTMLEntityEncoder.htmlEntityEncode(name),
+                    HTMLEntityEncoder.htmlEntityEncode(value)
+                  });
+              return true;
+            } else {
 
-    private void stripCData(Node node) {
-        addError(ErrorMessageUtil.ERROR_CDATA_FOUND, new Object[]{HTMLEntityEncoder.htmlEntityEncode(node.getTextContent())});
-        Node text = document.createTextNode(node.getTextContent());
-        node.getParentNode().insertBefore(text, node);
-        node.getParentNode().removeChild(node);
-    }
+              /*
+               * onInvalidAction = "removeAttribute"
+               */
+
+              ele.removeAttribute(attribute.getNodeName());
+              currentAttributeIndex--;
+              addError(
+                  ErrorMessageUtil.ERROR_ATTRIBUTE_INVALID,
+                  new Object[] {
+                    tagName,
+                    HTMLEntityEncoder.htmlEntityEncode(name),
+                    HTMLEntityEncoder.htmlEntityEncode(value)
+                  });
+            }
+          }
 
-    private void processCommentNode(Node node) {
-        if (!policy.isPreserveComments()) {
-            node.getParentNode().removeChild(node);
         } else {
-            String value = ((Comment) node).getData();
-            // Strip conditional directives regardless of the
-            // PRESERVE_COMMENTS setting.
-            if (value != null) {
-                ((Comment) node).setData(conditionalDirectives.matcher(value).replaceAll(""));
-            }
-        }
+          /*
+           * the attribute they specified isn't in our policy
+           * - remove it (whitelisting!)
+           */
+
+          addError(
+              ErrorMessageUtil.ERROR_ATTRIBUTE_NOT_IN_POLICY,
+              new Object[] {
+                tagName,
+                HTMLEntityEncoder.htmlEntityEncode(name),
+                HTMLEntityEncoder.htmlEntityEncode(value)
+              });
+          ele.removeAttribute(attribute.getNodeName());
+          currentAttributeIndex--;
+        } // end if attribute is found in policy file
+      } // end while loop through attributes
+    } // loop through each attribute
+    return false;
+  }
+
+  private void processChildren(Node ele, int currentStackDepth) throws ScanException {
+    processChildren(ele.getChildNodes(), currentStackDepth);
+  }
+
+  private void processChildren(NodeList childNodes, int currentStackDepth) throws ScanException {
+    Node tmp;
+    for (int i = 0; i < childNodes.getLength(); i++) {
+
+      tmp = childNodes.item(i);
+      recursiveValidateTag(tmp, currentStackDepth);
+
+      /*
+       * This indicates the node was removed/failed validation.
+       */
+      if (tmp.getParentNode() == null) {
+        i--;
+      }
     }
-
-    private boolean removeDisallowedEmpty(Node node){
-        String tagName = node.getNodeName();
-
-        if (!isAllowedEmptyTag(tagName)) {
-           /*
-            * Wasn't in the list of allowed elements, so we'll nuke it.
-            */
-            addError(ErrorMessageUtil.ERROR_TAG_EMPTY, new Object[]{HTMLEntityEncoder.htmlEntityEncode(node.getNodeName())});
-            removeNode(node);
-            return true;
-        }
-        return false;
-    }
-
-    private void removeNode(Node node) {
-		Node parent = node.getParentNode();
-		parent.removeChild(node);
-		String tagName = parent.getNodeName();
-		if(	parent instanceof Element && 
-			parent.getChildNodes().getLength() == 0 && 
-			!isAllowedEmptyTag(tagName)) {
-			removeNode(parent);
-		}
-	}
-
-	private boolean isAllowedEmptyTag(String tagName) {
-        return "head".equals(tagName ) || policy.getAllowedEmptyTags().matches(tagName);
-	}
-	
-    /**
-     * Used to promote the children of a parent to accomplish the "filterTag" action.
-     *
-     * @param ele The Element we want to filter.
-     */
-    private void promoteChildren(Element ele) {
-        promoteChildren(ele, ele.getChildNodes());
+  }
+
+  private void removePI(Node node) {
+    addError(
+        ErrorMessageUtil.ERROR_PI_FOUND,
+        new Object[] {HTMLEntityEncoder.htmlEntityEncode(node.getTextContent())});
+    removeNode(node);
+  }
+
+  private void stripCData(Node node) {
+    addError(
+        ErrorMessageUtil.ERROR_CDATA_FOUND,
+        new Object[] {HTMLEntityEncoder.htmlEntityEncode(node.getTextContent())});
+    Node text = document.createTextNode(node.getTextContent());
+    node.getParentNode().insertBefore(text, node);
+    node.getParentNode().removeChild(node);
+  }
+
+  private void processCommentNode(Node node) {
+    if (!policy.isPreserveComments()) {
+      node.getParentNode().removeChild(node);
+    } else {
+      String value = ((Comment) node).getData();
+      // Strip conditional directives regardless of the
+      // PRESERVE_COMMENTS setting.
+      if (value != null) {
+        ((Comment) node).setData(conditionalDirectives.matcher(value).replaceAll(""));
+      }
     }
+  }
+
+  private boolean removeDisallowedEmpty(Node node) {
+    String tagName = node.getNodeName();
+
+    if (!isAllowedEmptyTag(tagName)) {
+      /*
+       * Wasn't in the list of allowed elements, so we'll nuke it.
+       */
+      addError(
+          ErrorMessageUtil.ERROR_TAG_EMPTY,
+          new Object[] {HTMLEntityEncoder.htmlEntityEncode(node.getNodeName())});
+      removeNode(node);
+      return true;
+    }
+    return false;
+  }
+
+  private void removeNode(Node node) {
+    Node parent = node.getParentNode();
+    parent.removeChild(node);
+    String tagName = parent.getNodeName();
+    if (parent instanceof Element
+        && parent.getChildNodes().getLength() == 0
+        && !isAllowedEmptyTag(tagName)) {
+      removeNode(parent);
+    }
+  }
 
-    private void promoteChildren(Element ele, NodeList eleChildNodes) {
-
-        Node parent = ele.getParentNode();
+  private boolean isAllowedEmptyTag(String tagName) {
+    return "head".equals(tagName) || policy.getAllowedEmptyTags().matches(tagName);
+  }
 
-        while (eleChildNodes.getLength() > 0) {
-            Node node = ele.removeChild(eleChildNodes.item(0));
-            parent.insertBefore(node, ele);
-        }
+  /**
+   * Used to promote the children of a parent to accomplish the "filterTag" action.
+   *
+   * @param ele The Element we want to filter.
+   */
+  private void promoteChildren(Element ele) {
+    promoteChildren(ele, ele.getChildNodes());
+  }
 
-        if (parent != null) {
-            removeNode(ele);
-        }
-    }
+  private void promoteChildren(Element ele, NodeList eleChildNodes) {
 
-    /**
-     * This method was borrowed from Mark McLaren, to whom I owe much beer.
-     *
-     * This method ensures that the output has only valid XML unicode characters
-     * as specified by the XML 1.0 standard. For reference, please see <a
-     * href="http://www.w3.org/TR/2000/REC-xml-20001006#NT-Char">the
-     * standard</a>. This method will return an empty String if the input is
-     * null or empty.
-     *
-     * @param in The String whose non-valid characters we want to remove.
-     * @param invalidXmlCharsMatcher  The reusable regex matcher
-     * @return The in String, stripped of non-valid characters.
-     */
-    private String stripNonValidXMLCharacters(String in, Matcher invalidXmlCharsMatcher) {
+    Node parent = ele.getParentNode();
 
-        if (in == null || ("".equals(in))) {
-            return ""; // vacancy test.
-        }
-        invalidXmlCharsMatcher.reset(in);
-        return invalidXmlCharsMatcher.matches() ? invalidXmlCharsMatcher.replaceAll("") : in;
+    while (eleChildNodes.getLength() > 0) {
+      Node node = ele.removeChild(eleChildNodes.item(0));
+      parent.insertBefore(node, ele);
     }
 
-    /**
-     * Transform the element to text, HTML-encode it and promote the children.
-     * The element will be kept in the fragment as one or two text Nodes located
-     * before and after the children; representing how the tag used to wrap
-     * them. If the element didn't have any children then only one text Node is
-     * created representing an empty element.
-     *
-     * @param ele Element to be encoded
-     */
-    private void encodeAndPromoteChildren(Element ele) {
-        Node parent = ele.getParentNode();
-        String tagName = ele.getTagName();
-        Node openingTag = parent.getOwnerDocument().createTextNode(toString(ele));
-        parent.insertBefore(openingTag, ele);
-        if (ele.hasChildNodes()) {
-            Node closingTag = parent.getOwnerDocument().createTextNode("</" + tagName + ">");
-            parent.insertBefore(closingTag, ele.getNextSibling());
-        }
-        promoteChildren(ele);
+    if (parent != null) {
+      removeNode(ele);
     }
-
-    /**
-     * Returns a text version of the passed element
-     *
-     * @param ele Element to be converted
-     * @return String representation of the element
-     */
-    private String toString(Element ele) {
-        StringBuilder eleAsString = new StringBuilder("<" + ele.getNodeName());
-        NamedNodeMap attributes = ele.getAttributes();
-        Node attribute;
-        for (int i = 0; i < attributes.getLength(); i++) {
-            attribute = attributes.item(i);
-
-            String name = attribute.getNodeName();
-            String value = attribute.getNodeValue();
-
-            eleAsString.append(" ");
-            eleAsString.append(HTMLEntityEncoder.htmlEntityEncode(name));
-            eleAsString.append("=\"");
-            eleAsString.append(HTMLEntityEncoder.htmlEntityEncode(value));
-            eleAsString.append("\"");
-        }
-        if (ele.hasChildNodes()) {
-            eleAsString.append(">");
-        } else {
-            eleAsString.append("/>");
-        }
-        return eleAsString.toString();
+  }
+
+  /**
+   * This method was borrowed from Mark McLaren, to whom I owe much beer.
+   *
+   * <p>This method ensures that the output has only valid XML unicode characters as specified by
+   * the XML 1.0 standard. For reference, please see <a
+   * href="http://www.w3.org/TR/2000/REC-xml-20001006#NT-Char">the standard</a>. This method will
+   * return an empty String if the input is null or empty.
+   *
+   * @param in The String whose non-valid characters we want to remove.
+   * @param invalidXmlCharsMatcher The reusable regex matcher
+   * @return The in String, stripped of non-valid characters.
+   */
+  private String stripNonValidXMLCharacters(String in, Matcher invalidXmlCharsMatcher) {
+
+    if (in == null || ("".equals(in))) {
+      return ""; // vacancy test.
     }
-
-    @Override
-    public CleanResults getResults() {
-        return results;
+    invalidXmlCharsMatcher.reset(in);
+    return invalidXmlCharsMatcher.matches() ? invalidXmlCharsMatcher.replaceAll("") : in;
+  }
+
+  /**
+   * Transform the element to text, HTML-encode it and promote the children. The element will be
+   * kept in the fragment as one or two text Nodes located before and after the children;
+   * representing how the tag used to wrap them. If the element didn't have any children then only
+   * one text Node is created representing an empty element.
+   *
+   * @param ele Element to be encoded
+   */
+  private void encodeAndPromoteChildren(Element ele) {
+    Node parent = ele.getParentNode();
+    String tagName = ele.getTagName();
+    Node openingTag = parent.getOwnerDocument().createTextNode(toString(ele));
+    parent.insertBefore(openingTag, ele);
+    if (ele.hasChildNodes()) {
+      Node closingTag = parent.getOwnerDocument().createTextNode("</" + tagName + ">");
+      parent.insertBefore(closingTag, ele.getNextSibling());
+    }
+    promoteChildren(ele);
+  }
+
+  /**
+   * Returns a text version of the passed element
+   *
+   * @param ele Element to be converted
+   * @return String representation of the element
+   */
+  private String toString(Element ele) {
+    StringBuilder eleAsString = new StringBuilder("<" + ele.getNodeName());
+    NamedNodeMap attributes = ele.getAttributes();
+    Node attribute;
+    for (int i = 0; i < attributes.getLength(); i++) {
+      attribute = attributes.item(i);
+
+      String name = attribute.getNodeName();
+      String value = attribute.getNodeValue();
+
+      eleAsString.append(" ");
+      eleAsString.append(HTMLEntityEncoder.htmlEntityEncode(name));
+      eleAsString.append("=\"");
+      eleAsString.append(HTMLEntityEncoder.htmlEntityEncode(value));
+      eleAsString.append("\"");
     }
+    if (ele.hasChildNodes()) {
+      eleAsString.append(">");
+    } else {
+      eleAsString.append("/>");
+    }
+    return eleAsString.toString();
+  }
+
+  @Override
+  public CleanResults getResults() {
+    return results;
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java b/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java
index da4aba58..de2ba651 100644
--- a/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java
+++ b/src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -31,7 +31,6 @@
 import java.util.Queue;
 import java.util.concurrent.Callable;
 import java.util.concurrent.ConcurrentLinkedQueue;
-
 import javax.xml.XMLConstants;
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
@@ -39,9 +38,8 @@
 import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.sax.SAXResult;
 import javax.xml.transform.sax.SAXSource;
-
-import org.apache.xerces.xni.parser.XMLDocumentFilter;
 import net.sourceforge.htmlunit.cyberneko.parsers.SAXParser;
+import org.apache.xerces.xni.parser.XMLDocumentFilter;
 import org.owasp.validator.html.CleanResults;
 import org.owasp.validator.html.Policy;
 import org.owasp.validator.html.ScanException;
@@ -52,167 +50,175 @@
 
 public class AntiSamySAXScanner extends AbstractAntiSamyScanner {
 
-    private static final Queue<CachedItem> cachedItems = new ConcurrentLinkedQueue<CachedItem>();
-
-    private static final TransformerFactory sTransformerFactory;
+  private static final Queue<CachedItem> cachedItems = new ConcurrentLinkedQueue<CachedItem>();
+
+  private static final TransformerFactory sTransformerFactory;
+
+  static {
+    // Per issue #103, an IllegalArgumentException could be thrown below if the SAX parser does
+    // not
+    // support these JAXP 1.5 features. This did actually occur in certain environments where we
+    // let
+    // the TransformerFactory create whatever instance it decided to create. For example, if
+    // xalan:2.7.2 was on the classpath, which doesn't support these JAXP features.
+    // However, this should never happen anymore because, by default, we now force the use of
+    // the
+    // JDK provided Xalan SAX parser, which DOES support these features. However, if someone
+    // REALLY
+    // wants to use a different implementation, they can set the new property
+    // "antisamy.transformerfactory.impl"
+    // to whatever they prefer to use, but that class must implement the two attributes we set.
+
+    String TRANSFORMER_FACTORY_IMPL =
+        System.getProperty(
+            "antisamy.transformerfactory.impl",
+            "com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl");
+
+    sTransformerFactory = TransformerFactory.newInstance(TRANSFORMER_FACTORY_IMPL, null);
+
+    // Disable external entities, etc.
+    sTransformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+    sTransformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+  }
+
+  static class CachedItem {
+    private final Transformer transformer;
+    private final SAXParser saxParser;
+    private final MagicSAXFilter magicSAXFilter;
+
+    CachedItem(Transformer transformer, SAXParser saxParser, MagicSAXFilter magicSAXFilter) {
+      this.transformer = transformer;
+      this.saxParser = saxParser;
+      this.magicSAXFilter = magicSAXFilter;
+      XMLDocumentFilter[] filters = {magicSAXFilter};
+      try {
+        saxParser.setProperty("http://cyberneko.org/html/properties/filters", filters);
+      } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+        throw new RuntimeException(e);
+      }
+    }
+  }
 
-    static {
-        // Per issue #103, an IllegalArgumentException could be thrown below if the SAX parser does not
-        // support these JAXP 1.5 features. This did actually occur in certain environments where we let
-        // the TransformerFactory create whatever instance it decided to create. For example, if
-        // xalan:2.7.2 was on the classpath, which doesn't support these JAXP features.
-        // However, this should never happen anymore because, by default, we now force the use of the
-        // JDK provided Xalan SAX parser, which DOES support these features. However, if someone REALLY
-        // wants to use a different implementation, they can set the new property "antisamy.transformerfactory.impl"
-        // to whatever they prefer to use, but that class must implement the two attributes we set.
+  public AntiSamySAXScanner(Policy policy) {
+    super(policy);
+  }
 
-        String TRANSFORMER_FACTORY_IMPL = System.getProperty("antisamy.transformerfactory.impl",
-                "com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl");
+  @Override
+  public CleanResults getResults() {
+    return null;
+  }
 
-        sTransformerFactory =
-                TransformerFactory.newInstance(TRANSFORMER_FACTORY_IMPL, null );
+  @Override
+  public CleanResults scan(String html) throws ScanException {
+    return scan(html, this.policy);
+  }
 
-        // Disable external entities, etc.
-        sTransformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
-        sTransformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+  public CleanResults scan(String html, Policy policy) throws ScanException {
+    if (html == null) {
+      throw new ScanException(new NullPointerException("Null html input"));
     }
 
-    static class CachedItem {
-        private final Transformer transformer;
-        private final SAXParser saxParser;
-        private final MagicSAXFilter magicSAXFilter;
-
-        CachedItem(Transformer transformer, SAXParser saxParser, MagicSAXFilter magicSAXFilter)  {
-            this.transformer = transformer;
-            this.saxParser = saxParser;
-            this.magicSAXFilter = magicSAXFilter;
-            XMLDocumentFilter[] filters = { magicSAXFilter };
-            try {
-                saxParser.setProperty("http://cyberneko.org/html/properties/filters", filters);
-            } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
-                throw new RuntimeException(e);
-            }
-        }
-    }
+    int maxInputSize = this.policy.getMaxInputSize();
 
-    public AntiSamySAXScanner(Policy policy) {
-        super(policy);
+    if (html.length() > maxInputSize) {
+      addError(ErrorMessageUtil.ERROR_INPUT_SIZE, new Object[] {html.length(), maxInputSize});
+      throw new ScanException(errorMessages.get(0));
     }
 
-    @Override
-    public CleanResults getResults() {
-        return null;
-    }
+    final StringWriter out = new StringWriter();
+    StringReader reader = new StringReader(html);
 
-    @Override
-    public CleanResults scan(String html) throws ScanException {
-        return scan(html, this.policy);
-    }
-
-    public CleanResults scan(String html, Policy policy) throws ScanException {
-       if (html == null) {
-           throw new ScanException(new NullPointerException("Null html input"));
-       }
-
-       int maxInputSize = this.policy.getMaxInputSize();
-
-       if (html.length() > maxInputSize) {
-           addError(ErrorMessageUtil.ERROR_INPUT_SIZE, new Object[] {html.length(), maxInputSize});
-           throw new ScanException(errorMessages.get(0));
-       }
-       
-        final StringWriter out = new StringWriter();
-        StringReader reader = new StringReader(html);
-
-        CleanResults results = scan(reader, out);
-        final String tainted = html;
-        Callable<String> cleanCallable = new Callable<String>() {
-            public String call() throws Exception {
-                return trim(tainted, out.toString());
-            }
+    CleanResults results = scan(reader, out);
+    final String tainted = html;
+    Callable<String> cleanCallable =
+        new Callable<String>() {
+          public String call() throws Exception {
+            return trim(tainted, out.toString());
+          }
         };
-        return new CleanResults(results.getStartOfScan(), cleanCallable, null, results.getErrorMessages());
+    return new CleanResults(
+        results.getStartOfScan(), cleanCallable, null, results.getErrorMessages());
+  }
+
+  /**
+   * Using a SAX parser, can pass Streams for input and output. Use case is a Servlet filter where
+   * request or response is large and caller does not need the entire string in memory.
+   *
+   * @param reader A Reader which can feed the SAXParser a little input at a time
+   * @param writer A Writer that can take a little output at a time
+   * @return CleanResults where the cleanHtml is null. If a caller wants the HTML as a string, it
+   *     must capture the contents of the writer (i.e., use a StringWriter).
+   * @throws ScanException When there is a problem encountered while scanning the HTML.
+   */
+  public CleanResults scan(Reader reader, Writer writer) throws ScanException {
+    try {
+
+      CachedItem candidateCachedItem = cachedItems.poll();
+      if (candidateCachedItem == null) {
+        candidateCachedItem =
+            new CachedItem(getNewTransformer(), getParser(), new MagicSAXFilter(messages));
+      }
+
+      final CachedItem cachedItem = candidateCachedItem;
+
+      SAXParser parser = cachedItem.saxParser;
+      cachedItem.magicSAXFilter.reset(policy);
+
+      long startOfScan = System.currentTimeMillis();
+
+      final SAXSource source = new SAXSource(parser, new InputSource(reader));
+
+      final Transformer transformer = cachedItem.transformer;
+      boolean formatOutput = policy.isFormatOutput();
+      boolean omitXml = policy.isOmitXmlDeclaration();
+
+      transformer.setOutputProperty(OutputKeys.INDENT, formatOutput ? "yes" : "no");
+      transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, omitXml ? "yes" : "no");
+      transformer.setOutputProperty(OutputKeys.METHOD, "html");
+
+      //noinspection deprecation
+      final org.apache.xml.serialize.OutputFormat format = getOutputFormat();
+      //noinspection deprecation
+      final org.apache.xml.serialize.HTMLSerializer serializer = getHTMLSerializer(writer, format);
+
+      transformer.transform(source, new SAXResult(serializer));
+      errorMessages.clear();
+      errorMessages.addAll(cachedItem.magicSAXFilter.getErrorMessages());
+      cachedItems.add(cachedItem);
+      return new CleanResults(startOfScan, (String) null, null, errorMessages);
+
+    } catch (Exception e) {
+      throw new ScanException(e);
     }
-
-    /**
-     * Using a SAX parser, can pass Streams for input and output.
-     * Use case is a Servlet filter where request or response is large
-     * and caller does not need the entire string in memory.
-     * @param reader A Reader which can feed the SAXParser a little input at a time
-     * @param writer A Writer that can take a little output at a time
-     * @return CleanResults where the cleanHtml is null. If a caller wants the HTML as a string,
-     *         it must capture the contents of the writer (i.e., use a StringWriter).
-     * @throws ScanException When there is a problem encountered
-     *         while scanning the HTML.
-     */
-    public CleanResults scan(Reader reader, Writer writer) throws ScanException {
-        try {
-
-            CachedItem candidateCachedItem = cachedItems.poll();
-            if (candidateCachedItem == null){
-                candidateCachedItem = new CachedItem(getNewTransformer(), getParser(), new MagicSAXFilter(messages));
-            }
-            
-            final CachedItem cachedItem = candidateCachedItem;
-
-            SAXParser parser = cachedItem.saxParser;
-            cachedItem.magicSAXFilter.reset(policy);
-
-            long startOfScan = System.currentTimeMillis();
-
-            final SAXSource source = new SAXSource(parser, new InputSource(reader));
-
-            final Transformer transformer = cachedItem.transformer;
-            boolean formatOutput = policy.isFormatOutput();
-            boolean omitXml = policy.isOmitXmlDeclaration();
-
-            transformer.setOutputProperty(OutputKeys.INDENT, formatOutput ? "yes" : "no");
-            transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, omitXml ? "yes" : "no");
-            transformer.setOutputProperty(OutputKeys.METHOD, "html");
-
-            //noinspection deprecation
-            final org.apache.xml.serialize.OutputFormat format = getOutputFormat();
-            //noinspection deprecation
-            final org.apache.xml.serialize.HTMLSerializer serializer = getHTMLSerializer(writer, format);
-            
-            transformer.transform(source, new SAXResult(serializer));
-            errorMessages.clear();
-            errorMessages.addAll(cachedItem.magicSAXFilter.getErrorMessages());
-            cachedItems.add( cachedItem);
-            return new CleanResults(startOfScan, (String) null, null, errorMessages);
-
-        } catch (Exception e) {
-            throw new ScanException(e);
-        }
+  }
+
+  /**
+   * Return a new Transformer instance. This is wrapped in a synchronized method because there is no
+   * guarantee that the TransformerFactory is thread-safe.
+   *
+   * @return a new Transformer instance.
+   */
+  private static synchronized Transformer getNewTransformer() {
+    try {
+      return sTransformerFactory.newTransformer();
+    } catch (TransformerConfigurationException e) {
+      throw new RuntimeException(e);
     }
-
-     /**
-      * Return a new Transformer instance. This is wrapped in a synchronized method because there is
-      * no guarantee that the TransformerFactory is thread-safe.
-      *
-      * @return a new Transformer instance.
-      */
-     private static synchronized Transformer getNewTransformer()  {
-         try {
-             return sTransformerFactory.newTransformer();
-         } catch (TransformerConfigurationException e) {
-             throw new RuntimeException(e);
-         }
-     }
-
-    private static SAXParser getParser()  {
-        try {
-            SAXParser parser = new SAXParser();
-            parser.setFeature("http://xml.org/sax/features/namespaces", false);
-            parser.setFeature("http://cyberneko.org/html/features/balance-tags/document-fragment", true);
-            parser.setFeature("http://cyberneko.org/html/features/scanner/cdata-sections", true);
-            parser.setFeature("http://apache.org/xml/features/scanner/notify-char-refs", true);
-            parser.setFeature("http://apache.org/xml/features/scanner/notify-builtin-refs", true);
-
-            parser.setProperty("http://cyberneko.org/html/properties/names/elems", "lower");
-            return parser;
-        } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
-            throw new RuntimeException(e);
-        }
+  }
+
+  private static SAXParser getParser() {
+    try {
+      SAXParser parser = new SAXParser();
+      parser.setFeature("http://xml.org/sax/features/namespaces", false);
+      parser.setFeature("http://cyberneko.org/html/features/balance-tags/document-fragment", true);
+      parser.setFeature("http://cyberneko.org/html/features/scanner/cdata-sections", true);
+      parser.setFeature("http://apache.org/xml/features/scanner/notify-char-refs", true);
+      parser.setFeature("http://apache.org/xml/features/scanner/notify-builtin-refs", true);
+
+      parser.setProperty("http://cyberneko.org/html/properties/names/elems", "lower");
+      return parser;
+    } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+      throw new RuntimeException(e);
     }
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/scan/Constants.java b/src/main/java/org/owasp/validator/html/scan/Constants.java
index 9a975fc5..1756d70b 100644
--- a/src/main/java/org/owasp/validator/html/scan/Constants.java
+++ b/src/main/java/org/owasp/validator/html/scan/Constants.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -24,53 +24,78 @@
 package org.owasp.validator.html.scan;
 
 import java.util.*;
-
 import org.owasp.validator.html.Policy;
 import org.owasp.validator.html.model.Attribute;
 import org.owasp.validator.html.model.Tag;
 
 public class Constants {
 
-    public static final Tag BASIC_PARAM_TAG_RULE;
-    public static final List<String> defaultAllowedEmptyTags;
-    public static final List<String> defaultRequireClosingTags;
-    
-    private static final String[] allowedEmptyTags = {
-         "br", "hr", "a", "img", "link", "iframe", "script", "object", "applet",
-         "frame", "base", "param", "meta", "input", "textarea", "embed",
-         "basefont", "col"
-        };
-    
-    private static final String[] requiresClosingTags = {
-    	"iframe", "script", "link"
-    };
+  public static final Tag BASIC_PARAM_TAG_RULE;
+  public static final List<String> defaultAllowedEmptyTags;
+  public static final List<String> defaultRequireClosingTags;
+
+  private static final String[] allowedEmptyTags = {
+    "br",
+    "hr",
+    "a",
+    "img",
+    "link",
+    "iframe",
+    "script",
+    "object",
+    "applet",
+    "frame",
+    "base",
+    "param",
+    "meta",
+    "input",
+    "textarea",
+    "embed",
+    "basefont",
+    "col"
+  };
 
-    static {
-        Attribute paramNameAttr = new Attribute("name", Arrays.asList(Policy.ANYTHING_REGEXP), Collections.<String>emptyList(), null, null );
-        Attribute paramValueAttr = new Attribute("value", Arrays.asList(Policy.ANYTHING_REGEXP), Collections.<String>emptyList(), null, null );
+  private static final String[] requiresClosingTags = {"iframe", "script", "link"};
 
-        Map<String, Attribute> attrs = new HashMap<String, Attribute>();
-        attrs.put(paramNameAttr.getName().toLowerCase(), paramNameAttr);
-        attrs.put(paramValueAttr.getName().toLowerCase(), paramValueAttr);
-        BASIC_PARAM_TAG_RULE = new Tag("param", attrs, Policy.ACTION_VALIDATE);
-        
-        List<String> allowedEmptyTagsList = new ArrayList<String>(Arrays.asList(allowedEmptyTags));
-        defaultAllowedEmptyTags = Collections.unmodifiableList(allowedEmptyTagsList);
+  static {
+    Attribute paramNameAttr =
+        new Attribute(
+            "name",
+            Arrays.asList(Policy.ANYTHING_REGEXP),
+            Collections.<String>emptyList(),
+            null,
+            null);
+    Attribute paramValueAttr =
+        new Attribute(
+            "value",
+            Arrays.asList(Policy.ANYTHING_REGEXP),
+            Collections.<String>emptyList(),
+            null,
+            null);
 
-        List<String> requiresClosingTagsList = new ArrayList<String>(Arrays.asList(requiresClosingTags));
-        defaultRequireClosingTags = Collections.unmodifiableList(requiresClosingTagsList);
-    }
-    
-    public static final String DEFAULT_LOCALE_LANG = "en";
-    public static final String DEFAULT_LOCALE_LOC = "US";
-    
-    public static final String big5CharsToEncode = "<>\"'&";
-    public static final Set<Integer> big5CharsToEncodeSet = new HashSet<Integer>(){
+    Map<String, Attribute> attrs = new HashMap<String, Attribute>();
+    attrs.put(paramNameAttr.getName().toLowerCase(), paramNameAttr);
+    attrs.put(paramValueAttr.getName().toLowerCase(), paramValueAttr);
+    BASIC_PARAM_TAG_RULE = new Tag("param", attrs, Policy.ACTION_VALIDATE);
+
+    List<String> allowedEmptyTagsList = new ArrayList<String>(Arrays.asList(allowedEmptyTags));
+    defaultAllowedEmptyTags = Collections.unmodifiableList(allowedEmptyTagsList);
+
+    List<String> requiresClosingTagsList =
+        new ArrayList<String>(Arrays.asList(requiresClosingTags));
+    defaultRequireClosingTags = Collections.unmodifiableList(requiresClosingTagsList);
+  }
+
+  public static final String DEFAULT_LOCALE_LANG = "en";
+  public static final String DEFAULT_LOCALE_LOC = "US";
+
+  public static final String big5CharsToEncode = "<>\"'&";
+  public static final Set<Integer> big5CharsToEncodeSet =
+      new HashSet<Integer>() {
         {
-            for (int i = 0; i <big5CharsToEncode.length(); i++){
-                add((int) big5CharsToEncode.charAt(i));
-            }
+          for (int i = 0; i < big5CharsToEncode.length(); i++) {
+            add((int) big5CharsToEncode.charAt(i));
+          }
         }
-    };
-
+      };
 }
diff --git a/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java b/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java
index fe0bcf6e..1daf5d88 100644
--- a/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java
+++ b/src/main/java/org/owasp/validator/html/scan/MagicSAXFilter.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -26,7 +26,7 @@
 
 import java.util.*;
 import java.util.regex.Pattern;
-
+import net.sourceforge.htmlunit.cyberneko.filters.DefaultFilter;
 import org.apache.xerces.util.AugmentationsImpl;
 import org.apache.xerces.util.XMLAttributesImpl;
 import org.apache.xerces.util.XMLStringBuffer;
@@ -36,7 +36,6 @@
 import org.apache.xerces.xni.XMLString;
 import org.apache.xerces.xni.XNIException;
 import org.apache.xerces.xni.parser.XMLDocumentFilter;
-import net.sourceforge.htmlunit.cyberneko.filters.DefaultFilter;
 import org.owasp.validator.css.CssScanner;
 import org.owasp.validator.html.CleanResults;
 import org.owasp.validator.html.InternalPolicy;
@@ -48,392 +47,428 @@
 import org.owasp.validator.html.util.HTMLEntityEncoder;
 
 /**
- * Implementation of an HTML-filter that adheres to an AntiSamy policy. This
- * filter is SAX-based which means it is much more memory-efficient and also a
- * bit faster than the DOM-based implementation.
+ * Implementation of an HTML-filter that adheres to an AntiSamy policy. This filter is SAX-based
+ * which means it is much more memory-efficient and also a bit faster than the DOM-based
+ * implementation.
  */
 public class MagicSAXFilter extends DefaultFilter implements XMLDocumentFilter {
 
-    private enum Ops {
-        CSS, FILTER, REMOVE, TRUNCATE, KEEP, ENCODE
-    }
-	private final Stack<Ops> operations = new Stack<Ops>();
-	private final List<String> errorMessages = new ArrayList<String>();
-	private StringBuffer cssContent = null;
-	private XMLAttributes cssAttributes = null;
-	private CssScanner cssScanner = null;
-	private InternalPolicy policy;
-	private ResourceBundle messages;
-
-	private boolean isNofollowAnchors;
-	private boolean isNoopenerAndNoreferrerAnchors;
-	private boolean isValidateParamAsEmbed;
-	private boolean inCdata = false;
-    // From policy
-    private boolean preserveComments;
-    private int maxInputSize;
-    private boolean shouldParseImportedStyles;
-
-    public MagicSAXFilter(ResourceBundle messages) {
-		this.messages = messages;
+  private enum Ops {
+    CSS,
+    FILTER,
+    REMOVE,
+    TRUNCATE,
+    KEEP,
+    ENCODE
+  }
+
+  private final Stack<Ops> operations = new Stack<Ops>();
+  private final List<String> errorMessages = new ArrayList<String>();
+  private StringBuffer cssContent = null;
+  private XMLAttributes cssAttributes = null;
+  private CssScanner cssScanner = null;
+  private InternalPolicy policy;
+  private ResourceBundle messages;
+
+  private boolean isNofollowAnchors;
+  private boolean isNoopenerAndNoreferrerAnchors;
+  private boolean isValidateParamAsEmbed;
+  private boolean inCdata = false;
+  // From policy
+  private boolean preserveComments;
+  private int maxInputSize;
+  private boolean shouldParseImportedStyles;
+
+  public MagicSAXFilter(ResourceBundle messages) {
+    this.messages = messages;
+  }
+
+  public void reset(InternalPolicy instance) {
+    this.policy = instance;
+    isNofollowAnchors = policy.isNofollowAnchors();
+    isNoopenerAndNoreferrerAnchors = policy.isNoopenerAndNoreferrerAnchors();
+    isValidateParamAsEmbed = policy.isValidateParamAsEmbed();
+    preserveComments = policy.isPreserveComments();
+    maxInputSize = policy.getMaxInputSize();
+    shouldParseImportedStyles = policy.isEmbedStyleSheets();
+    operations.clear();
+    errorMessages.clear();
+    cssContent = null;
+    cssAttributes = null;
+    cssScanner = null;
+    inCdata = false;
+  }
+
+  public void characters(XMLString text, Augmentations augs) throws XNIException {
+
+    Ops topOp = peekTop();
+    //noinspection StatementWithEmptyBody
+    if (topOp == Ops.REMOVE) {
+      // content is removed altogether
+    } else if (topOp == Ops.CSS) {
+      // we record the style element's text content
+      // to filter it later
+      cssContent.append(text.ch, text.offset, text.length);
+    } else {
+      // pass through all character content.
+      if (inCdata) {
+        String encoded = HTMLEntityEncoder.htmlEntityEncode(text.toString());
+        addError(ErrorMessageUtil.ERROR_CDATA_FOUND, new Object[] {encoded});
+      }
+      super.characters(text, augs);
     }
+  }
+
+  private static final Pattern conditionalDirectives =
+      Pattern.compile("<?!?\\[\\s*(?:end)?if[^]]*\\]>?");
 
-    public void reset(InternalPolicy instance){
-        this.policy = instance;
-        isNofollowAnchors = policy.isNofollowAnchors();
-        isNoopenerAndNoreferrerAnchors = policy.isNoopenerAndNoreferrerAnchors();
-        isValidateParamAsEmbed = policy.isValidateParamAsEmbed();
-        preserveComments = policy.isPreserveComments();
-        maxInputSize = policy.getMaxInputSize();
-        shouldParseImportedStyles = policy.isEmbedStyleSheets();
-        operations.clear();
-        errorMessages.clear();
+  public void comment(XMLString text, Augmentations augs) throws XNIException {
+
+    if (preserveComments) {
+      String value = text.toString();
+      // Strip conditional directives regardless of the
+      // PRESERVE_COMMENTS setting.
+      if (value != null) {
+        value = conditionalDirectives.matcher(value).replaceAll("");
+        super.comment(new XMLString(value.toCharArray(), 0, value.length()), augs);
+      }
+    }
+  }
+
+  public void doctypeDecl(String root, String publicId, String systemId, Augmentations augs)
+      throws XNIException {
+    // user supplied doctypes are ignored
+  }
+
+  public void emptyElement(QName element, XMLAttributes attributes, Augmentations augs)
+      throws XNIException {
+    this.startElement(element, attributes, augs);
+    this.endElement(element, augs);
+  }
+
+  private Ops peekTop() {
+    return operations.empty() ? null : operations.peek();
+  }
+
+  private XMLStringBuffer makeEndTag(String tagName) {
+    return new XMLStringBuffer("</" + tagName + ">");
+  }
+
+  public void endElement(QName element, Augmentations augs) throws XNIException {
+    Ops topOp = peekTop();
+    if (Ops.REMOVE == topOp) {
+      // content is removed altogether
+      operations.pop();
+    } else if (Ops.FILTER == topOp) {
+      // content is removed, but child nodes not
+      operations.pop();
+    } else if (Ops.ENCODE == topOp) {
+      // if encoding this element, insert closing tag: super.characters will encode the string
+      // buffer
+      operations.pop();
+      super.characters(makeEndTag(element.rawname), augs);
+    } else if (Ops.CSS == topOp) {
+      operations.pop();
+      // now scan the CSS.
+      CssScanner cssScanner = makeCssScanner();
+      try {
+        CleanResults results = cssScanner.scanStyleSheet(cssContent.toString(), maxInputSize);
+        // report all errors found
+        errorMessages.addAll(results.getErrorMessages());
+        /*
+         * If IE gets an empty style tag, i.e. <style/> it will break
+         * all CSS on the page. I wish I was kidding. So, if after
+         * validation no CSS properties are left, we would normally be
+         * left with an empty style tag and break all CSS. To prevent
+         * that, we have this check.
+         */
+        //noinspection StatementWithEmptyBody
+        if (results.getCleanHTML() == null || results.getCleanHTML().equals("")) {
+          // we do not generate empty style elements
+        } else {
+          // XMLAttributes attributes = new XMLAttributesImpl();
+          // attributes.addAttribute(makeSimpleQname("type"), "CDATA",
+          // "text/css");
+          // start the CSS element
+
+          super.startElement(element, cssAttributes, new AugmentationsImpl());
+          // send the cleaned content
+          super.characters(new XMLStringBuffer(results.getCleanHTML()), new AugmentationsImpl());
+          // end the CSS element
+          super.endElement(element, augs);
+        }
+      } catch (ScanException e) {
+        // if the CSS is unscannable, we report the error, but skip the
+        // style element
+        addError(
+            ErrorMessageUtil.ERROR_CSS_TAG_MALFORMED,
+            new Object[] {HTMLEntityEncoder.htmlEntityEncode(cssContent.toString())});
+      } finally {
+        // reset the string buffer to allow fresh recording of next
+        // style tag
         cssContent = null;
         cssAttributes = null;
-        cssScanner = null;
-        inCdata = false;
+      }
+    } else {
+      // keep or truncate means the end-tag stays intact
+      operations.pop();
+      super.endElement(element, augs);
     }
+  }
 
-	public void characters(XMLString text, Augmentations augs) throws XNIException {
+  private CssScanner makeCssScanner() {
+    if (cssScanner == null) {
+      cssScanner = new CssScanner(policy, messages, shouldParseImportedStyles);
+    }
+    return cssScanner;
+  }
+
+  public void processingInstruction(String target, XMLString data, Augmentations augs)
+      throws XNIException {
+    // processing instructions are being removed
+  }
+
+  public void startCDATA(Augmentations augs) throws XNIException {
+    inCdata = true;
+    super.startCDATA(augs);
+  }
+
+  public void endCDATA(Augmentations augs) throws XNIException {
+    inCdata = false;
+    super.endCDATA(augs);
+  }
+
+  public void startElement(QName element, XMLAttributes attributes, Augmentations augs)
+      throws XNIException {
+    // see if we have a policy for this tag.
+    String tagNameLowerCase = element.localpart.toLowerCase();
+    Tag tag = policy.getTagByLowercaseName(tagNameLowerCase);
+
+    /*
+     * Handle the automatic translation of <param> to nested <embed> for IE.
+     * This is only if the "validateParamAsEmbed" directive is enabled.
+     */
+    boolean masqueradingParam = false;
+    String embedName = null;
+    String embedValue = null;
+    if (tag == null && isValidateParamAsEmbed && "param".equals(tagNameLowerCase)) {
+      Tag embedPolicy = policy.getEmbedTag();
+      if (embedPolicy != null && embedPolicy.isAction(Policy.ACTION_VALIDATE)) {
+        tag = embedPolicy; // Constants.BASIC_PARAM_TAG_RULE;
+        masqueradingParam = true;
+        // take <param name=x value=y> and turn into
+        // <embed x=y></embed>
+        embedName = attributes.getValue("name");
+        embedValue = attributes.getValue("value");
+        XMLAttributes masqueradingAttrs = new XMLAttributesImpl();
+        masqueradingAttrs.addAttribute(makeSimpleQname(embedName), "CDATA", embedValue);
+        attributes = masqueradingAttrs;
+      }
+    }
 
-        Ops topOp = peekTop();
-        //noinspection StatementWithEmptyBody
-        if (topOp ==  Ops.REMOVE) {
-			// content is removed altogether
-		} else if (topOp == Ops.CSS) {
-			// we record the style element's text content
-			// to filter it later
-			cssContent.append(text.ch, text.offset, text.length);
-		} else {
-			// pass through all character content.
-			if ( inCdata ) {
-				String encoded = HTMLEntityEncoder.htmlEntityEncode(text.toString());
-                addError(ErrorMessageUtil.ERROR_CDATA_FOUND, new Object[]{encoded});
-			}
-			super.characters(text, augs);
-		}
-	}
-
-    private static final Pattern conditionalDirectives =
-            Pattern.compile("<?!?\\[\\s*(?:end)?if[^]]*\\]>?");
-
-    public void comment(XMLString text, Augmentations augs) throws XNIException {
-
-		if (preserveComments) {
-			String value = text.toString();
-			// Strip conditional directives regardless of the
-			// PRESERVE_COMMENTS setting.
-			if (value != null) {
-                value = conditionalDirectives.matcher(value).replaceAll("");
-				super.comment(new XMLString(value.toCharArray(), 0, value.length()), augs);
-			}
-		}
-	}
-
-	public void doctypeDecl(String root, String publicId, String systemId, Augmentations augs) throws XNIException {
-		// user supplied doctypes are ignored
-	}
-
-	public void emptyElement(QName element, XMLAttributes attributes, Augmentations augs) throws XNIException {
-		this.startElement(element, attributes, augs);
-		this.endElement(element, augs);
-	}
-
-    private Ops peekTop(){
-         return operations.empty() ? null : operations.peek();
+    XMLAttributes validattributes = new XMLAttributesImpl();
+    Ops topOp = peekTop();
+    if (Ops.REMOVE == topOp || Ops.CSS == topOp) {
+      // we are in removal-mode, so remove this tag as well
+      // we also remove all child elements of a style element
+      this.operations.push(Ops.REMOVE);
+    } else if ((tag == null && policy.isEncodeUnknownTag())
+        || (tag != null && tag.isAction("encode"))) {
+      String name = "<" + element.localpart + ">";
+      super.characters(new XMLString(name.toCharArray(), 0, name.length()), augs);
+      this.operations.push(Ops.ENCODE);
+    } else if (tag == null) {
+      addError(
+          ErrorMessageUtil.ERROR_TAG_NOT_IN_POLICY,
+          new Object[] {HTMLEntityEncoder.htmlEntityEncode(element.localpart)});
+      this.operations.push(Ops.FILTER);
+    } else if (tag.isAction("filter")) {
+      addError(
+          ErrorMessageUtil.ERROR_TAG_FILTERED,
+          new Object[] {HTMLEntityEncoder.htmlEntityEncode(element.localpart)});
+      this.operations.push(Ops.FILTER);
+    } else if (tag.isAction("validate")) {
+
+      boolean isStyle = "style".endsWith(element.localpart);
+
+      // validate all attributes, we need to do this now to find out
+      // how to deal with the element
+      boolean removeTag = false;
+      boolean filterTag = false;
+      for (int i = 0; i < attributes.getLength(); i++) {
+        String name = attributes.getQName(i);
+        String value = attributes.getValue(i);
+        String nameLower = name.toLowerCase();
+        Attribute attribute = tag.getAttributeByName(nameLower);
+        if (attribute == null) {
+          // no policy defined, perhaps it is a global attribute
+          attribute = policy.getGlobalAttributeByName(nameLower);
+          if (attribute == null && policy.isAllowDynamicAttributes()) {
+            // not a global attribute, perhaps it is a dynamic attribute, if allowed
+            attribute = policy.getDynamicAttributeByName(nameLower);
+          }
+        }
+        // boolean isAttributeValid = false;
+        if ("style".equalsIgnoreCase(name)) {
+          CssScanner styleScanner = makeCssScanner();
+          try {
+            CleanResults cr = styleScanner.scanInlineStyle(value, element.localpart, maxInputSize);
+            attributes.setValue(i, cr.getCleanHTML());
+            validattributes.addAttribute(makeSimpleQname(name), "CDATA", cr.getCleanHTML());
+            errorMessages.addAll(cr.getErrorMessages());
+          } catch (ScanException e) {
+            addError(
+                ErrorMessageUtil.ERROR_CSS_ATTRIBUTE_MALFORMED,
+                new Object[] {element.localpart, HTMLEntityEncoder.htmlEntityEncode(value)});
+          }
+        } else if (attribute != null) {
+          // validate the values against the policy
+          boolean isValid = false;
+          if (attribute.containsAllowedValue(value.toLowerCase())
+              || attribute.matchesAllowedExpression(value)) {
+            int attrIndex;
+            if ((attrIndex = validattributes.getIndex(name)) > 0) {
+              // If attribute is repeated, use last value.
+              validattributes.setValue(attrIndex, value);
+            } else {
+              validattributes.addAttribute(makeSimpleQname(name), "CDATA", value);
+            }
+            isValid = true;
+          }
+
+          // if value or regexp matched, attribute is already
+          // copied, but what happens if not
+          if (!isValid && "removeTag".equals(attribute.getOnInvalid())) {
+
+            addError(
+                ErrorMessageUtil.ERROR_ATTRIBUTE_INVALID_REMOVED,
+                new Object[] {
+                  tag.getName(),
+                  HTMLEntityEncoder.htmlEntityEncode(name),
+                  HTMLEntityEncoder.htmlEntityEncode(value)
+                });
+
+            removeTag = true;
+
+          } else if (!isValid
+              && ("filterTag".equals(attribute.getOnInvalid()) || masqueradingParam)) {
+
+            addError(
+                ErrorMessageUtil.ERROR_ATTRIBUTE_CAUSE_FILTER,
+                new Object[] {
+                  tag.getName(),
+                  HTMLEntityEncoder.htmlEntityEncode(name),
+                  HTMLEntityEncoder.htmlEntityEncode(value)
+                });
+
+            filterTag = true;
+
+          } else if (!isValid) {
+            addError(
+                ErrorMessageUtil.ERROR_ATTRIBUTE_INVALID,
+                new Object[] {
+                  tag.getName(),
+                  HTMLEntityEncoder.htmlEntityEncode(name),
+                  HTMLEntityEncoder.htmlEntityEncode(value)
+                });
+          }
+
+        } else { // attribute == null
+          addError(
+              ErrorMessageUtil.ERROR_ATTRIBUTE_NOT_IN_POLICY,
+              new Object[] {
+                element.localpart,
+                HTMLEntityEncoder.htmlEntityEncode(name),
+                HTMLEntityEncoder.htmlEntityEncode(value)
+              });
+
+          if (masqueradingParam) {
+            filterTag = true;
+          }
+        }
+      }
+
+      if (removeTag) {
+        this.operations.push(Ops.REMOVE);
+      } else if (isStyle) {
+        this.operations.push(Ops.CSS);
+        cssContent = new StringBuffer();
+        cssAttributes = validattributes;
+      } else if (filterTag) {
+        this.operations.push(Ops.FILTER);
+      } else {
+
+        if ("a".equals(element.localpart)) {
+          boolean addNofollow = isNofollowAnchors;
+          boolean addNoopenerAndNoreferrer = false;
+
+          if (isNoopenerAndNoreferrerAnchors) {
+            String targetValue = attributes.getValue("target");
+            if (targetValue != null && targetValue.equalsIgnoreCase("_blank")) {
+              addNoopenerAndNoreferrer = true;
+            }
+          }
+
+          String currentRelValue = attributes.getValue("rel");
+          if (currentRelValue != null) {
+            Attribute attribute = tag.getAttributeByName("rel");
+            if (attribute != null
+                && !(attribute.containsAllowedValue(currentRelValue)
+                    || attribute.matchesAllowedExpression(currentRelValue))) {
+              currentRelValue = "";
+            }
+          }
+          String relValue =
+              Attribute.mergeRelValuesInAnchor(
+                  addNofollow, addNoopenerAndNoreferrer, currentRelValue);
+          if (!relValue.isEmpty()) {
+            int relIndex;
+            if ((relIndex = validattributes.getIndex("rel")) > 0) {
+              validattributes.setValue(relIndex, relValue);
+            } else {
+              validattributes.addAttribute(makeSimpleQname("rel"), "CDATA", relValue);
+            }
+          }
+        }
+
+        if (masqueradingParam) {
+          validattributes = new XMLAttributesImpl();
+          validattributes.addAttribute(makeSimpleQname("name"), "CDATA", embedName);
+          validattributes.addAttribute(makeSimpleQname("value"), "CDATA", embedValue);
+        }
+
+        this.operations.push(Ops.KEEP);
+      }
+
+    } else if (tag.isAction("truncate")) {
+      this.operations.push(Ops.TRUNCATE);
+    } else {
+      // no options left, so the tag will be removed
+      addError(
+          ErrorMessageUtil.ERROR_TAG_DISALLOWED,
+          new Object[] {HTMLEntityEncoder.htmlEntityEncode(element.localpart)});
+      this.operations.push(Ops.REMOVE);
     }
-    
-    private XMLStringBuffer makeEndTag(String tagName) {
-        return new XMLStringBuffer("</" + tagName + ">");
+    // now we know exactly what to do, let's do it
+    if (Ops.TRUNCATE.equals(operations.peek())) {
+      // copy the element, but remove all attributes
+      super.startElement(element, new XMLAttributesImpl(), augs);
+    } else if (Ops.KEEP.equals(operations.peek())) {
+      // copy the element, but only copy accepted attributes
+      super.startElement(element, validattributes, augs);
     }
+  }
+
+  private QName makeSimpleQname(String name) {
+    return new QName("", name, name, "");
+  }
 
-	public void endElement(QName element, Augmentations augs) throws XNIException {
-        Ops topOp = peekTop();
-        if (Ops.REMOVE == topOp) {
-			// content is removed altogether
-			operations.pop();
-		} else if (Ops.FILTER == topOp) {
-			// content is removed, but child nodes not
-			operations.pop();
-		} else if (Ops.ENCODE == topOp) {
-            // if encoding this element, insert closing tag: super.characters will encode the string buffer
-		    operations.pop();
-		    super.characters(makeEndTag(element.rawname), augs);
-		} else if (Ops.CSS == topOp) {
-			operations.pop();
-			// now scan the CSS.
-			CssScanner cssScanner = makeCssScanner();
-			try {
-				CleanResults results = cssScanner.scanStyleSheet(cssContent.toString(), maxInputSize);
-				// report all errors found
-				errorMessages.addAll(results.getErrorMessages());
-				/*
-				 * If IE gets an empty style tag, i.e. <style/> it will break
-				 * all CSS on the page. I wish I was kidding. So, if after
-				 * validation no CSS properties are left, we would normally be
-				 * left with an empty style tag and break all CSS. To prevent
-				 * that, we have this check.
-				 */
-                //noinspection StatementWithEmptyBody
-                if (results.getCleanHTML() == null || results.getCleanHTML().equals("")) {
-					// we do not generate empty style elements
-				} else {
-					// XMLAttributes attributes = new XMLAttributesImpl();
-					// attributes.addAttribute(makeSimpleQname("type"), "CDATA",
-					// "text/css");
-					// start the CSS element
-
-					super.startElement(element, cssAttributes, new AugmentationsImpl());
-					// send the cleaned content
-					super.characters(new XMLStringBuffer(results.getCleanHTML()), new AugmentationsImpl());
-					// end the CSS element
-					super.endElement(element, augs);
-				}
-			} catch (ScanException e) {
-				// if the CSS is unscannable, we report the error, but skip the
-				// style element
-				addError(ErrorMessageUtil.ERROR_CSS_TAG_MALFORMED, new Object[] {
-					HTMLEntityEncoder.htmlEntityEncode(cssContent.toString())
-				});
-			} finally {
-				// reset the string buffer to allow fresh recording of next
-				// style tag
-				cssContent = null;
-				cssAttributes = null;
-			}
-		} else {
-			// keep or truncate means the end-tag stays intact
-			operations.pop();
-			super.endElement(element, augs);
-		}
-	}
-
-	private CssScanner makeCssScanner() {
-		if (cssScanner == null) {
-            cssScanner = new CssScanner(policy, messages, shouldParseImportedStyles);
-		}
-		return cssScanner;
-	}
-
-	public void processingInstruction(String target, XMLString data, Augmentations augs) throws XNIException {
-		// processing instructions are being removed
-	}
-	
-	public void startCDATA(Augmentations augs) throws XNIException {
-		inCdata = true;
-		super.startCDATA(augs);
-	}
-	
-	public void endCDATA(Augmentations augs) throws XNIException {
-		inCdata = false;
-		super.endCDATA(augs);
-	}
-
-	public void startElement(QName element, XMLAttributes attributes, Augmentations augs) throws XNIException {
-		// see if we have a policy for this tag.
-        String tagNameLowerCase = element.localpart.toLowerCase();
-        Tag tag = policy.getTagByLowercaseName(tagNameLowerCase);
-
-		/*
-		 * Handle the automatic translation of <param> to nested <embed> for IE.
-		 * This is only if the "validateParamAsEmbed" directive is enabled.
-		 */
-		boolean masqueradingParam = false;
-		String embedName = null;
-		String embedValue = null;
-		if (tag == null && isValidateParamAsEmbed && "param".equals(tagNameLowerCase)) {
-			Tag embedPolicy = policy.getEmbedTag();
-			if (embedPolicy != null && embedPolicy.isAction( Policy.ACTION_VALIDATE)) {
-				tag = embedPolicy;// Constants.BASIC_PARAM_TAG_RULE;
-				masqueradingParam = true;
-				// take <param name=x value=y> and turn into
-				// <embed x=y></embed>
-				embedName = attributes.getValue("name");
-				embedValue = attributes.getValue("value");
-				XMLAttributes masqueradingAttrs = new XMLAttributesImpl();
-				masqueradingAttrs.addAttribute(makeSimpleQname(embedName), "CDATA", embedValue);
-				attributes = masqueradingAttrs;
-			}
-		}
-
-		XMLAttributes validattributes = new XMLAttributesImpl();
-        Ops topOp = peekTop();
-        if (Ops.REMOVE == topOp || Ops.CSS == topOp) {
-			// we are in removal-mode, so remove this tag as well
-			// we also remove all child elements of a style element
-			this.operations.push( Ops.REMOVE);
-		} else if ((tag == null && policy.isEncodeUnknownTag()) || (tag != null && tag.isAction( "encode" ))) {
-			String name = "<" + element.localpart + ">";
-			super.characters( new XMLString( name.toCharArray(), 0, name.length() ), augs );
-			this.operations.push(Ops.ENCODE);
-		} else if (tag == null) {
-			addError( ErrorMessageUtil.ERROR_TAG_NOT_IN_POLICY,
-                      new Object[]{ HTMLEntityEncoder.htmlEntityEncode( element.localpart ) } );
-			this.operations.push(Ops.FILTER);
-		} else if (tag.isAction( "filter")) {
-			addError(ErrorMessageUtil.ERROR_TAG_FILTERED, new Object[] {
-				HTMLEntityEncoder.htmlEntityEncode(element.localpart)
-			});
-			this.operations.push(Ops.FILTER);
-		} else if (tag.isAction( "validate")) {
-
-			boolean isStyle = "style".endsWith(element.localpart);
-
-				// validate all attributes, we need to do this now to find out
-				// how to deal with the element
-				boolean removeTag = false;
-				boolean filterTag = false;
-				for (int i = 0; i < attributes.getLength(); i++) {
-					String name = attributes.getQName(i);
-					String value = attributes.getValue(i);
-					String nameLower = name.toLowerCase();
-					Attribute attribute = tag.getAttributeByName(nameLower);
-					if (attribute == null) {
-						// no policy defined, perhaps it is a global attribute
-						attribute = policy.getGlobalAttributeByName(nameLower);
-						if (attribute == null && policy.isAllowDynamicAttributes()) {
-						    // not a global attribute, perhaps it is a dynamic attribute, if allowed
-						    attribute = policy.getDynamicAttributeByName(nameLower);
-						}
-					}
-					// boolean isAttributeValid = false;
-					if ("style".equalsIgnoreCase(name)) {
-						CssScanner styleScanner = makeCssScanner();
-						try {
-							CleanResults cr = styleScanner.scanInlineStyle(value, element.localpart, maxInputSize);
-							attributes.setValue(i, cr.getCleanHTML());
-							validattributes.addAttribute(makeSimpleQname(name), "CDATA", cr.getCleanHTML());
-							errorMessages.addAll(cr.getErrorMessages());
-						} catch (ScanException e) {
-							addError(ErrorMessageUtil.ERROR_CSS_ATTRIBUTE_MALFORMED, new Object[] {
-									element.localpart, HTMLEntityEncoder.htmlEntityEncode(value)
-							});
-						}
-					} else if (attribute != null) {
-						// validate the values against the policy
-						boolean isValid = false;
-                        if (attribute.containsAllowedValue(value.toLowerCase())
-								|| attribute.matchesAllowedExpression(value)) {
-							int attrIndex;
-							if ((attrIndex = validattributes.getIndex(name)) > 0) {
-								// If attribute is repeated, use last value.
-								validattributes.setValue(attrIndex, value);
-							} else {
-								validattributes.addAttribute(makeSimpleQname(name), "CDATA", value);
-							}
-                            isValid = true;
-                        }
-
-                        // if value or regexp matched, attribute is already
-						// copied, but what happens if not
-						if (!isValid && "removeTag".equals(attribute.getOnInvalid())) {
-							
-							addError(ErrorMessageUtil.ERROR_ATTRIBUTE_INVALID_REMOVED,
-								new Object[] { tag.getName(), HTMLEntityEncoder.htmlEntityEncode(name), HTMLEntityEncoder.htmlEntityEncode(value) });
-							
-							removeTag = true;
-							
-						} else if (!isValid && ("filterTag".equals(attribute.getOnInvalid()) || masqueradingParam)) {
-							
-							addError(ErrorMessageUtil.ERROR_ATTRIBUTE_CAUSE_FILTER, 
-								new Object[] { tag.getName(), HTMLEntityEncoder.htmlEntityEncode(name), HTMLEntityEncoder.htmlEntityEncode(value) });
-							
-							filterTag = true;
-							
-						} else if (!isValid) {
-							addError(ErrorMessageUtil.ERROR_ATTRIBUTE_INVALID, new Object[] { tag.getName(), HTMLEntityEncoder.htmlEntityEncode(name), HTMLEntityEncoder.htmlEntityEncode(value) });
-						}
-						
-					} else { // attribute == null
-						addError(ErrorMessageUtil.ERROR_ATTRIBUTE_NOT_IN_POLICY, new Object[] {
-								element.localpart, HTMLEntityEncoder.htmlEntityEncode(name), HTMLEntityEncoder.htmlEntityEncode(value)
-						});
-						
-						if (masqueradingParam) {
-							filterTag = true;
-						}
-					}
-				}
-
-				if (removeTag) {
-					this.operations.push(Ops.REMOVE);
-				} else if (isStyle) {
-					this.operations.push(Ops.CSS);
-					cssContent = new StringBuffer();
-					cssAttributes = validattributes;
-				} else if (filterTag) {
-					this.operations.push(Ops.FILTER);
-				} else {
-
-					if ("a".equals(element.localpart)) {
-						boolean addNofollow = isNofollowAnchors;
-						boolean addNoopenerAndNoreferrer = false;
-
-						if (isNoopenerAndNoreferrerAnchors) {
-							String targetValue = attributes.getValue("target");
-							if (targetValue != null && targetValue.equalsIgnoreCase("_blank")) {
-								addNoopenerAndNoreferrer = true;
-							}
-						}
-
-						String currentRelValue = attributes.getValue("rel");
-						if (currentRelValue != null) {
-							Attribute attribute = tag.getAttributeByName("rel");
-							if (attribute != null &&
-									!(attribute.containsAllowedValue(currentRelValue) || attribute.matchesAllowedExpression(currentRelValue))) {
-								currentRelValue = "";
-							}
-						}
-						String relValue = Attribute.mergeRelValuesInAnchor(addNofollow, addNoopenerAndNoreferrer, currentRelValue);
-						if (!relValue.isEmpty()){
-							int relIndex;
-							if ((relIndex = validattributes.getIndex("rel")) > 0) {
-								validattributes.setValue(relIndex, relValue);
-							} else {
-								validattributes.addAttribute(makeSimpleQname("rel"), "CDATA", relValue);
-							}
-						}
-					}
-
-					if (masqueradingParam) {
-						validattributes = new XMLAttributesImpl();
-						validattributes.addAttribute(makeSimpleQname("name"), "CDATA", embedName);
-						validattributes.addAttribute(makeSimpleQname("value"), "CDATA", embedValue);
-					}
-
-					this.operations.push(Ops.KEEP);
-				}
-			
-		} else if (tag.isAction( "truncate")) {
-			this.operations.push(Ops.TRUNCATE);
-		} else {
-			// no options left, so the tag will be removed
-			addError(ErrorMessageUtil.ERROR_TAG_DISALLOWED, new Object[] {
-				HTMLEntityEncoder.htmlEntityEncode(element.localpart)
-			});
-			this.operations.push(Ops.REMOVE);
-		}
-		// now we know exactly what to do, let's do it
-		if ( Ops.TRUNCATE.equals( operations.peek() )) {
-			// copy the element, but remove all attributes
-			super.startElement(element, new XMLAttributesImpl(), augs);
-		} else if ( Ops.KEEP.equals(operations.peek())) {
-			// copy the element, but only copy accepted attributes
-			super.startElement(element, validattributes, augs);
-		}
-	}
-
-	private QName makeSimpleQname(String name) {
-		return new QName("", name, name, "");
-	}
-
-	private void addError(String errorKey, Object[] objs) {
-		errorMessages.add(ErrorMessageUtil.getMessage(messages, errorKey, objs));
-	}
-
-	public List<String> getErrorMessages() {
-		// Return a copy of the errorMessages so caller can't change internal copy.
-		return new ArrayList<String>(errorMessages);
-	}
+  private void addError(String errorKey, Object[] objs) {
+    errorMessages.add(ErrorMessageUtil.getMessage(messages, errorKey, objs));
+  }
 
+  public List<String> getErrorMessages() {
+    // Return a copy of the errorMessages so caller can't change internal copy.
+    return new ArrayList<String>(errorMessages);
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/util/ErrorMessageUtil.java b/src/main/java/org/owasp/validator/html/util/ErrorMessageUtil.java
index bd5afeb2..4a585515 100644
--- a/src/main/java/org/owasp/validator/html/util/ErrorMessageUtil.java
+++ b/src/main/java/org/owasp/validator/html/util/ErrorMessageUtil.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -28,56 +28,59 @@
 
 public final class ErrorMessageUtil {
 
-	public static final String ERROR_TAG_NOT_IN_POLICY = "error.tag.notfound";
-	public static final String ERROR_TAG_DISALLOWED = "error.tag.removed";
-	public static final String ERROR_TAG_FILTERED = "error.tag.filtered";
-	public static final String ERROR_TAG_ENCODED = "error.tag.encoded";
-	public static final String ERROR_TAG_EMPTY = "error.tag.empty";
-	
-	public static final String ERROR_CDATA_FOUND = "error.cdata.found";
-	public static final String ERROR_PI_FOUND = "error.pi.found";
-	
-	public static final String ERROR_ATTRIBUTE_CAUSE_FILTER = "error.attribute.invalid.filtered";
-	public static final String ERROR_ATTRIBUTE_CAUSE_ENCODE = "error.attribute.invalid.encoded";
-	public static final String ERROR_ATTRIBUTE_INVALID_FILTERED = "error.attribute.invalid.filtered";
-	public static final String ERROR_ATTRIBUTE_INVALID_REMOVED = "error.attribute.invalid.removed";
-	public static final String ERROR_ATTRIBUTE_NOT_IN_POLICY = "error.attribute.notfound";
-	public static final String ERROR_ATTRIBUTE_INVALID = "error.attribute.invalid";
-
-	public static final String ERROR_COMMENT_REMOVED = "error.comment.removed";
-	
-	public static final String ERROR_INPUT_SIZE = "error.size.toolarge";
-
-	public static final String ERROR_CSS_ATTRIBUTE_MALFORMED = "error.css.attribute.malformed";
-	public static final String ERROR_CSS_TAG_MALFORMED = "error.css.tag.malformed";
-	
-	public static final String ERROR_STYLESHEET_NOT_ALLOWED = "error.css.disallowed";
-	
-	public static final String ERROR_CSS_IMPORT_DISABLED = "error.css.import.disabled";
-	public static final String ERROR_CSS_IMPORT_EXCEEDED = "error.css.import.exceeded";
-	public static final String ERROR_CSS_IMPORT_FAILURE = "error.css.import.failure";
-	public static final String ERROR_CSS_IMPORT_INPUT_SIZE = "error.css.import.toolarge";
-	public static final String ERROR_CSS_IMPORT_URL_INVALID = "error.css.import.url.invalid";
-
-	public static final String ERROR_STYLESHEET_RELATIVE = "error.css.stylesheet.relative";
-	public static final String ERROR_CSS_TAG_RELATIVE = "error.css.tag.relative";
-	
-	public static final String ERROR_STYLESHEET_RULE_NOTFOUND = "error.css.stylesheet.rule.notfound";
-	public static final String ERROR_CSS_TAG_RULE_NOTFOUND = "error.css.tag.rule.notfound";
-	
-	public static final String ERROR_STYLESHEET_SELECTOR_NOTFOUND = "error.css.stylesheet.selector.notfound";
-	public static final String ERROR_CSS_TAG_SELECTOR_NOTFOUND = "error.css.tag.selector.notfound";
-	
-	public static final String ERROR_STYLESHEET_SELECTOR_DISALLOWED = "error.css.stylesheet.selector.disallowed";
-	public static final String ERROR_CSS_TAG_SELECTOR_DISALLOWED = "error.css.tag.selector.disallowed";
-	
-	public static final String ERROR_STYLESHEET_PROPERTY_INVALID = "error.css.stylesheet.property.invalid";
-	public static final String ERROR_CSS_TAG_PROPERTY_INVALID = "error.css.tag.property.invalid";	
-
-	private ErrorMessageUtil() {}
-
-	public static String getMessage(ResourceBundle messages, String msgKey, Object[] arguments) {	
-		return MessageFormat.format( messages.getString(msgKey), arguments );
-	}
-	
+  public static final String ERROR_TAG_NOT_IN_POLICY = "error.tag.notfound";
+  public static final String ERROR_TAG_DISALLOWED = "error.tag.removed";
+  public static final String ERROR_TAG_FILTERED = "error.tag.filtered";
+  public static final String ERROR_TAG_ENCODED = "error.tag.encoded";
+  public static final String ERROR_TAG_EMPTY = "error.tag.empty";
+
+  public static final String ERROR_CDATA_FOUND = "error.cdata.found";
+  public static final String ERROR_PI_FOUND = "error.pi.found";
+
+  public static final String ERROR_ATTRIBUTE_CAUSE_FILTER = "error.attribute.invalid.filtered";
+  public static final String ERROR_ATTRIBUTE_CAUSE_ENCODE = "error.attribute.invalid.encoded";
+  public static final String ERROR_ATTRIBUTE_INVALID_FILTERED = "error.attribute.invalid.filtered";
+  public static final String ERROR_ATTRIBUTE_INVALID_REMOVED = "error.attribute.invalid.removed";
+  public static final String ERROR_ATTRIBUTE_NOT_IN_POLICY = "error.attribute.notfound";
+  public static final String ERROR_ATTRIBUTE_INVALID = "error.attribute.invalid";
+
+  public static final String ERROR_COMMENT_REMOVED = "error.comment.removed";
+
+  public static final String ERROR_INPUT_SIZE = "error.size.toolarge";
+
+  public static final String ERROR_CSS_ATTRIBUTE_MALFORMED = "error.css.attribute.malformed";
+  public static final String ERROR_CSS_TAG_MALFORMED = "error.css.tag.malformed";
+
+  public static final String ERROR_STYLESHEET_NOT_ALLOWED = "error.css.disallowed";
+
+  public static final String ERROR_CSS_IMPORT_DISABLED = "error.css.import.disabled";
+  public static final String ERROR_CSS_IMPORT_EXCEEDED = "error.css.import.exceeded";
+  public static final String ERROR_CSS_IMPORT_FAILURE = "error.css.import.failure";
+  public static final String ERROR_CSS_IMPORT_INPUT_SIZE = "error.css.import.toolarge";
+  public static final String ERROR_CSS_IMPORT_URL_INVALID = "error.css.import.url.invalid";
+
+  public static final String ERROR_STYLESHEET_RELATIVE = "error.css.stylesheet.relative";
+  public static final String ERROR_CSS_TAG_RELATIVE = "error.css.tag.relative";
+
+  public static final String ERROR_STYLESHEET_RULE_NOTFOUND = "error.css.stylesheet.rule.notfound";
+  public static final String ERROR_CSS_TAG_RULE_NOTFOUND = "error.css.tag.rule.notfound";
+
+  public static final String ERROR_STYLESHEET_SELECTOR_NOTFOUND =
+      "error.css.stylesheet.selector.notfound";
+  public static final String ERROR_CSS_TAG_SELECTOR_NOTFOUND = "error.css.tag.selector.notfound";
+
+  public static final String ERROR_STYLESHEET_SELECTOR_DISALLOWED =
+      "error.css.stylesheet.selector.disallowed";
+  public static final String ERROR_CSS_TAG_SELECTOR_DISALLOWED =
+      "error.css.tag.selector.disallowed";
+
+  public static final String ERROR_STYLESHEET_PROPERTY_INVALID =
+      "error.css.stylesheet.property.invalid";
+  public static final String ERROR_CSS_TAG_PROPERTY_INVALID = "error.css.tag.property.invalid";
+
+  private ErrorMessageUtil() {}
+
+  public static String getMessage(ResourceBundle messages, String msgKey, Object[] arguments) {
+    return MessageFormat.format(messages.getString(msgKey), arguments);
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/util/HTMLEntityEncoder.java b/src/main/java/org/owasp/validator/html/util/HTMLEntityEncoder.java
index beddae9b..7068d3ff 100644
--- a/src/main/java/org/owasp/validator/html/util/HTMLEntityEncoder.java
+++ b/src/main/java/org/owasp/validator/html/util/HTMLEntityEncoder.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -25,41 +25,40 @@
 package org.owasp.validator.html.util;
 
 public class HTMLEntityEncoder {
-	
-	/**
-	 * A helper method for HTML entity-encoding a String value.
-	 * @param value A String containing HTML control characters.
-	 * @return An HTML-encoded String.
-	 */
-	public static String htmlEntityEncode(String value) {
-		
-		StringBuffer buff = new StringBuffer();
-		
-		if ( value == null ) {
-			return null;
-		}
-		
-		for(int i=0;i<value.length();i++) {
-			
-			char ch = value.charAt(i);
-			
-			if ( ch == '&' ) {
-				buff.append("&amp;");
-			} else if ( ch == '<') {
-				buff.append("&lt;");
-			} else if ( ch == '>') {
-				buff.append("&gt;");
-			} else if ( Character.isWhitespace(ch ) ) {
-				buff.append(ch);
-			} else if ( Character.isLetterOrDigit(ch) ) {
-				buff.append(ch);
-			} else if ( (int)ch >= 32 && (int)ch <= 126 ) {
-				buff.append( "&#" + (int)ch + ";" );			
-			}
-			
-		}
-		
-		return buff.toString();
-		
-	}
+
+  /**
+   * A helper method for HTML entity-encoding a String value.
+   *
+   * @param value A String containing HTML control characters.
+   * @return An HTML-encoded String.
+   */
+  public static String htmlEntityEncode(String value) {
+
+    StringBuffer buff = new StringBuffer();
+
+    if (value == null) {
+      return null;
+    }
+
+    for (int i = 0; i < value.length(); i++) {
+
+      char ch = value.charAt(i);
+
+      if (ch == '&') {
+        buff.append("&amp;");
+      } else if (ch == '<') {
+        buff.append("&lt;");
+      } else if (ch == '>') {
+        buff.append("&gt;");
+      } else if (Character.isWhitespace(ch)) {
+        buff.append(ch);
+      } else if (Character.isLetterOrDigit(ch)) {
+        buff.append(ch);
+      } else if ((int) ch >= 32 && (int) ch <= 126) {
+        buff.append("&#" + (int) ch + ";");
+      }
+    }
+
+    return buff.toString();
+  }
 }
diff --git a/src/main/java/org/owasp/validator/html/util/URIUtils.java b/src/main/java/org/owasp/validator/html/util/URIUtils.java
index 14140134..ee4c9984 100644
--- a/src/main/java/org/owasp/validator/html/util/URIUtils.java
+++ b/src/main/java/org/owasp/validator/html/util/URIUtils.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -25,7 +25,6 @@
 package org.owasp.validator.html.util;
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-
 import java.io.File;
 import java.net.MalformedURLException;
 import java.net.URL;
@@ -36,181 +35,171 @@
  * A utility class for URI handling
  *
  * @author <a href="mailto:kvisco-at-intalio.com">Keith Visco</a>
- **/
+ */
 public class URIUtils {
 
-	/**
-	 * the File protocol
-	 **/
-	private static final String FILE_PROTOCOL_PREFIX = "file:///";
-	/**
-	 * the path separator for an URI
-	 */
-	private static final char HREF_PATH_SEP = '/';
-	/**
-	 * the path separate for a URL as a String
-	 */
-	private static final String URL_PATH_SEP_STR = "/";
-	/**
-	 * The current directory designator
-	 */
-	private static final String CURRENT_DIR_OP = ".";
-	/**
-	 * The parent directory designator
-	 */
-	private static final String PARENT_DIR_OP = "..";
-
-	@SuppressFBWarnings(value = "SECURITY",justification="The 2x Path Traversal warnings related to the use of"
-			+ " new File(href) are not vulnerabilities as no data is read or written.")
-	public static String resolveAsString(String href, String documentBase) {
-
-		try {
-			//-- try to create a new URL and see if MalformedURLExcetion is
-			//-- ever thrown
-			new URL(href);
-			return href;
-		} catch (MalformedURLException muex) {
-		}
-
-		//-- join document base + href
-		String absolute = null;
-		if ((documentBase != null) && (documentBase.length() > 0)) {
-			int idx = documentBase.lastIndexOf(HREF_PATH_SEP);
-			if (idx == (documentBase.length() - 1)) {
-				absolute = documentBase + href;
-			} else {
-				absolute = documentBase + HREF_PATH_SEP + href;
-			}
-
-		} else {
-			absolute = href;
-		}
-
-		try {
-			//-- try to create a new URL and see if MalformedURLExcetion is
-			//-- ever thrown
-
-			if (absolute.indexOf("./") >= 0) {
-				//-- normalize . or .. from URL
-				absolute = normalize(absolute);
-			}
-			new URL(absolute);
-			return absolute;
-		} catch (MalformedURLException muex) {
-			//-- check for unrecognized protocol
-			int idx = absolute.indexOf(':');
-			if (idx >= 0) {
-				String scheme = absolute.substring(0, idx);
-				//-- a bit of a hack, but good enough for now
-				String error = "unknown protocol: " + scheme;
-				if (error.equals(muex.getMessage())) {
-					return absolute;
-				}
-			}
-		}
-
-		// Try local files
-		String fileURL = absolute;
-		File iFile = new File(href);
-		boolean exists = iFile.exists();
-		fileURL = createFileURL(iFile.getAbsolutePath());
-		if (!iFile.isAbsolute()) {
-			iFile = new File(absolute);
-			if (iFile.exists() || (!exists)) {
-				fileURL = createFileURL(iFile.getAbsolutePath());
-			}
-		}
-
-		//-- one last sanity check
-		try {
-			//-- try to create a new URL and see if MalformedURLException is
-			//-- ever thrown
-			new URL(fileURL);
-			return fileURL;
-		} catch (MalformedURLException muex) {
-		}
-
-		//-- At this point we were unsuccessful at trying to resolve
-		//-- the href + documentbase, this could be due to a custom
-		//-- protocol or typo in the URI, just return documentBase +
-		//-- href
-		return absolute;
-	} //-- resolveHref
-
-	/**
-	 * This method removes "." or ".." from absolute URL.
-	 * I needed this method because the JDK doesn't do this
-	 * automatically when creating URLs.
-	 *
-	 * @param absoluteURL the absolute URL to normalize
-	 * @return The normalized URL
-	 * @throws MalformedURLException if the supplied URL is malformed.
-	 */
-	public static String normalize(String absoluteURL)
-			throws MalformedURLException {
-		if (absoluteURL == null) {
-			return absoluteURL;
-		}
-		if (absoluteURL.indexOf('.') < 0) {
-			return absoluteURL;
-		}
-
-		//-- Note: using StringTokenizer and Stacks
-		//-- is not very efficient, this may need
-		//-- some optimizing
-		Stack<String> tokens = new Stack<String>();
-		StringTokenizer st = new StringTokenizer(absoluteURL, URL_PATH_SEP_STR, true);
-		String last = null;
-		while (st.hasMoreTokens()) {
-			String token = st.nextToken();
-			if (URL_PATH_SEP_STR.equals(token)) {
-				if (URL_PATH_SEP_STR.equals(last)) {
-					tokens.push("");
-				}
-			} else if (PARENT_DIR_OP.equals(token)) {
-				if (tokens.empty()) {
-					//-- this should be an error
-					throw new MalformedURLException("invalid absolute URL: " + absoluteURL);
-				}
-				tokens.pop();
-			} else if (!CURRENT_DIR_OP.equals(token)) {
-				tokens.push(token);
-			}
-			last = token;
-		}
-
-		//-- rebuild URL
-		StringBuffer buffer = new StringBuffer(absoluteURL.length());
-		for (int i = 0; i < tokens.size(); i++) {
-			if (i > 0) {
-				buffer.append(HREF_PATH_SEP);
-			}
-			buffer.append(tokens.elementAt(i));
-		}
-		return buffer.toString();
-	} //-- normalize
-
-	/**
-	 * Creates a File URL for the given file name
-	 *
-	 * @param filename the name of the file
-	 * @return the String representation of the File URL
-	 **/
-	private static String createFileURL(String filename) {
-
-		if (filename == null) {
-			return FILE_PROTOCOL_PREFIX;
-		}
-		StringBuffer sb = new StringBuffer(filename.length() + FILE_PROTOCOL_PREFIX.length());
-		sb.append(FILE_PROTOCOL_PREFIX);
-		for (char ch : filename.toCharArray()) {
-			if (ch == '\\') {
-				sb.append(HREF_PATH_SEP);
-			} else {
-				sb.append(ch);
-			}
-		}
-		return sb.toString();
-	} //-- createFileURL
-
+  /** the File protocol */
+  private static final String FILE_PROTOCOL_PREFIX = "file:///";
+  /** the path separator for an URI */
+  private static final char HREF_PATH_SEP = '/';
+  /** the path separate for a URL as a String */
+  private static final String URL_PATH_SEP_STR = "/";
+  /** The current directory designator */
+  private static final String CURRENT_DIR_OP = ".";
+  /** The parent directory designator */
+  private static final String PARENT_DIR_OP = "..";
+
+  @SuppressFBWarnings(
+      value = "SECURITY",
+      justification =
+          "The 2x Path Traversal warnings related to the use of"
+              + " new File(href) are not vulnerabilities as no data is read or written.")
+  public static String resolveAsString(String href, String documentBase) {
+
+    try {
+      // -- try to create a new URL and see if MalformedURLExcetion is
+      // -- ever thrown
+      new URL(href);
+      return href;
+    } catch (MalformedURLException muex) {
+    }
+
+    // -- join document base + href
+    String absolute = null;
+    if ((documentBase != null) && (documentBase.length() > 0)) {
+      int idx = documentBase.lastIndexOf(HREF_PATH_SEP);
+      if (idx == (documentBase.length() - 1)) {
+        absolute = documentBase + href;
+      } else {
+        absolute = documentBase + HREF_PATH_SEP + href;
+      }
+
+    } else {
+      absolute = href;
+    }
+
+    try {
+      // -- try to create a new URL and see if MalformedURLExcetion is
+      // -- ever thrown
+
+      if (absolute.indexOf("./") >= 0) {
+        // -- normalize . or .. from URL
+        absolute = normalize(absolute);
+      }
+      new URL(absolute);
+      return absolute;
+    } catch (MalformedURLException muex) {
+      // -- check for unrecognized protocol
+      int idx = absolute.indexOf(':');
+      if (idx >= 0) {
+        String scheme = absolute.substring(0, idx);
+        // -- a bit of a hack, but good enough for now
+        String error = "unknown protocol: " + scheme;
+        if (error.equals(muex.getMessage())) {
+          return absolute;
+        }
+      }
+    }
+
+    // Try local files
+    String fileURL = absolute;
+    File iFile = new File(href);
+    boolean exists = iFile.exists();
+    fileURL = createFileURL(iFile.getAbsolutePath());
+    if (!iFile.isAbsolute()) {
+      iFile = new File(absolute);
+      if (iFile.exists() || (!exists)) {
+        fileURL = createFileURL(iFile.getAbsolutePath());
+      }
+    }
+
+    // -- one last sanity check
+    try {
+      // -- try to create a new URL and see if MalformedURLException is
+      // -- ever thrown
+      new URL(fileURL);
+      return fileURL;
+    } catch (MalformedURLException muex) {
+    }
+
+    // -- At this point we were unsuccessful at trying to resolve
+    // -- the href + documentbase, this could be due to a custom
+    // -- protocol or typo in the URI, just return documentBase +
+    // -- href
+    return absolute;
+  } // -- resolveHref
+
+  /**
+   * This method removes "." or ".." from absolute URL. I needed this method because the JDK doesn't
+   * do this automatically when creating URLs.
+   *
+   * @param absoluteURL the absolute URL to normalize
+   * @return The normalized URL
+   * @throws MalformedURLException if the supplied URL is malformed.
+   */
+  public static String normalize(String absoluteURL) throws MalformedURLException {
+    if (absoluteURL == null) {
+      return absoluteURL;
+    }
+    if (absoluteURL.indexOf('.') < 0) {
+      return absoluteURL;
+    }
+
+    // -- Note: using StringTokenizer and Stacks
+    // -- is not very efficient, this may need
+    // -- some optimizing
+    Stack<String> tokens = new Stack<String>();
+    StringTokenizer st = new StringTokenizer(absoluteURL, URL_PATH_SEP_STR, true);
+    String last = null;
+    while (st.hasMoreTokens()) {
+      String token = st.nextToken();
+      if (URL_PATH_SEP_STR.equals(token)) {
+        if (URL_PATH_SEP_STR.equals(last)) {
+          tokens.push("");
+        }
+      } else if (PARENT_DIR_OP.equals(token)) {
+        if (tokens.empty()) {
+          // -- this should be an error
+          throw new MalformedURLException("invalid absolute URL: " + absoluteURL);
+        }
+        tokens.pop();
+      } else if (!CURRENT_DIR_OP.equals(token)) {
+        tokens.push(token);
+      }
+      last = token;
+    }
+
+    // -- rebuild URL
+    StringBuffer buffer = new StringBuffer(absoluteURL.length());
+    for (int i = 0; i < tokens.size(); i++) {
+      if (i > 0) {
+        buffer.append(HREF_PATH_SEP);
+      }
+      buffer.append(tokens.elementAt(i));
+    }
+    return buffer.toString();
+  } // -- normalize
+
+  /**
+   * Creates a File URL for the given file name
+   *
+   * @param filename the name of the file
+   * @return the String representation of the File URL
+   */
+  private static String createFileURL(String filename) {
+
+    if (filename == null) {
+      return FILE_PROTOCOL_PREFIX;
+    }
+    StringBuffer sb = new StringBuffer(filename.length() + FILE_PROTOCOL_PREFIX.length());
+    sb.append(FILE_PROTOCOL_PREFIX);
+    for (char ch : filename.toCharArray()) {
+      if (ch == '\\') {
+        sb.append(HREF_PATH_SEP);
+      } else {
+        sb.append(ch);
+      }
+    }
+    return sb.toString();
+  } // -- createFileURL
 }
diff --git a/src/main/java/org/owasp/validator/html/util/XMLUtil.java b/src/main/java/org/owasp/validator/html/util/XMLUtil.java
index 901256fd..54b9f988 100644
--- a/src/main/java/org/owasp/validator/html/util/XMLUtil.java
+++ b/src/main/java/org/owasp/validator/html/util/XMLUtil.java
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  * Neither the name of OWASP nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
@@ -24,186 +24,182 @@
 
 package org.owasp.validator.html.util;
 
-import org.w3c.dom.Element;
-import org.w3c.dom.NodeList;
-
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
+import org.w3c.dom.Element;
+import org.w3c.dom.NodeList;
 
 public class XMLUtil {
 
-    private static final Pattern encgt = Pattern.compile("&gt;");
-    private static final Pattern enclt = Pattern.compile("&lt;");
-    private static final Pattern encQuot = Pattern.compile("&quot;");
-    private static final Pattern encAmp = Pattern.compile("&amp;");
-
-    private static final Pattern gt = Pattern.compile(">");
-    private static final Pattern lt = Pattern.compile("<");
-    private static final Pattern quot = Pattern.compile("\"");
-    private static final Pattern amp = Pattern.compile("&");
-
-    /**
-	 * Helper function for quickly retrieving an attribute from a given
-	 * element. 
-	 * @param ele The document element from which to pull the attribute value.
-	 * @param attrName The name of the attribute.
-	 * @return The value of the attribute contained within the element
-	 */
-	public static String getAttributeValue (Element ele, String attrName) {
-		return decode(ele.getAttribute(attrName));
-	}
-	
-	/**
-	 * Helper function for quickly retrieving an integer value of a given
-	 * XML element.
-	 * @param ele The document element from which to pull the integer value.
-	 * @param tagName The name of the node.
-	 * @param defaultValue The default int to return if the specified XML element cannot be found
-	 *           or parsed properly.
-	 * @return The integer value of the given node in the element passed in.
-	 */
-	
-	public static int getIntValue(Element ele, String tagName, int defaultValue) {
-	
-		int toReturn = defaultValue;
-		
-		try {
-			toReturn = Integer.parseInt(getTextValue(ele,tagName));
-		} catch (Throwable t) { }
-			
-		return toReturn;
-	}
-	
-	
-	/**
-	 * Helper function for quickly retrieving a String value of a given
-	 * XML element.
-	 * @param ele The document element from which to pull the String value.
-	 * @param tagName The name of the node.
-	 * @return The String value of the given node in the element passed in.
-	 */
-	public static String getTextValue(Element ele, String tagName) {
-		String textVal = null;
-		NodeList nl = ele.getElementsByTagName(tagName);
-		if(nl != null && nl.getLength() > 0) {
-			Element el = (Element)nl.item(0);
-			if ( el.getFirstChild() != null ) {
-				textVal = el.getFirstChild().getNodeValue();
-			} else {
-				textVal = "";
-			}
-		}
-		return decode(textVal);
-	}
-	
-	
-	/**
-	 * Helper function for quickly retrieving an boolean value of a given
-	 * XML element.
-	 * @param ele The document element from which to pull the boolean value.
-	 * @param tagName The name of the node.
-	 * @return The boolean value of the given node in the element passed in.
-	 */
-	public static boolean getBooleanValue(Element ele, String tagName) {
-		
-		boolean boolVal = false;
-		NodeList nl = ele.getElementsByTagName(tagName);
-		
-		if ( nl != null && nl.getLength() > 0 ) {
-			Element el = (Element)nl.item(0);
-			boolVal = el.getFirstChild().getNodeValue().equals("true");
-		}
-		
-		return boolVal;
-	}
-	
-	/**
-	 * Helper function for quickly retrieving an boolean value of a given
-	 * XML element, with a default initialization value passed in a parameter.
-	 * @param ele The document element from which to pull the boolean value.
-	 * @param tagName The name of the node.
-	 * @param defaultValue The default value of the node if it's value can't be processed.
-	 * @return The boolean value of the given node in the element passed in.
-	 */
-	public static boolean getBooleanValue(Element ele, String tagName, boolean defaultValue) {
-		
-		boolean boolVal = defaultValue;
-		NodeList nl = ele.getElementsByTagName(tagName);
-		
-		if ( nl != null && nl.getLength() > 0 ) {
-			
-			Element el = (Element)nl.item(0);
-			
-			if ( el.getFirstChild().getNodeValue() != null ) {
-			
-				boolVal = "true".equals(el.getFirstChild().getNodeValue());
-
-			} else {
-		
-				boolVal = defaultValue;
-				
-			}
-		}
-		
-		return boolVal;
-	}
-
-
-    /**
-     * Helper function for decode XML entities.
-     *
-     * @param str The XML-encoded String to decode.
-     * @return An XML-decoded String.
-     */
-    public static String decode(String str) {
-
-        if (str == null) {
-            return null;
-        }
-
-        Matcher gtmatcher = encgt.matcher(str);
-        if (gtmatcher.matches()) {
-            str = gtmatcher.replaceAll(">");
-        }
-        Matcher ltmatcher = enclt.matcher(str);
-        if (ltmatcher.matches()) {
-            str = ltmatcher.replaceAll("<");
-        }
-        Matcher quotMatcher = encQuot.matcher(str);
-        if (quotMatcher.matches()) {
-            str = quotMatcher.replaceAll("\"");
-        }
-        Matcher ampMatcher = encAmp.matcher(str);
-        if (ampMatcher.matches()) {
-            str = ampMatcher.replaceAll("&");
-        }
-
-        return str;
+  private static final Pattern encgt = Pattern.compile("&gt;");
+  private static final Pattern enclt = Pattern.compile("&lt;");
+  private static final Pattern encQuot = Pattern.compile("&quot;");
+  private static final Pattern encAmp = Pattern.compile("&amp;");
+
+  private static final Pattern gt = Pattern.compile(">");
+  private static final Pattern lt = Pattern.compile("<");
+  private static final Pattern quot = Pattern.compile("\"");
+  private static final Pattern amp = Pattern.compile("&");
+
+  /**
+   * Helper function for quickly retrieving an attribute from a given element.
+   *
+   * @param ele The document element from which to pull the attribute value.
+   * @param attrName The name of the attribute.
+   * @return The value of the attribute contained within the element
+   */
+  public static String getAttributeValue(Element ele, String attrName) {
+    return decode(ele.getAttribute(attrName));
+  }
+
+  /**
+   * Helper function for quickly retrieving an integer value of a given XML element.
+   *
+   * @param ele The document element from which to pull the integer value.
+   * @param tagName The name of the node.
+   * @param defaultValue The default int to return if the specified XML element cannot be found or
+   *     parsed properly.
+   * @return The integer value of the given node in the element passed in.
+   */
+  public static int getIntValue(Element ele, String tagName, int defaultValue) {
+
+    int toReturn = defaultValue;
+
+    try {
+      toReturn = Integer.parseInt(getTextValue(ele, tagName));
+    } catch (Throwable t) {
+    }
+
+    return toReturn;
+  }
+
+  /**
+   * Helper function for quickly retrieving a String value of a given XML element.
+   *
+   * @param ele The document element from which to pull the String value.
+   * @param tagName The name of the node.
+   * @return The String value of the given node in the element passed in.
+   */
+  public static String getTextValue(Element ele, String tagName) {
+    String textVal = null;
+    NodeList nl = ele.getElementsByTagName(tagName);
+    if (nl != null && nl.getLength() > 0) {
+      Element el = (Element) nl.item(0);
+      if (el.getFirstChild() != null) {
+        textVal = el.getFirstChild().getNodeValue();
+      } else {
+        textVal = "";
+      }
+    }
+    return decode(textVal);
+  }
+
+  /**
+   * Helper function for quickly retrieving an boolean value of a given XML element.
+   *
+   * @param ele The document element from which to pull the boolean value.
+   * @param tagName The name of the node.
+   * @return The boolean value of the given node in the element passed in.
+   */
+  public static boolean getBooleanValue(Element ele, String tagName) {
+
+    boolean boolVal = false;
+    NodeList nl = ele.getElementsByTagName(tagName);
+
+    if (nl != null && nl.getLength() > 0) {
+      Element el = (Element) nl.item(0);
+      boolVal = el.getFirstChild().getNodeValue().equals("true");
+    }
+
+    return boolVal;
+  }
+
+  /**
+   * Helper function for quickly retrieving an boolean value of a given XML element, with a default
+   * initialization value passed in a parameter.
+   *
+   * @param ele The document element from which to pull the boolean value.
+   * @param tagName The name of the node.
+   * @param defaultValue The default value of the node if it's value can't be processed.
+   * @return The boolean value of the given node in the element passed in.
+   */
+  public static boolean getBooleanValue(Element ele, String tagName, boolean defaultValue) {
+
+    boolean boolVal = defaultValue;
+    NodeList nl = ele.getElementsByTagName(tagName);
+
+    if (nl != null && nl.getLength() > 0) {
+
+      Element el = (Element) nl.item(0);
+
+      if (el.getFirstChild().getNodeValue() != null) {
+
+        boolVal = "true".equals(el.getFirstChild().getNodeValue());
+
+      } else {
+
+        boolVal = defaultValue;
+      }
+    }
+
+    return boolVal;
+  }
+
+  /**
+   * Helper function for decode XML entities.
+   *
+   * @param str The XML-encoded String to decode.
+   * @return An XML-decoded String.
+   */
+  public static String decode(String str) {
+
+    if (str == null) {
+      return null;
     }
 
-    public static String encode(String str) {
-
-        if (str == null) {
-            return null;
-        }
-
-        Matcher gtMatcher = gt.matcher(str);
-        if (gtMatcher.matches()) {
-            str = gtMatcher.replaceAll("&gt;");
-        }
-        Matcher ltMatcher = lt.matcher(str);
-        if (ltMatcher.matches()) {
-            str = ltMatcher.replaceAll("&lt;");
-        }
-        Matcher quotMatcher = quot.matcher(str);
-        if (quotMatcher.matches()) {
-            str = quotMatcher.replaceAll("&quot;");
-        }
-        Matcher ampMatcher = amp.matcher(str);
-        if (ampMatcher.matches()) {
-            str = ampMatcher.replaceAll("&amp;");
-        }
-
-        return str;
+    Matcher gtmatcher = encgt.matcher(str);
+    if (gtmatcher.matches()) {
+      str = gtmatcher.replaceAll(">");
+    }
+    Matcher ltmatcher = enclt.matcher(str);
+    if (ltmatcher.matches()) {
+      str = ltmatcher.replaceAll("<");
+    }
+    Matcher quotMatcher = encQuot.matcher(str);
+    if (quotMatcher.matches()) {
+      str = quotMatcher.replaceAll("\"");
     }
+    Matcher ampMatcher = encAmp.matcher(str);
+    if (ampMatcher.matches()) {
+      str = ampMatcher.replaceAll("&");
+    }
+
+    return str;
+  }
+
+  public static String encode(String str) {
+
+    if (str == null) {
+      return null;
+    }
+
+    Matcher gtMatcher = gt.matcher(str);
+    if (gtMatcher.matches()) {
+      str = gtMatcher.replaceAll("&gt;");
+    }
+    Matcher ltMatcher = lt.matcher(str);
+    if (ltMatcher.matches()) {
+      str = ltMatcher.replaceAll("&lt;");
+    }
+    Matcher quotMatcher = quot.matcher(str);
+    if (quotMatcher.matches()) {
+      str = quotMatcher.replaceAll("&quot;");
+    }
+    Matcher ampMatcher = amp.matcher(str);
+    if (ampMatcher.matches()) {
+      str = ampMatcher.replaceAll("&amp;");
+    }
+
+    return str;
+  }
 }
diff --git a/src/main/resources/antisamy-anythinggoes.xml b/src/main/resources/antisamy-anythinggoes.xml
index da6548e1..d07b4c96 100644
--- a/src/main/resources/antisamy-anythinggoes.xml
+++ b/src/main/resources/antisamy-anythinggoes.xml
@@ -1,2644 +1,2640 @@
 <?xml version="1.0" encoding="ISO-8859-1" ?>
 
 
-<!--
-W3C rules retrieved from:
-http://www.w3.org/TR/html401/struct/global.html
--->
+<!-- W3C rules retrieved from: http://www.w3.org/TR/html401/struct/global.html -->
 
 
-<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-		xsi:noNamespaceSchemaLocation="antisamy.xsd">
+<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="antisamy.xsd">
 
-	<directives>
-		<directive name="omitXmlDeclaration" value="true"/>
-		<directive name="omitDoctypeDeclaration" value="true"/>
-		<directive name="maxInputSize" value="200000"/>
-		<directive name="formatOutput" value="true"/>
+    <directives>
+        <directive name="omitXmlDeclaration" value="true" />
+        <directive name="omitDoctypeDeclaration" value="true" />
+        <directive name="maxInputSize" value="200000" />
+        <directive name="formatOutput" value="true" />
 
-		<!--
-		remember, this won't work for relative URIs - AntiSamy doesn't
-		know anything about the URL or your web structure
-		-->
-		<directive name="embedStyleSheets" value="false"/>
-		<directive name="connectionTimeout" value="5000"/>
-		<directive name="maxStyleSheetImports" value="3"/>
+        <!-- remember, this won't work for relative URIs - AntiSamy doesn't know anything about the URL or your web structure -->
+        <directive name="embedStyleSheets" value="false" />
+        <directive name="connectionTimeout" value="5000" />
+        <directive name="maxStyleSheetImports" value="3" />
 
-	</directives>
+    </directives>
 
-	<common-regexps>
+    <common-regexps>
 
-		<!--
-		From W3C:
-		This attribute assigns a class name or set of class names to an
-		element. Any number of elements may be assigned the same class
-		name or names. Multiple class names must be separated by white
-		space characters.
-		-->
+        <!-- From W3C: This attribute assigns a class name or set of class names to an element. Any number of elements may be assigned the same 
+            class name or names. Multiple class names must be separated by white space characters. -->
 
-		<!-- The 16 colors defined by the HTML Spec (also used by the CSS Spec) -->
-		<regexp name="colorName" value="(aqua|black|blue|fuchsia|gray|grey|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow)"/>
+        <!-- The 16 colors defined by the HTML Spec (also used by the CSS Spec) -->
+        <regexp name="colorName"
+            value="(aqua|black|blue|fuchsia|gray|grey|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow)" />
 
-		<!-- HTML/CSS Spec allows 3 or 6 digit hex to specify color -->
-		<regexp name="colorCode" value="(#([0-9a-fA-F]{6}|[0-9a-fA-F]{3}))"/>
+        <!-- HTML/CSS Spec allows 3 or 6 digit hex to specify color -->
+        <regexp name="colorCode" value="(#([0-9a-fA-F]{6}|[0-9a-fA-F]{3}))" />
 
-		<regexp name="anything" value=".*"/>
-		<regexp name="numberOrPercent" value="(\d)+(%{0,1})"/>
-		<regexp name="paragraph" value="([\p{L}\p{N},'\.\s\-_\(\)]|&amp;[0-9]{2};)*"/>
-		<regexp name="htmlId" value="[a-zA-Z0-9\:\-_\.]+"/>
-		<regexp name="htmlTitle" value="[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&amp;]*"/> <!-- force non-empty with a '+' at the end instead of '*' -->
-		<regexp name="htmlClass" value="[a-zA-Z0-9\s,\-_]+"/>
+        <regexp name="anything" value=".*" />
+        <regexp name="numberOrPercent" value="(\d)+(%{0,1})" />
+        <regexp name="paragraph" value="([\p{L}\p{N},'\.\s\-_\(\)]|&amp;[0-9]{2};)*" />
+        <regexp name="htmlId" value="[a-zA-Z0-9\:\-_\.]+" />
+        <regexp name="htmlTitle" value="[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&amp;]*" /> <!-- force non-empty with a '+' at the end instead of '*' -->
+        <regexp name="htmlClass" value="[a-zA-Z0-9\s,\-_]+" />
 
-		<regexp name="onsiteURL" value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*"/>
-		<regexp name="offsiteURL" value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&amp;;:\-_~,\?=/!\(\)]*(\s)*"/>
+        <regexp name="onsiteURL"
+            value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*" />
+        <regexp name="offsiteURL"
+            value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&amp;;:\-_~,\?=/!\(\)]*(\s)*" />
 
-		<regexp name="boolean" value="(true|false)"/>
-		<regexp name="singlePrintable" value="[a-zA-Z0-9]{1}"/> <!-- \w allows the '_' character -->
+        <regexp name="boolean" value="(true|false)" />
+        <regexp name="singlePrintable" value="[a-zA-Z0-9]{1}" /> <!-- \w allows the '_' character -->
 
-		<!-- This is for elements (ex: elemName { ... }) -->
-		<regexp name="cssElementSelector" value="[a-zA-Z0-9-_]+|\*"/>
+        <!-- This is for elements (ex: elemName { ... }) -->
+        <regexp name="cssElementSelector" value="[a-zA-Z0-9-_]+|\*" />
 
-		<!--  This is to list out any element names that are *not* valid -->
-		<regexp name="cssElementExclusion" value=""/>
+        <!-- This is to list out any element names that are *not* valid -->
+        <regexp name="cssElementExclusion" value="" />
 
-		<!--  This if for classes (ex: .className { ... }) -->
-		<regexp name="cssClassSelector" value="\.[a-zA-Z0-9-_]+"/>
+        <!-- This if for classes (ex: .className { ... }) -->
+        <regexp name="cssClassSelector" value="\.[a-zA-Z0-9-_]+" />
 
-		<!--  This is to list out any class names that are *not* valid -->
-		<regexp name="cssClassExclusion" value=""/>
+        <!-- This is to list out any class names that are *not* valid -->
+        <regexp name="cssClassExclusion" value="" />
 
-		<!--  This is for ID selectors (ex: #myId { ... } -->
-		<regexp name="cssIDSelector" value="#[a-zA-Z0-9-_]+"/>
+        <!-- This is for ID selectors (ex: #myId { ... } -->
+        <regexp name="cssIDSelector" value="#[a-zA-Z0-9-_]+" />
 
-		<!--  This is to list out any IDs that are *not* valid - FIXME: What should the default be to avoid div hijacking? *? -->
-		<regexp name="cssIDExclusion" value=""/>
+        <!-- This is to list out any IDs that are *not* valid - FIXME: What should the default be to avoid div hijacking? *? -->
+        <regexp name="cssIDExclusion" value="" />
 
-		<!--  This is for pseudo-element selector (ex. foo:pseudo-element { ... } -->
-		<regexp name="cssPseudoElementSelector" value=":[a-zA-Z0-9\-_]+"/>
+        <!-- This is for pseudo-element selector (ex. foo:pseudo-element { ... } -->
+        <regexp name="cssPseudoElementSelector" value=":[a-zA-Z0-9\-_]+" />
 
-		<!--  This is to list out any psuedo-element names that are *not* valid -->
-		<regexp name="cssPsuedoElementExclusion" value=""/>
+        <!-- This is to list out any psuedo-element names that are *not* valid -->
+        <regexp name="cssPsuedoElementExclusion" value="" />
 
-		<!--  This is for attribute selectors (ex. foo[attr=value] { ... } -->
-		<regexp name="cssAttributeSelector" value="\[[a-zA-Z0-9\-_]+((=|~=|\|=){1}[a-zA-Z0-9\-_]+){1}\]"/>
-
-		<!--  This is to list out any attribute names that are *not* valid -->
-		<regexp name="cssAttributeExclusion" value=""/>
-
-		<!--  This is for resources referenced from CSS (such as background images and other imported stylesheets) -->
-		<regexp name="cssOnsiteUri" value="url\(([\p{L}\p{N}\\/\.\?=\#&amp;;\-_~]+|\#(\w)+)\)"/>
-		<regexp name="cssOffsiteUri" value="url\((\s)*((ht|f)tp(s?)://)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@#$%&amp;;:,\?=/\+!]*(\s)*\)"/>
-
-		<!--  This if for CSS Identifiers -->
-		<regexp name="cssIdentifier" value="[a-zA-Z0-9\-_]+"/>
+        <!-- This is for attribute selectors (ex. foo[attr=value] { ... } -->
+        <regexp name="cssAttributeSelector" value="\[[a-zA-Z0-9\-_]+((=|~=|\|=){1}[a-zA-Z0-9\-_]+){1}\]" />
 
-		<!--  This is for comments within CSS (ex. /* comment */) -->
-		<regexp name="cssCommentText" value="[\p{L}\p{N}\-_,\/\\\.\s\(\)!\?\=\$#%\^&amp;:&quot;']+"/>
-
-		<regexp name="integer" value="(-|\+)?[0-9]+"/>
-		<regexp name="positiveInteger" value="(\+)?[0-9]+"/>
-		<regexp name="number" value="(-|\+)?([0-9]+(\.[0-9]+)?)"/>
-		<regexp name="angle" value="(-|\+)?([0-9]+(\.[0-9]+)?)(deg|grad|rad)"/>
-		<regexp name="time" value="([0-9]+(\.[0-9]+)?)(ms|s)"/>
-		<regexp name="frequency" value="([0-9]+(\.[0-9]+)?)(hz|khz)"/>
-		<regexp name="length" value="((-|\+)?0|(-|\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))"/>
-		<regexp name="positiveLength" value="((\+)?0|(\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))"/>
-		<regexp name="percentage" value="(-|\+)?([0-9]+(\.[0-9]+)?)%"/>
-		<regexp name="positivePercentage" value="(\+)?([0-9]+(\.[0-9]+)?)%"/>
-
-		<regexp name="absolute-size" value="(xx-small|x-small|small|medium|large|x-large|xx-large)"/>
-		<regexp name="relative-size" value="(larger|smaller)"/>
-
-		<!-- Used for CSS Color specifications (complex regexp expresses integer values of 0-255) -->
-		<regexp name="rgbCode" value="rgb\(([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\)"/>
-
-		<!-- CSS2 Allowed System Color Values -->
-		<regexp name="systemColor" value="(activeborder|activecaption|appworkspace|background|buttonface|buttonhighlight|buttonshadow|buttontext|captiontext|graytext|highlight|highlighttext|inactiveborder|inactivecaption|inactivecaptiontext|infobackground|infotext|menu|menutext|scrollbar|threeddarkshadow|threedface|threedhighlight|threedlightshadow|threedshadow|window|windowframe|windowtext)"/>
-
-	</common-regexps>
-
-	<!--
-
-	Tag.name = a, b, div, body, etc.
-	Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, remove: remove tag and contents
-	Attribute.name = id, class, href, align, width, etc.
-	Attribute.onInvalid = what to do when the attribute is invalid, e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag)
-	Attribute.description = What rules in English you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML
-
-	 -->
-
-	<!--
-	Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no
-	collisions between any of these attribute names with attribute names of other tags that are for different purposes.
-	-->
-
-	<common-attributes>
+        <!-- This is to list out any attribute names that are *not* valid -->
+        <regexp name="cssAttributeExclusion" value="" />
 
+        <!-- This is for resources referenced from CSS (such as background images and other imported stylesheets) -->
+        <regexp name="cssOnsiteUri" value="url\(([\p{L}\p{N}\\/\.\?=\#&amp;;\-_~]+|\#(\w)+)\)" />
+        <regexp name="cssOffsiteUri"
+            value="url\((\s)*((ht|f)tp(s?)://)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@#$%&amp;;:,\?=/\+!]*(\s)*\)" />
+
+        <!-- This if for CSS Identifiers -->
+        <regexp name="cssIdentifier" value="[a-zA-Z0-9\-_]+" />
 
-		<!-- Common to all HTML tags  -->
-
-		<attribute name="id" description="The 'id' of any HTML attribute should not contain anything besides letters and numbers">
-			<regexp-list>
-				<regexp name="htmlId"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="class" description="The 'class' of any HTML attribute is usually a single word, but it can also be a list of class names separated by spaces">
-			<regexp-list>
-				<regexp name="htmlClass"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="lang" description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
-		 	<regexp-list>
-		 		<regexp value="[a-zA-Z0-9-]{2,20}"/>
-		 	</regexp-list>
-		 </attribute>
-		 <attribute name="title" description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
-		 	<regexp-list>
-		 		<regexp name="htmlTitle"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="alt" description="The 'alt' attribute provides alternative text to users when its visual representation is not available">
-		 	<regexp-list>
-		 		<regexp name="paragraph"/>
-		 	</regexp-list>
-		 </attribute>
-
-
- 		<!-- the "style" attribute will be validated by an inline stylesheet scanner, so no need to define anything here - i hate having to special case this but no other choice -->
-		 <attribute name="style" description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax"/>
-
-		 <attribute name="media">
-		 	<regexp-list>
-		 		<regexp value="[a-zA-Z0-9,\-\s]+"/>
-		 	</regexp-list>
-		 	
-		 	<literal-list>
-		 		<literal value="screen"/>
-		 		<literal value="tty"/>
-		 		<literal value="tv"/>
-		 		<literal value="projection"/>
-		 		<literal value="handheld"/>
-		 		<literal value="print"/>
-		 		<literal value="braille"/>
-		 		<literal value="aural"/>
-		 		<literal value="all"/>
-		 	</literal-list>
-		 </attribute>
-
-
-		 <!-- Anchor related -->
-
-		 <!--  onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
-		<attribute name="href">
-			<regexp-list>
-				<regexp name="onsiteURL"/>
-				<regexp name="offsiteURL"/>
-			</regexp-list>
-			<literal-list>
-				<literal value="javascript:history.go(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:location.reload()"/>
-			</literal-list>
-		</attribute>
-
-		<attribute name="name">
-		 	<regexp-list>
-
-		 		<regexp value="[a-zA-Z0-9\-_\$]+"/>
-
-		 		<!--
-		 		have to allow the $ for .NET controls - although,
-		 		will users be supplying input that has server-generated
-		 		.NET control names? methinks not, but i want to pass my
-		 		test cases
-		 		-->
-
-		 	</regexp-list>
-		 </attribute>
-
-
-		<attribute name="shape" description="The 'shape' attribute defines the shape of the selectable area">
-			<literal-list>
-				<literal value="default"/>
-				<literal value="rect"/>
-				<literal value="circle"/>
-				<literal value="poly"/>
-			</literal-list>
-		</attribute>
-
-
-
-		<!--  Table attributes  -->
-
-		<attribute name="border">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="cellpadding">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="cellspacing">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="colspan">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="rowspan">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="background">
-			<regexp-list>
-				<regexp name="onsiteURL"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="bgcolor">
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-			</regexp-list>
-		</attribute>
-
-		 <attribute name="abbr">
-			<regexp-list>
-			 	<regexp name="paragraph"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="headers" description="The 'headers' attribute is a space-separated list of cell IDs">
-		 	<regexp-list>
-			 	<regexp value="[a-zA-Z0-9\s*]*"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="charoff">
-		 	<regexp-list>
-		 		<regexp value="numberOrPercent"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="char">
-			<regexp-list>
-				<regexp value=".{0,1}"/>
-			</regexp-list>
-		 </attribute>
-
-
-		<attribute name="axis" description="The 'headers' attribute is a comma-separated list of related header cells">
-		 	<regexp-list>
-			 	<regexp value="[a-zA-Z0-9\s*,]*"/>
-		 	</regexp-list>
-		</attribute>
-
-		<attribute name="nowrap" description="The 'nowrap' attribute tells the browser not to wrap text that goes over one line">
-			<regexp-list>
-				<regexp name="anything"/>
-				<!-- <regexp value="(nowrap){0,1}"/>  -->
-			</regexp-list>
-		</attribute>
-
-
-		<!--  Common positioning attributes  -->
-
-		<attribute name="width">
-			<regexp-list>
-				<regexp name="numberOrPercent"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="height">
-			<regexp-list>
-				<regexp name="numberOrPercent"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="align" description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
-			<literal-list>
-				<literal value="center"/>
-				<literal value="middle"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="justify"/>
-				<literal value="char"/>
-			</literal-list>
-		</attribute>
-
-		<attribute name="valign" description="The 'valign' attribute of an HTML attribute is a direction word, like 'baseline','bottom','middle' or 'top'">
-			<literal-list>
-				<literal value="baseline"/>
-				<literal value="bottom"/>
-				<literal value="middle"/>
-				<literal value="top"/>
-			</literal-list>
-		</attribute>
-
-
-
-		<!-- Intrinsic JavaScript Events -->
-
-		<attribute name="onFocus" description="The 'onFocus' event is executed when the control associated with the tag gains focus">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		</attribute>
-
-		<attribute name="onBlur" description="The 'onBlur' event is executed when the control associated with the tag loses focus">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		</attribute>
-
-		 <attribute name="onClick" description="The 'onClick' event is executed when the control associated with the tag is clicked">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		 <attribute name="onDblClick" description="The 'onDblClick' event is executed when the control associated with the tag is clicked twice immediately">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		  <attribute name="onMouseDown" description="The 'onMouseDown' event is executed when the control associated with the tag is clicked but not yet released">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		 <attribute name="onMouseUp" description="The 'onMouseUp' event is executed when the control associated with the tag is clicked after the button is released">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
- 		 <attribute name="onMouseOver" description="The 'onMouseOver' event is executed when the user's mouse hovers over the control associated with the tag">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		 <attribute name="scope" description="The 'scope' attribute defines what's covered by the header cells">
-		 	<literal-list>
-		 		<literal value="row"/>
-		 		<literal value="col"/>
-		 		<literal value="rowgroup"/>
-		 		<literal value="colgroup"/>
-		 	</literal-list>
-		 </attribute>
-
-
-
-		 <!-- If you want users to be able to mess with tabindex, uncomment this -->
-		 <!--
-		 <attribute name="tabindex" description="...">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-		  -->
-
-
-		 <!-- Input/form related common attributes -->
-
-		 <attribute name="disabled">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="readonly">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>
-		 </attribute>
+        <!-- This is for comments within CSS (ex. /* comment */) -->
+        <regexp name="cssCommentText" value="[\p{L}\p{N}\-_,\/\\\.\s\(\)!\?\=\$#%\^&amp;:&quot;']+" />
 
-		 <attribute name="accesskey">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>
-		 </attribute>
+        <regexp name="integer" value="(-|\+)?[0-9]+" />
+        <regexp name="positiveInteger" value="(\+)?[0-9]+" />
+        <regexp name="number" value="(-|\+)?([0-9]+(\.[0-9]+)?)" />
+        <regexp name="angle" value="(-|\+)?([0-9]+(\.[0-9]+)?)(deg|grad|rad)" />
+        <regexp name="time" value="([0-9]+(\.[0-9]+)?)(ms|s)" />
+        <regexp name="frequency" value="([0-9]+(\.[0-9]+)?)(hz|khz)" />
+        <regexp name="length" value="((-|\+)?0|(-|\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))" />
+        <regexp name="positiveLength" value="((\+)?0|(\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))" />
+        <regexp name="percentage" value="(-|\+)?([0-9]+(\.[0-9]+)?)%" />
+        <regexp name="positivePercentage" value="(\+)?([0-9]+(\.[0-9]+)?)%" />
+
+        <regexp name="absolute-size" value="(xx-small|x-small|small|medium|large|x-large|xx-large)" />
+        <regexp name="relative-size" value="(larger|smaller)" />
+
+        <!-- Used for CSS Color specifications (complex regexp expresses integer values of 0-255) -->
+        <regexp name="rgbCode"
+            value="rgb\(([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\)" />
+
+        <!-- CSS2 Allowed System Color Values -->
+        <regexp name="systemColor"
+            value="(activeborder|activecaption|appworkspace|background|buttonface|buttonhighlight|buttonshadow|buttontext|captiontext|graytext|highlight|highlighttext|inactiveborder|inactivecaption|inactivecaptiontext|infobackground|infotext|menu|menutext|scrollbar|threeddarkshadow|threedface|threedhighlight|threedlightshadow|threedshadow|window|windowframe|windowtext)" />
+
+    </common-regexps>
+
+    <!-- Tag.name = a, b, div, body, etc. Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, 
+        remove: remove tag and contents Attribute.name = id, class, href, align, width, etc. Attribute.onInvalid = what to do when the attribute is invalid, 
+        e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag) Attribute.description = What rules in English 
+        you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML -->
+
+    <!-- Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no collisions 
+        between any of these attribute names with attribute names of other tags that are for different purposes. -->
+
+    <common-attributes>
+
+
+        <!-- Common to all HTML tags -->
+
+        <attribute name="id" description="The 'id' of any HTML attribute should not contain anything besides letters and numbers">
+            <regexp-list>
+                <regexp name="htmlId" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="class"
+            description="The 'class' of any HTML attribute is usually a single word, but it can also be a list of class names separated by spaces">
+            <regexp-list>
+                <regexp name="htmlClass" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="lang"
+            description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9-]{2,20}" />
+            </regexp-list>
+        </attribute>
+        <attribute name="title"
+            description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
+            <regexp-list>
+                <regexp name="htmlTitle" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="alt"
+            description="The 'alt' attribute provides alternative text to users when its visual representation is not available">
+            <regexp-list>
+                <regexp name="paragraph" />
+            </regexp-list>
+        </attribute>
+
+
+        <!-- the "style" attribute will be validated by an inline stylesheet scanner, so no need to define anything here - i hate having to special 
+            case this but no other choice -->
+        <attribute name="style"
+            description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax" />
+
+        <attribute name="media">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9,\-\s]+" />
+            </regexp-list>
+
+            <literal-list>
+                <literal value="screen" />
+                <literal value="tty" />
+                <literal value="tv" />
+                <literal value="projection" />
+                <literal value="handheld" />
+                <literal value="print" />
+                <literal value="braille" />
+                <literal value="aural" />
+                <literal value="all" />
+            </literal-list>
+        </attribute>
+
+
+        <!-- Anchor related -->
+
+        <!-- onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
+        <attribute name="href">
+            <regexp-list>
+                <regexp name="onsiteURL" />
+                <regexp name="offsiteURL" />
+            </regexp-list>
+            <literal-list>
+                <literal value="javascript:history.go(0)" />
+                <literal value="javascript:history.go(-1)" />
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:location.reload()" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="name">
+            <regexp-list>
+
+                <regexp value="[a-zA-Z0-9\-_\$]+" />
+
+                <!-- have to allow the $ for .NET controls - although, will users be supplying input that has server-generated .NET control names? 
+                    methinks not, but i want to pass my test cases -->
+
+            </regexp-list>
+        </attribute>
+
+
+        <attribute name="shape" description="The 'shape' attribute defines the shape of the selectable area">
+            <literal-list>
+                <literal value="default" />
+                <literal value="rect" />
+                <literal value="circle" />
+                <literal value="poly" />
+            </literal-list>
+        </attribute>
+
+
+
+        <!-- Table attributes -->
+
+        <attribute name="border">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cellpadding">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cellspacing">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="colspan">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="rowspan">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="background">
+            <regexp-list>
+                <regexp name="onsiteURL" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="bgcolor">
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="abbr">
+            <regexp-list>
+                <regexp name="paragraph" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="headers" description="The 'headers' attribute is a space-separated list of cell IDs">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9\s*]*" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="charoff">
+            <regexp-list>
+                <regexp value="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="char">
+            <regexp-list>
+                <regexp value=".{0,1}" />
+            </regexp-list>
+        </attribute>
+
+
+        <attribute name="axis" description="The 'headers' attribute is a comma-separated list of related header cells">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9\s*,]*" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="nowrap" description="The 'nowrap' attribute tells the browser not to wrap text that goes over one line">
+            <regexp-list>
+                <regexp name="anything" />
+                <!-- <regexp value="(nowrap){0,1}"/> -->
+            </regexp-list>
+        </attribute>
+
+
+        <!-- Common positioning attributes -->
+
+        <attribute name="width">
+            <regexp-list>
+                <regexp name="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="height">
+            <regexp-list>
+                <regexp name="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="align"
+            description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
+            <literal-list>
+                <literal value="center" />
+                <literal value="middle" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="justify" />
+                <literal value="char" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="valign"
+            description="The 'valign' attribute of an HTML attribute is a direction word, like 'baseline','bottom','middle' or 'top'">
+            <literal-list>
+                <literal value="baseline" />
+                <literal value="bottom" />
+                <literal value="middle" />
+                <literal value="top" />
+            </literal-list>
+        </attribute>
+
+
+
+        <!-- Intrinsic JavaScript Events -->
+
+        <attribute name="onFocus"
+            description="The 'onFocus' event is executed when the control associated with the tag gains focus">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onBlur" description="The 'onBlur' event is executed when the control associated with the tag loses focus">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onClick"
+            description="The 'onClick' event is executed when the control associated with the tag is clicked">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onDblClick"
+            description="The 'onDblClick' event is executed when the control associated with the tag is clicked twice immediately">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseDown"
+            description="The 'onMouseDown' event is executed when the control associated with the tag is clicked but not yet released">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseUp"
+            description="The 'onMouseUp' event is executed when the control associated with the tag is clicked after the button is released">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseOver"
+            description="The 'onMouseOver' event is executed when the user's mouse hovers over the control associated with the tag">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="scope" description="The 'scope' attribute defines what's covered by the header cells">
+            <literal-list>
+                <literal value="row" />
+                <literal value="col" />
+                <literal value="rowgroup" />
+                <literal value="colgroup" />
+            </literal-list>
+        </attribute>
+
+
+
+        <!-- If you want users to be able to mess with tabindex, uncomment this -->
+        <!-- <attribute name="tabindex" description="..."> <regexp-list> <regexp name="number"/> </regexp-list> </attribute> -->
+
+
+        <!-- Input/form related common attributes -->
+
+        <attribute name="disabled">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="readonly">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
 
-		 <attribute name="size">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
+        <attribute name="accesskey">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
 
+        <attribute name="size">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
 
-		<attribute name="autocomplete">
-			<literal-list>
-				<literal value="on"/>
-				<literal value="off"/>
-			</literal-list>
-		</attribute>
 
-		 <attribute name="rows">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
+        <attribute name="autocomplete">
+            <literal-list>
+                <literal value="on" />
+                <literal value="off" />
+            </literal-list>
+        </attribute>
 
-		 <attribute name="cols">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
+        <attribute name="rows">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
 
-	</common-attributes>
+        <attribute name="cols">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
 
+    </common-attributes>
 
-	<!--
-	This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue
-	this is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after
-	a while? Even wars of attrition, surely?
-	 -->
 
-	<global-tag-attributes>
-		<!-- Not valid in base, head, html, meta, param, script, style, and title elements. -->
-		<attribute name="id"/>
-		<attribute name="style"/>
-		<attribute name="title"/>
-		<attribute name="class"/>
-		<!-- Not valid in base, br, frame, frameset, hr, iframe, param, and script elements.  -->
-		<attribute name="lang"/>
-	</global-tag-attributes>
+    <!-- This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue this 
+        is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after a while? Even wars of 
+        attrition, surely? -->
 
-	<tags-to-encode>
-		<tag>g</tag>
-		<tag>grin</tag>
-	</tags-to-encode>
+    <global-tag-attributes>
+        <!-- Not valid in base, head, html, meta, param, script, style, and title elements. -->
+        <attribute name="id" />
+        <attribute name="style" />
+        <attribute name="title" />
+        <attribute name="class" />
+        <!-- Not valid in base, br, frame, frameset, hr, iframe, param, and script elements. -->
+        <attribute name="lang" />
+    </global-tag-attributes>
 
-	<tag-rules>
+    <tags-to-encode>
+        <tag>g</tag>
+        <tag>grin</tag>
+    </tags-to-encode>
 
-		<!-- You can mess with this stuff if you know what you're doing -->
+    <tag-rules>
 
-		<tag name="html" action="validate"/>
+        <!-- You can mess with this stuff if you know what you're doing -->
 
-		<tag name="body" action="validate">
-			<attribute name="bgcolor"/>
-		</tag>
+        <tag name="html" action="validate" />
 
-		<tag name="meta" action="filter"/>
+        <tag name="body" action="validate">
+            <attribute name="bgcolor" />
+        </tag>
 
-		<tag name="head" action="validate"/>
+        <tag name="meta" action="filter" />
 
-		<!-- since we're validating the style sheets this is safe to have - switch to "truncate" if the user's html will appear in the html body -->
-		<tag name="title" action="truncate"/>
+        <tag name="head" action="validate" />
 
+        <!-- since we're validating the style sheets this is safe to have - switch to "truncate" if the user's html will appear in the html body -->
+        <tag name="title" action="truncate" />
 
-		<!-- Tags related to JavaScript -->
 
-		<tag name="script" action="remove"/>
-		<tag name="noscript" action="validate"/> <!-- although no javascript can fire inside a noscript tag, css is still a viable attack vector -->
+        <!-- Tags related to JavaScript -->
 
+        <tag name="script" action="remove" />
+        <tag name="noscript" action="validate" /> <!-- although no javascript can fire inside a noscript tag, css is still a viable attack vector -->
 
 
-		<!-- Frame & related tags -->
 
-		<tag name="iframe" action="remove"/>
-		<tag name="frameset" action="remove"/>
-		<tag name="frame" action="remove"/>
+        <!-- Frame & related tags -->
 
+        <tag name="iframe" action="remove" />
+        <tag name="frameset" action="remove" />
+        <tag name="frame" action="remove" />
 
 
-		<!-- Form related tags -->
 
-		<tag name="label" action="validate">
-			<attribute name="for">
-				<regexp-list>
-					<regexp name="htmlId"/>
-				</regexp-list>
-			</attribute>
-		</tag>
+        <!-- Form related tags -->
 
+        <tag name="label" action="validate">
+            <attribute name="for">
+                <regexp-list>
+                    <regexp name="htmlId" />
+                </regexp-list>
+            </attribute>
+        </tag>
 
-		<!--
-			If you wish to enable any of the form related tags, change the tag's action below from "filter" or "remove" to "validate". The attributes have been
-			hardened so this is safe to do, if it's something you want to allow. Beware the <><ing possibilities!
-		 -->
 
-		<tag name="form" action="validate">
+        <!-- If you wish to enable any of the form related tags, change the tag's action below from "filter" or "remove" to "validate". The attributes 
+            have been hardened so this is safe to do, if it's something you want to allow. Beware the <><ing possibilities! -->
 
-			<attribute name="action">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="offsiteURL"/>
-				</regexp-list>
-			</attribute>
+        <tag name="form" action="validate">
 
-			<attribute name="name"/>
+            <attribute name="action">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="offsiteURL" />
+                </regexp-list>
+            </attribute>
 
-			<attribute name="autocomplete"/>
+            <attribute name="name" />
 
-			<attribute name="method">
-				<literal-list>
-					<literal value="post"/>
-					<literal value="get"/>
-				</literal-list>
-			</attribute>
+            <attribute name="autocomplete" />
 
-		</tag>
+            <attribute name="method">
+                <literal-list>
+                    <literal value="post" />
+                    <literal value="get" />
+                </literal-list>
+            </attribute>
 
-		<tag name="button" action="validate">
-			<attribute name="name"/>
-			<attribute name="value">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
+        </tag>
 
-			<attribute name="disabled"/>
-			<attribute name="accesskey"/>
-			<attribute name="type">
-				<literal-list>
-					<literal value="submit"/>
-					<literal value="reset"/>
-					<literal value="button"/>
-				</literal-list>
-			</attribute>
-		</tag>
+        <tag name="button" action="validate">
+            <attribute name="name" />
+            <attribute name="value">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
 
-		<tag name="input" action="validate">
+            <attribute name="disabled" />
+            <attribute name="accesskey" />
+            <attribute name="type">
+                <literal-list>
+                    <literal value="submit" />
+                    <literal value="reset" />
+                    <literal value="button" />
+                </literal-list>
+            </attribute>
+        </tag>
 
-			<attribute name="name"/>
+        <tag name="input" action="validate">
 
-			<attribute name="size"/>
+            <attribute name="name" />
 
-			<attribute name="maxlength">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
+            <attribute name="size" />
 
-			<attribute name="autocomplete"/>
+            <attribute name="maxlength">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
 
-			<attribute name="checked">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
+            <attribute name="autocomplete" />
 
-			<attribute name="alt"/>
+            <attribute name="checked">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
 
-			<attribute name="src">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="offsiteURL"/>
-				</regexp-list>
-			</attribute>
+            <attribute name="alt" />
 
-			<attribute name="usemap">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="type">
-				<literal-list>
-					<literal value="hidden"/>
-					<literal value="text"/>
-					<literal value="password"/>
-					<literal value="radio"/>
-					<literal value="checkbox"/>
-					<literal value="submit"/>
-					<literal value="button"/>
-					<literal value="image"/>
-					<literal value="file"/>
-					<literal value="reset"/>
-				</literal-list>
-			</attribute>
-
-			<attribute name="value">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="disabled"/>
-			<attribute name="readonly"/>
-			<attribute name="accesskey"/>
-
-			<attribute name="border"/>
-
-		</tag>
-
-		<tag name="select" action="validate">
-
-			<attribute name="name"/>
-			<attribute name="disabled"/>
-
-			<attribute name="multiple">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="size"/>
-
-		</tag>
-
-		<tag name="option" action="validate">
-
-			<attribute name="disabled"/>
-
-			<attribute name="value">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="label">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="selected">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-
-		<tag name="textarea" action="validate">
-			<attribute name="rows"/>
-			<attribute name="cols"/>
-			<attribute name="name"/>
-			<attribute name="disabled"/>
-			<attribute name="readonly"/>
-			<attribute name="accesskey"/>
-		</tag>
-
-
-
-
-		<!-- All formatting tags -->
-
-		<tag name="h1" action="validate"/>
-		<tag name="h2" action="validate"/>
-		<tag name="h3" action="validate"/>
-		<tag name="h4" action="validate"/>
-		<tag name="h5" action="validate"/>
-		<tag name="h6" action="validate"/>
-
-		<tag name="p" action="validate">
-			<attribute name="align"/>
-		</tag>
-
-		<tag name="i" action="validate"/>
-		<tag name="b" action="validate"/>
-		<tag name="u" action="validate"/>
-		<tag name="strong" action="validate"/>
-
-		<tag name="em" action="validate"/>
-		<tag name="small" action="validate"/>
-		<tag name="big" action="validate"/>
-		<tag name="pre" action="validate"/>
-		<tag name="code" action="validate"/>
-		<tag name="cite" action="validate"/>
-        <tag name="acronym" action="validate"/>
-        <tag name="abbr" action="validate"/>
-        <tag name="var" action="validate"/>
-        <tag name="kbd" action="validate"/>
-        <tag name="dfn" action="validate"/>
-        <tag name="samp" action="validate"/>
-		<tag name="sub" action="validate"/>
-		<tag name="sup" action="validate"/>
-		<tag name="strike" action="validate"/>
-		<tag name="center" action="validate"/>
-		<tag name="blockquote" action="validate"/>
-
-		<tag name="hr" action="validate"/>
-		<tag name="br" action="validate"/>
-
-		<tag name="font" action="validate">
-			<attribute name="color">
-				<regexp-list>
-					<regexp name="colorName"/>
-					<regexp name="colorCode"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="face">
-				<regexp-list>
-					<regexp value="[\w;, \-]+"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="size">
-				<regexp-list>
-					<regexp value="(\+|-){0,1}(\d)+"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-
-
-		<!-- Anchor and anchor related tags -->
-
-		<tag name="a" action="validate">
-
-			<!--  onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
-			<attribute name="href"/>
-			<attribute name="onFocus"/>
-			<attribute name="onBlur"/>
-			<attribute name="nohref">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="rel">
-				<literal-list>
-					<literal value="nofollow"/>
-				</literal-list>
-			</attribute>
-			<attribute name="name"/>
-
-		</tag>
-
-		<tag name="map" action="validate"/>
-
-		<!-- base tag removed per demo - this could be enabled with literal-list values you allow -->
-		<!--
-		<tag name="base" action="validate">
-			<attribute name="href"/>
-		</tag>
-		-->
+            <attribute name="src">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="offsiteURL" />
+                </regexp-list>
+            </attribute>
 
+            <attribute name="usemap">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                </regexp-list>
+            </attribute>
 
+            <attribute name="type">
+                <literal-list>
+                    <literal value="hidden" />
+                    <literal value="text" />
+                    <literal value="password" />
+                    <literal value="radio" />
+                    <literal value="checkbox" />
+                    <literal value="submit" />
+                    <literal value="button" />
+                    <literal value="image" />
+                    <literal value="file" />
+                    <literal value="reset" />
+                </literal-list>
+            </attribute>
+
+            <attribute name="value">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="disabled" />
+            <attribute name="readonly" />
+            <attribute name="accesskey" />
+
+            <attribute name="border" />
+
+        </tag>
+
+        <tag name="select" action="validate">
+
+            <attribute name="name" />
+            <attribute name="disabled" />
+
+            <attribute name="multiple">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="size" />
+
+        </tag>
+
+        <tag name="option" action="validate">
+
+            <attribute name="disabled" />
+
+            <attribute name="value">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="label">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="selected">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+        <tag name="textarea" action="validate">
+            <attribute name="rows" />
+            <attribute name="cols" />
+            <attribute name="name" />
+            <attribute name="disabled" />
+            <attribute name="readonly" />
+            <attribute name="accesskey" />
+        </tag>
+
+
+
+
+        <!-- All formatting tags -->
+
+        <tag name="h1" action="validate" />
+        <tag name="h2" action="validate" />
+        <tag name="h3" action="validate" />
+        <tag name="h4" action="validate" />
+        <tag name="h5" action="validate" />
+        <tag name="h6" action="validate" />
+
+        <tag name="p" action="validate">
+            <attribute name="align" />
+        </tag>
+
+        <tag name="i" action="validate" />
+        <tag name="b" action="validate" />
+        <tag name="u" action="validate" />
+        <tag name="strong" action="validate" />
+
+        <tag name="em" action="validate" />
+        <tag name="small" action="validate" />
+        <tag name="big" action="validate" />
+        <tag name="pre" action="validate" />
+        <tag name="code" action="validate" />
+        <tag name="cite" action="validate" />
+        <tag name="acronym" action="validate" />
+        <tag name="abbr" action="validate" />
+        <tag name="var" action="validate" />
+        <tag name="kbd" action="validate" />
+        <tag name="dfn" action="validate" />
+        <tag name="samp" action="validate" />
+        <tag name="sub" action="validate" />
+        <tag name="sup" action="validate" />
+        <tag name="strike" action="validate" />
+        <tag name="center" action="validate" />
+        <tag name="blockquote" action="validate" />
+
+        <tag name="hr" action="validate" />
+        <tag name="br" action="validate" />
+
+        <tag name="font" action="validate">
+            <attribute name="color">
+                <regexp-list>
+                    <regexp name="colorName" />
+                    <regexp name="colorCode" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="face">
+                <regexp-list>
+                    <regexp value="[\w;, \-]+" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="size">
+                <regexp-list>
+                    <regexp value="(\+|-){0,1}(\d)+" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+
+        <!-- Anchor and anchor related tags -->
+
+        <tag name="a" action="validate">
+
+            <!-- onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
+            <attribute name="href" />
+            <attribute name="onFocus" />
+            <attribute name="onBlur" />
+            <attribute name="nohref">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+            <attribute name="rel">
+                <literal-list>
+                    <literal value="nofollow" />
+                </literal-list>
+            </attribute>
+            <attribute name="name" />
+
+        </tag>
+
+        <tag name="map" action="validate" />
 
-		<!-- Stylesheet Tags -->
+        <!-- base tag removed per demo - this could be enabled with literal-list values you allow -->
+        <!-- <tag name="base" action="validate"> <attribute name="href"/> </tag> -->
 
-		<tag name="style" action="validate">
-			<attribute name="type">
-				<literal-list>
-					<literal value="text/css"/>
-				</literal-list>
-			</attribute>
-			<attribute name="media"/>
-		</tag>
 
-		<tag name="span" action="validate"/>
 
-		<tag name="div" action="validate">
-			<attribute name="align"/>
-		</tag>
+        <!-- Stylesheet Tags -->
 
-		<!-- <attribute name="id"/>  what could an attacker do if they could overwrite an existing div definition? prolly something bad -->
-		<!-- <attribute name="class"/> what could an attacker do if they could specify any class in the namespace? prolly something bad -->
+        <tag name="style" action="validate">
+            <attribute name="type">
+                <literal-list>
+                    <literal value="text/css" />
+                </literal-list>
+            </attribute>
+            <attribute name="media" />
+        </tag>
 
+        <tag name="span" action="validate" />
 
+        <tag name="div" action="validate">
+            <attribute name="align" />
+        </tag>
 
+        <!-- <attribute name="id"/> what could an attacker do if they could overwrite an existing div definition? prolly something bad -->
+        <!-- <attribute name="class"/> what could an attacker do if they could specify any class in the namespace? prolly something bad -->
 
 
-		<!-- Image & image related tags -->
 
-		<tag name="img" action="validate">
-			<attribute name="src" onInvalid="removeTag">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="offsiteURL"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="name"/>
-			<attribute name="alt"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="border"/>
-			<attribute name="align"/>
 
-			<attribute name="hspace">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
 
-			<attribute name="vspace">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-		</tag>
+        <!-- Image & image related tags -->
 
-		<!-- no way to do this safely without hooking up the same code to @import to embed the remote stylesheet (malicious user could change offsite resource to be malicious after validation -->
-		<!-- <attribute name="href" onInvalid="removeTag"/>  -->
-
-		<tag name="link" action="validate">
-
-			<!-- <attribute name="href" onInvalid="removeTag"/>  -->
-
-			<attribute name="media"/>
-
-			<attribute name="type" onInvalid="removeTag">
-				<literal-list>
-					<literal value="text/css"/>
-					<literal value="application/rss+xml"/>
-					<literal value="image/x-icon"/>
-				</literal-list>
-			</attribute>
-
-			<attribute name="rel">
-				<literal-list>
-					<literal value="stylesheet"/>
-					<literal value="shortcut icon"/>
-					<literal value="search"/>
-					<literal value="copyright"/>
-					<literal value="top"/>
-					<literal value="alternate"/>
-				</literal-list>
-			</attribute>
-		</tag>
-
-
-
-
-
-		<!-- List tags -->
-
-		<tag name="ul" action="validate"/>
-		<tag name="ol" action="validate"/>
-		<tag name="li" action="validate"/>
-
-
-
-
-		<!-- Dictionary tags -->
-
-		<tag name="dd" action="truncate"/>
-		<tag name="dl" action="truncate"/>
-		<tag name="dt" action="truncate"/>
-
-
-
-
-		<!-- Table tags (tbody, thead, tfoot)-->
-
-		<tag name="thead" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="tbody" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="tfoot" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="table" action="validate">
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="border"/>
-			<attribute name="bgcolor"/>
-			<attribute name="cellpadding"/>
-			<attribute name="cellspacing"/>
-			<attribute name="background"/>
-			<attribute name="align"/>
-			<attribute name="noresize">
-				<literal-list>
-					<literal value="noresize"/>
-					<literal value=""/>
-				</literal-list>
-			</attribute>
-		</tag>
-
-		<tag name="td" action="validate">
-			<attribute name="background"/>
-			<attribute name="bgcolor"/>
-			<attribute name="abbr"/>
-			<attribute name="axis"/>
-			<attribute name="headers"/>
-			<attribute name="scope"/>
-			<attribute name="nowrap"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-			<attribute name="colspan"/>
-			<attribute name="rowspan"/>
-		</tag>
-
-		<tag name="th" action="validate">
-			<attribute name="abbr"/>
-			<attribute name="axis"/>
-			<attribute name="headers"/>
-			<attribute name="scope"/>
-			<attribute name="nowrap"/>
-			<attribute name="bgcolor"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-			<attribute name="colspan"/>
-			<attribute name="rowspan"/>
-		</tag>
-
-		<tag name="tr" action="validate">
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="valign"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="background"/>
-		</tag>
-
-		<tag name="colgroup" action="validate">
-
-			<attribute name="span">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="col" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-			<attribute name="span">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="width"/>
-		</tag>
-
-		<tag name="fieldset" action="validate"/>
-		<tag name="legend" action="validate"/>
-
-	</tag-rules>
-
-
-	<!--  CSS validation processing rules  -->
-
-	<css-rules>
-
-		<property name="azimuth" description="This property is most likely to be implemented by mixing the same signal into different channels at differing volumes.">
-			<literal-list>
-				<literal value="left-side"/>
-				<literal value="far-left"/>
-				<literal value="left"/>
-				<literal value="center-left"/>
-				<literal value="center"/>
-				<literal value="center-right"/>
-				<literal value="right"/>
-				<literal value="far-right"/>
-				<literal value="right-side"/>
-				<literal value="behind"/>
-				<literal value="leftwards"/>
-				<literal value="rightwards"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="angle"/>
-			</regexp-list>
-		</property>
-
-		<property name="background" description="The 'background' property is a shorthand property for setting the individual background properties (i.e., 'background-color', 'background-image', 'background-repeat', 'background-attachment' and 'background-position') at the same place in the style sheet.">
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="background-color"/>
-				<shorthand name="background-image"/>
-				<shorthand name="background-repeat"/>
-				<shorthand name="background-attachment"/>
-				<shorthand name="background-position"/>
-			</shorthand-list>
-		</property>
-
-		<property name="background-attachment" description="If a background image is specified, this property specifies whether it is fixed with regard to the viewport ('fixed') or scrolls along with the document ('scroll').">
-			<literal-list>
-				<literal value="scroll"/>
-				<literal value="fixed"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-
-		<property name="background-color" description="This property sets the background color of an element, either a &lt;color&gt; value or the keyword 'transparent', to make the underlying colors shine through.">
-			<literal-list>
-				<literal value="transparent"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-
-		<property name="background-image" description="This property sets the background image of an element.">
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-
-		<property name="background-position" description="If a background image has been specified, this property specifies its initial position.">
-			<literal-list>
-				<literal value="top"/>
-				<literal value="center"/>
-				<literal value="bottom"/>
-				<literal value="left"/>
-				<literal value="center"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="percentage"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-
-		<property name="background-repeat" description="If a background image is specified, this property specifies whether the image is repeated (tiled), and how.">
-			<literal-list>
-				<literal value="repeat"/>
-				<literal value="repeat-x"/>
-				<literal value="repeat-y"/>
-				<literal value="no-repeat"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-
-		<!-- Begin simple properties -->
-		<property name="border-collapse" default="collapse" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="collapse"/>
-				<literal value="separate"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="border-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="transparent"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-top-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-right-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-bottom-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-left-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="bottom" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="caption-side" default="top" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="top"/>
-				<literal value="bottom"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="clear" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="both"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="cue-after" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="cue-before" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="direction" default="ltr" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="ltr"/>
-				<literal value="rtl"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="display" default="inline" description="">
-			<category-list>
-				<category value="all"/>
-			</category-list>
-			<literal-list>
-				<literal value="inline"/>
-				<literal value="block"/>
-				<literal value="list-item"/>
-				<literal value="run-in"/>
-				<literal value="compact"/>
-				<literal value="marker"/>
-				<literal value="table"/>
-				<literal value="inline-table"/>
-				<literal value="table-row-group"/>
-				<literal value="table-header-group"/>
-				<literal value="table-footer-group"/>
-				<literal value="table-row"/>
-				<literal value="table-column-group"/>
-				<literal value="table-column"/>
-				<literal value="table-cell"/>
-				<literal value="table-caption"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="elevation" default="level" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="below"/>
-				<literal value="level"/>
-				<literal value="above"/>
-				<literal value="higher"/>
-				<literal value="lower"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="angle"/>
-			</regexp-list>
-		</property>
-		<property name="empty-cells" default="show" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="show"/>
-				<literal value="hide"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="float" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-size" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="absolute-size"/>
-				<regexp name="relative-size"/>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="font-size-adjust" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="font-stretch" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="wider"/>
-				<literal value="narrower"/>
-				<literal value="ultra-condensed"/>
-				<literal value="extra-condensed"/>
-				<literal value="condensed"/>
-				<literal value="semi-condensed"/>
-				<literal value="semi-expanded"/>
-				<literal value="expanded"/>
-				<literal value="extra-expanded"/>
-				<literal value="ultra-expanded"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-style" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="italic"/>
-				<literal value="oblique"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-variant" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="small-caps"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-weight" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="bold"/>
-				<literal value="bolder"/>
-				<literal value="lighter"/>
-				<literal value="100"/>
-				<literal value="200"/>
-				<literal value="300"/>
-				<literal value="400"/>
-				<literal value="500"/>
-				<literal value="600"/>
-				<literal value="700"/>
-				<literal value="800"/>
-				<literal value="900"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="height" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="left" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="letter-spacing" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="line-height" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="list-style-image" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="list-style-position" default="outside" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inside"/>
-				<literal value="outside"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="list-style-type" default="disc" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="disc"/>
-				<literal value="circle"/>
-				<literal value="square"/>
-				<literal value="decimal"/>
-				<literal value="decimal-leading-zero"/>
-				<literal value="lower-roman"/>
-				<literal value="upper-roman"/>
-				<literal value="lower-greek"/>
-				<literal value="lower-alpha"/>
-				<literal value="lower-latin"/>
-				<literal value="upper-alpha"/>
-				<literal value="upper-latin"/>
-				<literal value="hebrew"/>
-				<literal value="armenian"/>
-				<literal value="georgian"/>
-				<literal value="cjk-ideographic"/>
-				<literal value="hiragana"/>
-				<literal value="katakana"/>
-				<literal value="hiragana-iroha"/>
-				<literal value="katakana-iroha"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="marker-offset" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="max-height" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="max-width" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="min-height" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="min-width" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="orphans" default="2" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="outline-color" default="invert" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="invert"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="overflow" default="visible" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="visible"/>
-				<literal value="hidden"/>
-				<literal value="scroll"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-after" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="always"/>
-				<literal value="avoid"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-before" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="always"/>
-				<literal value="avoid"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-inside" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="avoid"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="pause-after" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="pause-before" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="pitch" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="x-low"/>
-				<literal value="low"/>
-				<literal value="medium"/>
-				<literal value="high"/>
-				<literal value="x-high"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="frequency"/>
-			</regexp-list>
-		</property>
-		<property name="pitch-range" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="position" default="static" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="static"/>
-				<!-- possible to perform phishing attacks with the following -->
-				<!--
-				<literal value="relative"/>
-				<literal value="absolute"/>
-				<literal value="fixed"/>
-				 -->
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="richness" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="right" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="size" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="portrait"/>
-				<literal value="landscape"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="speak" default="normal" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="none"/>
-				<literal value="spell-out"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-header" default="once" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="once"/>
-				<literal value="always"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-numeral" default="continuous" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="digits"/>
-				<literal value="continuous"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-punctuation" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="code"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speech-rate" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="x-slow"/>
-				<literal value="slow"/>
-				<literal value="medium"/>
-				<literal value="fast"/>
-				<literal value="x-fast"/>
-				<literal value="faster"/>
-				<literal value="slower"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="stress" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="table-layout" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="fixed"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="text-indent" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="text-transform" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="capitalize"/>
-				<literal value="uppercase"/>
-				<literal value="lowercase"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="top" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="unicode-bidi" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="embed"/>
-				<literal value="bidi-override"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="vertical-align" default="baseline" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="baseline"/>
-				<literal value="sub"/>
-				<literal value="super"/>
-				<literal value="top"/>
-				<literal value="text-top"/>
-				<literal value="middle"/>
-				<literal value="bottom"/>
-				<literal value="text-bottom"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="percentage"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="visibility" default="inherit" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="visible"/>
-				<literal value="hidden"/>
-				<literal value="collapse"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="volume" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="silent"/>
-				<literal value="x-soft"/>
-				<literal value="soft"/>
-				<literal value="medium"/>
-				<literal value="loud"/>
-				<literal value="x-loud"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="white-space" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="pre"/>
-				<literal value="nowrap"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="widows" default="2" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="width" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="word-spacing" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-
-		<!-- end simple properties -->
-
-		<!-- begin medium properties -->
-		<property name="border-style" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="none"/>
-				<literal value="hidden"/>
-				<literal value="dotted"/>
-				<literal value="dashed"/>
-				<literal value="solid"/>
-				<literal value="double"/>
-				<literal value="groove"/>
-				<literal value="ridge"/>
-				<literal value="inset"/>
-				<literal value="outset"/>
-			</literal-list>
-		</property>
-		<property name="border-top-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="border-right-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-top-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-right-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-width" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="thin"/>
-				<literal value="medium"/>
-				<literal value="thick"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="margin" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="auto"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="positiveLength"/>
-				<regexp name="positivePercentage"/>
-			</regexp-list>
-		</property>
-		<property name="margin-top" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-right" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-bottom" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-left" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="outline-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="outline-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="padding" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="padding-top" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-right" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-bottom" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-left" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<!-- end medium properties -->
-
-		<!-- begin hard properties -->
-		<property name="border" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-top" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-right" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="cue" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="cue-before"/>
-				<shorthand name="cue-after"/>
-			</shorthand-list>
-		</property>
-		<property name="list-style" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="list-style-type"/>
-				<shorthand name="list-style-position"/>
-				<shorthand name="list-style-image"/>
-			</shorthand-list>
-		</property>
-		<property name="marks" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="crop"/>
-				<literal value="cross"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="outline" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="outline-color"/>
-				<shorthand name="outline-style"/>
-				<shorthand name="outline-width"/>
-			</shorthand-list>
-		</property>
-		<property name="pause" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="text-decoration" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="underline"/>
-				<literal value="overline"/>
-				<literal value="line-through"/>
-				<literal value="blink"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<!-- end hard properties -->
-		<!--  begin manual properties -->
-		<property name="border-spacing" default="0" description="The lengths specify the distance that separates adjacent cell borders. If one length is specified, it gives both the horizontal and vertical spacing. If two are specified, the first gives the horizontal spacing and the second the vertical spacing. Lengths may not be negative.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="clip" default="auto" description="The 'clip' property applies to elements that have a 'overflow' property with a value other than 'visible'.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="counter-increment" default="none" description="The 'counter-increment' property accepts one or more names of counters (identifiers), each one optionally followed by an integer.">
-			<category-list>
-				<category value="all"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssIdentifier"/>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="cursor" default="auto" description="This property specifies the type of cursor to be displayed for the pointing device.">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-				<literal value="crosshair"/>
-				<literal value="default"/>
-				<literal value="pointer"/>
-				<literal value="move"/>
-				<literal value="e-resize"/>
-				<literal value="ne-resize"/>
-				<literal value="nw-resize"/>
-				<literal value="n-resize"/>
-				<literal value="se-resize"/>
-				<literal value="sw-resize"/>
-				<literal value="s-resize"/>
-				<literal value="w-resize| text"/>
-				<literal value="wait"/>
-				<literal value="help"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-
-		<property name="text-shadow" default="none" description="This property accepts a comma-separated list of shadow effects to be applied to the text of the element.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-
-		<property name="font" description="The 'font' property is, except as described below, a shorthand property for setting 'font-style', 'font-variant', 'font-weight', 'font-size', 'line-height', and 'font-family', at the same place in the style sheet.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="/"/>
-				<literal value="caption"/>
-				<literal value="icon"/>
-				<literal value="menu"/>
-				<literal value="message-box"/>
-				<literal value="small-caption"/>
-				<literal value="status-bar"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="font-style"/>
-				<shorthand name="font-variant"/>
-				<shorthand name="font-weight"/>
-				<shorthand name="font-size"/>
-				<shorthand name="line-height"/>
-				<shorthand name="font-family"/>
-			</shorthand-list>
-		</property>
-
-		<property name="font-family" description="This property specifies a prioritized list of font family names and/or generic family names.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<!-- allowing only generic font families -->
-			<literal-list>
-				<literal value="serif"/>
-				<literal value="arial"/>
-				<literal value="lucida console"/>
-				<literal value="sans-serif"/>
-				<literal value="cursive"/>
-				<literal value="verdana"/>
-				<literal value="fantasy"/>
-				<literal value="monospace"/>
-			</literal-list>
-
-
-			<regexp-list>
-				<regexp value="[\w,\-&apos;&quot; ]+"/>
-			</regexp-list>
-
-		</property>
-		<property name="page" description="The 'page' property can be used to specify a particular type of page where an element should be displayed.">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssIdentifier"/>
-			</regexp-list>
-		</property>
-		<property name="play-during" default="auto" description="Similar to the 'cue-before' and 'cue-after' properties, this property specifies a sound to be played as a background while an element's content is spoken.">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="mix"/>
-				<literal value="repeat"/>
-				<literal value="none"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="text-align" description="This property describes how inline content of a block is aligned.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<!--  For safety, ignoring string alignment which can be used to line table cells on characters -->
-			<literal-list>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="center"/>
-				<literal value="justify"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="voice-family" description="The value is a comma-separated, prioritized list of voice family names (compare with 'font-family').">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<!--  Allowing only generic voice family -->
-			<literal-list>
-				<literal value="male"/>
-				<literal value="female"/>
-				<literal value="child"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<!--  end manual properties -->
-	</css-rules>
-<allowed-empty-tags>
+        <tag name="img" action="validate">
+            <attribute name="src" onInvalid="removeTag">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="offsiteURL" />
+                </regexp-list>
+            </attribute>
+            <attribute name="name" />
+            <attribute name="alt" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="border" />
+            <attribute name="align" />
+
+            <attribute name="hspace">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="vspace">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+        <!-- no way to do this safely without hooking up the same code to @import to embed the remote stylesheet (malicious user could change 
+            offsite resource to be malicious after validation -->
+        <!-- <attribute name="href" onInvalid="removeTag"/> -->
+
+        <tag name="link" action="validate">
+
+            <!-- <attribute name="href" onInvalid="removeTag"/> -->
+
+            <attribute name="media" />
+
+            <attribute name="type" onInvalid="removeTag">
+                <literal-list>
+                    <literal value="text/css" />
+                    <literal value="application/rss+xml" />
+                    <literal value="image/x-icon" />
+                </literal-list>
+            </attribute>
+
+            <attribute name="rel">
+                <literal-list>
+                    <literal value="stylesheet" />
+                    <literal value="shortcut icon" />
+                    <literal value="search" />
+                    <literal value="copyright" />
+                    <literal value="top" />
+                    <literal value="alternate" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+
+
+
+
+        <!-- List tags -->
+
+        <tag name="ul" action="validate" />
+        <tag name="ol" action="validate" />
+        <tag name="li" action="validate" />
+
+
+
+
+        <!-- Dictionary tags -->
+
+        <tag name="dd" action="truncate" />
+        <tag name="dl" action="truncate" />
+        <tag name="dt" action="truncate" />
+
+
+
+
+        <!-- Table tags (tbody, thead, tfoot) -->
+
+        <tag name="thead" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="tbody" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="tfoot" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="table" action="validate">
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="border" />
+            <attribute name="bgcolor" />
+            <attribute name="cellpadding" />
+            <attribute name="cellspacing" />
+            <attribute name="background" />
+            <attribute name="align" />
+            <attribute name="noresize">
+                <literal-list>
+                    <literal value="noresize" />
+                    <literal value="" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+        <tag name="td" action="validate">
+            <attribute name="background" />
+            <attribute name="bgcolor" />
+            <attribute name="abbr" />
+            <attribute name="axis" />
+            <attribute name="headers" />
+            <attribute name="scope" />
+            <attribute name="nowrap" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="colspan" />
+            <attribute name="rowspan" />
+        </tag>
+
+        <tag name="th" action="validate">
+            <attribute name="abbr" />
+            <attribute name="axis" />
+            <attribute name="headers" />
+            <attribute name="scope" />
+            <attribute name="nowrap" />
+            <attribute name="bgcolor" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="colspan" />
+            <attribute name="rowspan" />
+        </tag>
+
+        <tag name="tr" action="validate">
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="valign" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="background" />
+        </tag>
+
+        <tag name="colgroup" action="validate">
+
+            <attribute name="span">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="col" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="span">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+            <attribute name="width" />
+        </tag>
+
+        <tag name="fieldset" action="validate" />
+        <tag name="legend" action="validate" />
+
+    </tag-rules>
+
+
+    <!-- CSS validation processing rules -->
+
+    <css-rules>
+
+        <property name="azimuth"
+            description="This property is most likely to be implemented by mixing the same signal into different channels at differing volumes.">
+            <literal-list>
+                <literal value="left-side" />
+                <literal value="far-left" />
+                <literal value="left" />
+                <literal value="center-left" />
+                <literal value="center" />
+                <literal value="center-right" />
+                <literal value="right" />
+                <literal value="far-right" />
+                <literal value="right-side" />
+                <literal value="behind" />
+                <literal value="leftwards" />
+                <literal value="rightwards" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="angle" />
+            </regexp-list>
+        </property>
+
+        <property name="background"
+            description="The 'background' property is a shorthand property for setting the individual background properties (i.e., 'background-color', 'background-image', 'background-repeat', 'background-attachment' and 'background-position') at the same place in the style sheet.">
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="background-color" />
+                <shorthand name="background-image" />
+                <shorthand name="background-repeat" />
+                <shorthand name="background-attachment" />
+                <shorthand name="background-position" />
+            </shorthand-list>
+        </property>
+
+        <property name="background-attachment"
+            description="If a background image is specified, this property specifies whether it is fixed with regard to the viewport ('fixed') or scrolls along with the document ('scroll').">
+            <literal-list>
+                <literal value="scroll" />
+                <literal value="fixed" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+
+        <property name="background-color"
+            description="This property sets the background color of an element, either a &lt;color&gt; value or the keyword 'transparent', to make the underlying colors shine through.">
+            <literal-list>
+                <literal value="transparent" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+
+        <property name="background-image" description="This property sets the background image of an element.">
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+
+        <property name="background-position"
+            description="If a background image has been specified, this property specifies its initial position.">
+            <literal-list>
+                <literal value="top" />
+                <literal value="center" />
+                <literal value="bottom" />
+                <literal value="left" />
+                <literal value="center" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="percentage" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <property name="background-repeat"
+            description="If a background image is specified, this property specifies whether the image is repeated (tiled), and how.">
+            <literal-list>
+                <literal value="repeat" />
+                <literal value="repeat-x" />
+                <literal value="repeat-y" />
+                <literal value="no-repeat" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+
+        <!-- Begin simple properties -->
+        <property name="border-collapse" default="collapse" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="collapse" />
+                <literal value="separate" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="border-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="transparent" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-top-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-right-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-bottom-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-left-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="bottom" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="caption-side" default="top" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="top" />
+                <literal value="bottom" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="clear" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="both" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="cue-after" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="cue-before" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="direction" default="ltr" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="ltr" />
+                <literal value="rtl" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="display" default="inline" description="">
+            <category-list>
+                <category value="all" />
+            </category-list>
+            <literal-list>
+                <literal value="inline" />
+                <literal value="block" />
+                <literal value="list-item" />
+                <literal value="run-in" />
+                <literal value="compact" />
+                <literal value="marker" />
+                <literal value="table" />
+                <literal value="inline-table" />
+                <literal value="table-row-group" />
+                <literal value="table-header-group" />
+                <literal value="table-footer-group" />
+                <literal value="table-row" />
+                <literal value="table-column-group" />
+                <literal value="table-column" />
+                <literal value="table-cell" />
+                <literal value="table-caption" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="elevation" default="level" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="below" />
+                <literal value="level" />
+                <literal value="above" />
+                <literal value="higher" />
+                <literal value="lower" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="angle" />
+            </regexp-list>
+        </property>
+        <property name="empty-cells" default="show" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="show" />
+                <literal value="hide" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="float" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-size" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="absolute-size" />
+                <regexp name="relative-size" />
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="font-size-adjust" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="font-stretch" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="wider" />
+                <literal value="narrower" />
+                <literal value="ultra-condensed" />
+                <literal value="extra-condensed" />
+                <literal value="condensed" />
+                <literal value="semi-condensed" />
+                <literal value="semi-expanded" />
+                <literal value="expanded" />
+                <literal value="extra-expanded" />
+                <literal value="ultra-expanded" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-style" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="italic" />
+                <literal value="oblique" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-variant" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="small-caps" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-weight" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="bold" />
+                <literal value="bolder" />
+                <literal value="lighter" />
+                <literal value="100" />
+                <literal value="200" />
+                <literal value="300" />
+                <literal value="400" />
+                <literal value="500" />
+                <literal value="600" />
+                <literal value="700" />
+                <literal value="800" />
+                <literal value="900" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="height" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="left" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="letter-spacing" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="line-height" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="list-style-image" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="list-style-position" default="outside" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inside" />
+                <literal value="outside" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="list-style-type" default="disc" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="disc" />
+                <literal value="circle" />
+                <literal value="square" />
+                <literal value="decimal" />
+                <literal value="decimal-leading-zero" />
+                <literal value="lower-roman" />
+                <literal value="upper-roman" />
+                <literal value="lower-greek" />
+                <literal value="lower-alpha" />
+                <literal value="lower-latin" />
+                <literal value="upper-alpha" />
+                <literal value="upper-latin" />
+                <literal value="hebrew" />
+                <literal value="armenian" />
+                <literal value="georgian" />
+                <literal value="cjk-ideographic" />
+                <literal value="hiragana" />
+                <literal value="katakana" />
+                <literal value="hiragana-iroha" />
+                <literal value="katakana-iroha" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="marker-offset" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="max-height" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="max-width" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="min-height" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="min-width" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="orphans" default="2" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="outline-color" default="invert" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="invert" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="overflow" default="visible" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="visible" />
+                <literal value="hidden" />
+                <literal value="scroll" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-after" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="always" />
+                <literal value="avoid" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-before" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="always" />
+                <literal value="avoid" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-inside" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="avoid" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="pause-after" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="pause-before" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="pitch" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="x-low" />
+                <literal value="low" />
+                <literal value="medium" />
+                <literal value="high" />
+                <literal value="x-high" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="frequency" />
+            </regexp-list>
+        </property>
+        <property name="pitch-range" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="position" default="static" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="static" />
+                <!-- possible to perform phishing attacks with the following -->
+                <!-- <literal value="relative"/> <literal value="absolute"/> <literal value="fixed"/> -->
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="richness" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="right" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="size" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="portrait" />
+                <literal value="landscape" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="speak" default="normal" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="none" />
+                <literal value="spell-out" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-header" default="once" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="once" />
+                <literal value="always" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-numeral" default="continuous" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="digits" />
+                <literal value="continuous" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-punctuation" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="code" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speech-rate" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="x-slow" />
+                <literal value="slow" />
+                <literal value="medium" />
+                <literal value="fast" />
+                <literal value="x-fast" />
+                <literal value="faster" />
+                <literal value="slower" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="stress" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="table-layout" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="fixed" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="text-indent" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="text-transform" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="capitalize" />
+                <literal value="uppercase" />
+                <literal value="lowercase" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="top" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="unicode-bidi" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="embed" />
+                <literal value="bidi-override" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="vertical-align" default="baseline" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="baseline" />
+                <literal value="sub" />
+                <literal value="super" />
+                <literal value="top" />
+                <literal value="text-top" />
+                <literal value="middle" />
+                <literal value="bottom" />
+                <literal value="text-bottom" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="percentage" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="visibility" default="inherit" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="visible" />
+                <literal value="hidden" />
+                <literal value="collapse" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="volume" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="silent" />
+                <literal value="x-soft" />
+                <literal value="soft" />
+                <literal value="medium" />
+                <literal value="loud" />
+                <literal value="x-loud" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="white-space" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="pre" />
+                <literal value="nowrap" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="widows" default="2" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="width" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="word-spacing" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <!-- end simple properties -->
+
+        <!-- begin medium properties -->
+        <property name="border-style" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="none" />
+                <literal value="hidden" />
+                <literal value="dotted" />
+                <literal value="dashed" />
+                <literal value="solid" />
+                <literal value="double" />
+                <literal value="groove" />
+                <literal value="ridge" />
+                <literal value="inset" />
+                <literal value="outset" />
+            </literal-list>
+        </property>
+        <property name="border-top-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="border-right-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-left-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-top-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-right-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-left-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-width" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="thin" />
+                <literal value="medium" />
+                <literal value="thick" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="margin" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="auto" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="positiveLength" />
+                <regexp name="positivePercentage" />
+            </regexp-list>
+        </property>
+        <property name="margin-top" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-right" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-bottom" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-left" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="outline-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="outline-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="padding" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="padding-top" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-right" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-bottom" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-left" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <!-- end medium properties -->
+
+        <!-- begin hard properties -->
+        <property name="border" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-top" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-right" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-left" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="cue" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="cue-before" />
+                <shorthand name="cue-after" />
+            </shorthand-list>
+        </property>
+        <property name="list-style" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="list-style-type" />
+                <shorthand name="list-style-position" />
+                <shorthand name="list-style-image" />
+            </shorthand-list>
+        </property>
+        <property name="marks" default="none" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="crop" />
+                <literal value="cross" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="outline" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="outline-color" />
+                <shorthand name="outline-style" />
+                <shorthand name="outline-width" />
+            </shorthand-list>
+        </property>
+        <property name="pause" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="text-decoration" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="underline" />
+                <literal value="overline" />
+                <literal value="line-through" />
+                <literal value="blink" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <!-- end hard properties -->
+        <!-- begin manual properties -->
+        <property name="border-spacing" default="0"
+            description="The lengths specify the distance that separates adjacent cell borders. If one length is specified, it gives both the horizontal and vertical spacing. If two are specified, the first gives the horizontal spacing and the second the vertical spacing. Lengths may not be negative.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="clip" default="auto"
+            description="The 'clip' property applies to elements that have a 'overflow' property with a value other than 'visible'.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="counter-increment" default="none"
+            description="The 'counter-increment' property accepts one or more names of counters (identifiers), each one optionally followed by an integer.">
+            <category-list>
+                <category value="all" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssIdentifier" />
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="cursor" default="auto"
+            description="This property specifies the type of cursor to be displayed for the pointing device.">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+                <literal value="crosshair" />
+                <literal value="default" />
+                <literal value="pointer" />
+                <literal value="move" />
+                <literal value="e-resize" />
+                <literal value="ne-resize" />
+                <literal value="nw-resize" />
+                <literal value="n-resize" />
+                <literal value="se-resize" />
+                <literal value="sw-resize" />
+                <literal value="s-resize" />
+                <literal value="w-resize| text" />
+                <literal value="wait" />
+                <literal value="help" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+
+        <property name="text-shadow" default="none"
+            description="This property accepts a comma-separated list of shadow effects to be applied to the text of the element.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <property name="font"
+            description="The 'font' property is, except as described below, a shorthand property for setting 'font-style', 'font-variant', 'font-weight', 'font-size', 'line-height', and 'font-family', at the same place in the style sheet.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="/" />
+                <literal value="caption" />
+                <literal value="icon" />
+                <literal value="menu" />
+                <literal value="message-box" />
+                <literal value="small-caption" />
+                <literal value="status-bar" />
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="font-style" />
+                <shorthand name="font-variant" />
+                <shorthand name="font-weight" />
+                <shorthand name="font-size" />
+                <shorthand name="line-height" />
+                <shorthand name="font-family" />
+            </shorthand-list>
+        </property>
+
+        <property name="font-family"
+            description="This property specifies a prioritized list of font family names and/or generic family names.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <!-- allowing only generic font families -->
+            <literal-list>
+                <literal value="serif" />
+                <literal value="arial" />
+                <literal value="lucida console" />
+                <literal value="sans-serif" />
+                <literal value="cursive" />
+                <literal value="verdana" />
+                <literal value="fantasy" />
+                <literal value="monospace" />
+            </literal-list>
+
+
+            <regexp-list>
+                <regexp value="[\w,\-&apos;&quot; ]+" />
+            </regexp-list>
+
+        </property>
+        <property name="page"
+            description="The 'page' property can be used to specify a particular type of page where an element should be displayed.">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssIdentifier" />
+            </regexp-list>
+        </property>
+        <property name="play-during" default="auto"
+            description="Similar to the 'cue-before' and 'cue-after' properties, this property specifies a sound to be played as a background while an element's content is spoken.">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="mix" />
+                <literal value="repeat" />
+                <literal value="none" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="text-align" description="This property describes how inline content of a block is aligned.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <!-- For safety, ignoring string alignment which can be used to line table cells on characters -->
+            <literal-list>
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="center" />
+                <literal value="justify" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="voice-family"
+            description="The value is a comma-separated, prioritized list of voice family names (compare with 'font-family').">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <!-- Allowing only generic voice family -->
+            <literal-list>
+                <literal value="male" />
+                <literal value="female" />
+                <literal value="child" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <!-- end manual properties -->
+    </css-rules>
+    <allowed-empty-tags>
         <literal-list>
-            <literal value="br"/>
-            <literal value="hr"/>
-            <literal value="a"/>
-            <literal value="img"/>
-            <literal value="link"/>
-            <literal value="iframe"/>
-            <literal value="script"/>
-            <literal value="object"/>
-            <literal value="applet"/>
-            <literal value="frame"/>
-            <literal value="base"/>
-            <literal value="param"/>
-            <literal value="meta"/>
-            <literal value="input"/>
-            <literal value="textarea"/>
-            <literal value="embed"/>
-            <literal value="basefont"/>
-            <literal value="col"/>
-            <literal value="div"/>
+            <literal value="br" />
+            <literal value="hr" />
+            <literal value="a" />
+            <literal value="img" />
+            <literal value="link" />
+            <literal value="iframe" />
+            <literal value="script" />
+            <literal value="object" />
+            <literal value="applet" />
+            <literal value="frame" />
+            <literal value="base" />
+            <literal value="param" />
+            <literal value="meta" />
+            <literal value="input" />
+            <literal value="textarea" />
+            <literal value="embed" />
+            <literal value="basefont" />
+            <literal value="col" />
+            <literal value="div" />
         </literal-list>
     </allowed-empty-tags>
 </anti-samy-rules>
diff --git a/src/main/resources/antisamy-ebay.xml b/src/main/resources/antisamy-ebay.xml
index bcbc3f47..1ab846ee 100644
--- a/src/main/resources/antisamy-ebay.xml
+++ b/src/main/resources/antisamy-ebay.xml
@@ -1,2452 +1,2450 @@
 <?xml version="1.0" encoding="ISO-8859-1" ?>
 
 
-<!--
-W3C rules retrieved from:
-http://www.w3.org/TR/html401/struct/global.html
--->
+<!-- W3C rules retrieved from: http://www.w3.org/TR/html401/struct/global.html -->
 
 
-<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-		xsi:noNamespaceSchemaLocation="antisamy.xsd">
+<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="antisamy.xsd">
 
-	<directives>
-		<directive name="omitXmlDeclaration" value="true"/>
-		<directive name="omitDoctypeDeclaration" value="true"/>
-		<directive name="maxInputSize" value="20000"/>
-		<directive name="formatOutput" value="true"/>
+    <directives>
+        <directive name="omitXmlDeclaration" value="true" />
+        <directive name="omitDoctypeDeclaration" value="true" />
+        <directive name="maxInputSize" value="20000" />
+        <directive name="formatOutput" value="true" />
 
-		<!--
-		remember, this won't work for relative URIs - AntiSamy doesn't
-		know anything about the URL or your web structure
-		-->
-		<directive name="embedStyleSheets" value="false"/>
+        <!-- remember, this won't work for relative URIs - AntiSamy doesn't know anything about the URL or your web structure -->
+        <directive name="embedStyleSheets" value="false" />
 
-	</directives>
+    </directives>
 
-	<common-regexps>
+    <common-regexps>
 
-		<!--
-		From W3C:
-		This attribute assigns a class name or set of class names to an
-		element. Any number of elements may be assigned the same class
-		name or names. Multiple class names must be separated by white
-		space characters.
-		-->
+        <!-- From W3C: This attribute assigns a class name or set of class names to an element. Any number of elements may be assigned the same 
+            class name or names. Multiple class names must be separated by white space characters. -->
 
-		<!-- The 16 colors defined by the HTML Spec (also used by the CSS Spec) -->
-		<regexp name="colorName" value="(aqua|black|blue|fuchsia|gray|grey|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow)"/>
+        <!-- The 16 colors defined by the HTML Spec (also used by the CSS Spec) -->
+        <regexp name="colorName"
+            value="(aqua|black|blue|fuchsia|gray|grey|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow)" />
 
-		<!-- HTML/CSS Spec allows 3 or 6 digit hex to specify color -->
-		<regexp name="colorCode" value="(#([0-9a-fA-F]{6}|[0-9a-fA-F]{3}))"/>
+        <!-- HTML/CSS Spec allows 3 or 6 digit hex to specify color -->
+        <regexp name="colorCode" value="(#([0-9a-fA-F]{6}|[0-9a-fA-F]{3}))" />
 
-		<regexp name="anything" value=".*"/>
-		<regexp name="numberOrPercent" value="(\d)+(%{0,1})"/>
-		<regexp name="paragraph" value="([\p{L}\p{N},'\.\s\-_\(\)]|&amp;[0-9]{2};)*"/>
-		<regexp name="htmlId" value="[a-zA-Z0-9\:\-_\.]+"/>
-		<regexp name="htmlTitle" value="[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&amp;]*"/> <!-- force non-empty with a '+' at the end instead of '*' -->
-		<regexp name="htmlClass" value="[a-zA-Z0-9\s,\-_]+"/>
+        <regexp name="anything" value=".*" />
+        <regexp name="numberOrPercent" value="(\d)+(%{0,1})" />
+        <regexp name="paragraph" value="([\p{L}\p{N},'\.\s\-_\(\)]|&amp;[0-9]{2};)*" />
+        <regexp name="htmlId" value="[a-zA-Z0-9\:\-_\.]+" />
+        <regexp name="htmlTitle" value="[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&amp;]*" /> <!-- force non-empty with a '+' at the end instead of '*' -->
+        <regexp name="htmlClass" value="[a-zA-Z0-9\s,\-_]+" />
 
-		<regexp name="onsiteURL" value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*"/>
-		<regexp name="offsiteURL" value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&amp;;:\-_~,\?=/!\(\)]*(\s)*"/>
+        <regexp name="onsiteURL"
+            value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*" />
+        <regexp name="offsiteURL"
+            value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&amp;;:\-_~,\?=/!\(\)]*(\s)*" />
 
-		<regexp name="boolean" value="(true|false)"/>
-		<regexp name="singlePrintable" value="[a-zA-Z0-9]{1}"/> <!-- \w allows the '_' character -->
+        <regexp name="boolean" value="(true|false)" />
+        <regexp name="singlePrintable" value="[a-zA-Z0-9]{1}" /> <!-- \w allows the '_' character -->
 
-		<!-- This is for elements (ex: elemName { ... }) -->
-		<regexp name="cssElementSelector" value="[a-zA-Z0-9\-_]+|\*"/>
+        <!-- This is for elements (ex: elemName { ... }) -->
+        <regexp name="cssElementSelector" value="[a-zA-Z0-9\-_]+|\*" />
 
-		<!--  This is to list out any element names that are *not* valid -->
-		<regexp name="cssElementExclusion" value=""/>
+        <!-- This is to list out any element names that are *not* valid -->
+        <regexp name="cssElementExclusion" value="" />
 
-		<!--  This if for classes (ex: .className { ... }) -->
-		<regexp name="cssClassSelector" value="\.[a-zA-Z0-9\-_]+"/>
+        <!-- This if for classes (ex: .className { ... }) -->
+        <regexp name="cssClassSelector" value="\.[a-zA-Z0-9\-_]+" />
 
-		<!--  This is to list out any class names that are *not* valid -->
-		<regexp name="cssClassExclusion" value=""/>
+        <!-- This is to list out any class names that are *not* valid -->
+        <regexp name="cssClassExclusion" value="" />
 
-		<!--  This is for ID selectors (ex: #myId { ... } -->
-		<regexp name="cssIDSelector" value="#[a-zA-Z0-9\-_]+"/>
+        <!-- This is for ID selectors (ex: #myId { ... } -->
+        <regexp name="cssIDSelector" value="#[a-zA-Z0-9\-_]+" />
 
-		<!--  This is to list out any IDs that are *not* valid - FIXME: What should the default be to avoid div hijacking? *? -->
-		<regexp name="cssIDExclusion" value=""/>
+        <!-- This is to list out any IDs that are *not* valid - FIXME: What should the default be to avoid div hijacking? *? -->
+        <regexp name="cssIDExclusion" value="" />
 
-		<!--  This is for pseudo-element selector (ex. foo:pseudo-element { ... } -->
-		<regexp name="cssPseudoElementSelector" value=":[a-zA-Z0-9\-_]+"/>
+        <!-- This is for pseudo-element selector (ex. foo:pseudo-element { ... } -->
+        <regexp name="cssPseudoElementSelector" value=":[a-zA-Z0-9\-_]+" />
 
-		<!--  This is to list out any psuedo-element names that are *not* valid -->
-		<regexp name="cssPsuedoElementExclusion" value=""/>
+        <!-- This is to list out any psuedo-element names that are *not* valid -->
+        <regexp name="cssPsuedoElementExclusion" value="" />
 
-		<!--  This is for attribute selectors (ex. foo[attr=value] { ... } -->
-		<regexp name="cssAttributeSelector" value="\[[a-zA-Z0-9\-_]+((=|~=|\|=){1}[a-zA-Z0-9\-_]+){1}\]"/>
+        <!-- This is for attribute selectors (ex. foo[attr=value] { ... } -->
+        <regexp name="cssAttributeSelector" value="\[[a-zA-Z0-9\-_]+((=|~=|\|=){1}[a-zA-Z0-9\-_]+){1}\]" />
 
-		<!--  This is to list out any attribute names that are *not* valid -->
-		<regexp name="cssAttributeExclusion" value=""/>
-
-		<!--  This is for resources referenced from CSS (such as background images and other imported stylesheets) -->
-		<regexp name="cssOnsiteUri" value="url\(([\p{L}\p{N}\\/\.\?=\#&amp;;\-_~]+|\#(\w)+)\)"/>
-		<regexp name="cssOffsiteUri" value="url\((\s)*((ht|f)tp(s?)://)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@#$%&amp;;:,\?=/\+!]*(\s)*\)"/>
+        <!-- This is to list out any attribute names that are *not* valid -->
+        <regexp name="cssAttributeExclusion" value="" />
 
-		<!--  This if for CSS Identifiers -->
-		<regexp name="cssIdentifier" value="[a-zA-Z0-9\-_]+"/>
+        <!-- This is for resources referenced from CSS (such as background images and other imported stylesheets) -->
+        <regexp name="cssOnsiteUri" value="url\(([\p{L}\p{N}\\/\.\?=\#&amp;;\-_~]+|\#(\w)+)\)" />
+        <regexp name="cssOffsiteUri"
+            value="url\((\s)*((ht|f)tp(s?)://)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@#$%&amp;;:,\?=/\+!]*(\s)*\)" />
 
-		<!--  This is for comments within CSS (ex. /* comment */) -->
-		<regexp name="cssCommentText" value="[\p{L}\p{N}\-_,\/\\\.\s\(\)!\?\=\$#%\^&amp;:&quot;']+"/>
-
-		<regexp name="integer" value="(-|\+)?[0-9]+"/>
-		<regexp name="positiveInteger" value="(\+)?[0-9]+"/>
-		<regexp name="number" value="(-|\+)?([0-9]+(\.[0-9]+)?)"/>
-		<regexp name="angle" value="(-|\+)?([0-9]+(\.[0-9]+)?)(deg|grad|rad)"/>
-		<regexp name="time" value="([0-9]+(\.[0-9]+)?)(ms|s)"/>
-		<regexp name="frequency" value="([0-9]+(\.[0-9]+)?)(hz|khz)"/>
-		<regexp name="length" value="((-|\+)?0|(-|\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))"/>
-		<regexp name="positiveLength" value="((\+)?0|(\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))"/>
-		<regexp name="percentage" value="(-|\+)?([0-9]+(\.[0-9]+)?)%"/>
-		<regexp name="positivePercentage" value="(\+)?([0-9]+(\.[0-9]+)?)%"/>
+        <!-- This if for CSS Identifiers -->
+        <regexp name="cssIdentifier" value="[a-zA-Z0-9\-_]+" />
 
-		<regexp name="absolute-size" value="(xx-small|x-small|small|medium|large|x-large|xx-large)"/>
-		<regexp name="relative-size" value="(larger|smaller)"/>
-
-		<!-- Used for CSS Color specifications (complex regexp expresses integer values of 0-255) -->
-		<regexp name="rgbCode" value="rgb\(([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\)"/>
-
-		<!-- CSS2 Allowed System Color Values -->
-		<regexp name="systemColor" value="(activeborder|activecaption|appworkspace|background|buttonface|buttonhighlight|buttonshadow|buttontext|captiontext|graytext|highlight|highlighttext|inactiveborder|inactivecaption|inactivecaptiontext|infobackground|infotext|menu|menutext|scrollbar|threeddarkshadow|threedface|threedhighlight|threedlightshadow|threedshadow|window|windowframe|windowtext)"/>
+        <!-- This is for comments within CSS (ex. /* comment */) -->
+        <regexp name="cssCommentText" value="[\p{L}\p{N}\-_,\/\\\.\s\(\)!\?\=\$#%\^&amp;:&quot;']+" />
 
-	</common-regexps>
+        <regexp name="integer" value="(-|\+)?[0-9]+" />
+        <regexp name="positiveInteger" value="(\+)?[0-9]+" />
+        <regexp name="number" value="(-|\+)?([0-9]+(\.[0-9]+)?)" />
+        <regexp name="angle" value="(-|\+)?([0-9]+(\.[0-9]+)?)(deg|grad|rad)" />
+        <regexp name="time" value="([0-9]+(\.[0-9]+)?)(ms|s)" />
+        <regexp name="frequency" value="([0-9]+(\.[0-9]+)?)(hz|khz)" />
+        <regexp name="length" value="((-|\+)?0|(-|\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))" />
+        <regexp name="positiveLength" value="((\+)?0|(\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))" />
+        <regexp name="percentage" value="(-|\+)?([0-9]+(\.[0-9]+)?)%" />
+        <regexp name="positivePercentage" value="(\+)?([0-9]+(\.[0-9]+)?)%" />
 
-	<!--
-
-	Tag.name = a, b, div, body, etc.
-	Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, remove: remove tag and contents
-	Attribute.name = id, class, href, align, width, etc.
-	Attribute.onInvalid = what to do when the attribute is invalid, e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag)
-	Attribute.description = What rules in English you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML
+        <regexp name="absolute-size" value="(xx-small|x-small|small|medium|large|x-large|xx-large)" />
+        <regexp name="relative-size" value="(larger|smaller)" />
 
-	 -->
+        <!-- Used for CSS Color specifications (complex regexp expresses integer values of 0-255) -->
+        <regexp name="rgbCode"
+            value="rgb\(([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\)" />
 
-	<!--
-	Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no
-	collisions between any of these attribute names with attribute names of other tags that are for different purposes.
-	-->
+        <!-- CSS2 Allowed System Color Values -->
+        <regexp name="systemColor"
+            value="(activeborder|activecaption|appworkspace|background|buttonface|buttonhighlight|buttonshadow|buttontext|captiontext|graytext|highlight|highlighttext|inactiveborder|inactivecaption|inactivecaptiontext|infobackground|infotext|menu|menutext|scrollbar|threeddarkshadow|threedface|threedhighlight|threedlightshadow|threedshadow|window|windowframe|windowtext)" />
+
+    </common-regexps>
+
+    <!-- Tag.name = a, b, div, body, etc. Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, 
+        remove: remove tag and contents Attribute.name = id, class, href, align, width, etc. Attribute.onInvalid = what to do when the attribute is invalid, 
+        e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag) Attribute.description = What rules in English 
+        you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML -->
 
-	<common-attributes>
+    <!-- Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no collisions 
+        between any of these attribute names with attribute names of other tags that are for different purposes. -->
 
+    <common-attributes>
 
-		<!-- Common to all HTML tags  -->
 
-		<attribute name="id" description="The 'id' of any HTML attribute should not contain anything besides letters and numbers">
-			<regexp-list>
-				<regexp name="htmlId"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="class" description="The 'class' of any HTML attribute is usually a single word, but it can also be a list of class names separated by spaces">
-			<regexp-list>
-				<regexp name="htmlClass"/>
-			</regexp-list>
-		</attribute>
+        <!-- Common to all HTML tags -->
+
+        <attribute name="id" description="The 'id' of any HTML attribute should not contain anything besides letters and numbers">
+            <regexp-list>
+                <regexp name="htmlId" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="class"
+            description="The 'class' of any HTML attribute is usually a single word, but it can also be a list of class names separated by spaces">
+            <regexp-list>
+                <regexp name="htmlClass" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="lang"
+            description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9-]{2,20}" />
+            </regexp-list>
+        </attribute>
+        <attribute name="title"
+            description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
+            <regexp-list>
+                <regexp name="htmlTitle" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="alt"
+            description="The 'alt' attribute provides alternative text to users when its visual representation is not available">
+            <regexp-list>
+                <regexp name="paragraph" />
+            </regexp-list>
+        </attribute>
+
+
+        <!-- the "style" attribute will be validated by an inline stylesheet scanner, so no need to define anything here - i hate having to special 
+            case this but no other choice -->
+        <attribute name="style"
+            description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax" />
+
+        <attribute name="media">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9,\-\s]+" />
+            </regexp-list>
+
+            <literal-list>
+                <literal value="screen" />
+                <literal value="tty" />
+                <literal value="tv" />
+                <literal value="projection" />
+                <literal value="handheld" />
+                <literal value="print" />
+                <literal value="braille" />
+                <literal value="aural" />
+                <literal value="all" />
+            </literal-list>
+        </attribute>
+
+
+        <!-- Anchor related -->
+
+        <!-- onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
+        <attribute name="href">
+            <regexp-list>
+                <regexp name="onsiteURL" />
+                <regexp name="offsiteURL" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="name">
+            <regexp-list>
+
+                <regexp value="[a-zA-Z0-9\-_\$]+" />
+
+                <!-- have to allow the $ for .NET controls - although, will users be supplying input that has server-generated .NET control names? 
+                    methinks not, but i want to pass my test cases -->
+
+            </regexp-list>
+        </attribute>
+
+
+        <attribute name="shape" description="The 'shape' attribute defines the shape of the selectable area">
+            <literal-list>
+                <literal value="default" />
+                <literal value="rect" />
+                <literal value="circle" />
+                <literal value="poly" />
+            </literal-list>
+        </attribute>
+
+
+
+        <!-- Table attributes -->
+
+        <attribute name="border">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cellpadding">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cellspacing">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="colspan">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="rowspan">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="background">
+            <regexp-list>
+                <regexp name="onsiteURL" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="bgcolor">
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="abbr">
+            <regexp-list>
+                <regexp name="paragraph" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="headers" description="The 'headers' attribute is a space-separated list of cell IDs">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9\s*]*" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="charoff">
+            <regexp-list>
+                <regexp value="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="char">
+            <regexp-list>
+                <regexp value=".{0,1}" />
+            </regexp-list>
+        </attribute>
+
+
+        <attribute name="axis" description="The 'headers' attribute is a comma-separated list of related header cells">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9\s*,]*" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="nowrap" description="The 'nowrap' attribute tells the browser not to wrap text that goes over one line">
+            <regexp-list>
+                <regexp name="anything" />
+                <!-- <regexp value="(nowrap){0,1}"/> -->
+            </regexp-list>
+        </attribute>
+
+
+        <!-- Common positioning attributes -->
+
+        <attribute name="width">
+            <regexp-list>
+                <regexp name="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="height">
+            <regexp-list>
+                <regexp name="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="align"
+            description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
+            <literal-list>
+                <literal value="center" />
+                <literal value="middle" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="justify" />
+                <literal value="char" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="valign"
+            description="The 'valign' attribute of an HTML attribute is a direction word, like 'baseline','bottom','middle' or 'top'">
+            <literal-list>
+                <literal value="baseline" />
+                <literal value="bottom" />
+                <literal value="middle" />
+                <literal value="top" />
+            </literal-list>
+        </attribute>
+
+
+
+        <!-- Intrinsic JavaScript Events -->
+
+        <attribute name="onFocus"
+            description="The 'onFocus' event is executed when the control associated with the tag gains focus">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onBlur" description="The 'onBlur' event is executed when the control associated with the tag loses focus">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onClick"
+            description="The 'onClick' event is executed when the control associated with the tag is clicked">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onDblClick"
+            description="The 'onDblClick' event is executed when the control associated with the tag is clicked twice immediately">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseDown"
+            description="The 'onMouseDown' event is executed when the control associated with the tag is clicked but not yet released">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseUp"
+            description="The 'onMouseUp' event is executed when the control associated with the tag is clicked after the button is released">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseOver"
+            description="The 'onMouseOver' event is executed when the user's mouse hovers over the control associated with the tag">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="scope" description="The 'scope' attribute defines what's covered by the header cells">
+            <literal-list>
+                <literal value="row" />
+                <literal value="col" />
+                <literal value="rowgroup" />
+                <literal value="colgroup" />
+            </literal-list>
+        </attribute>
+
+
+
+        <!-- If you want users to be able to mess with tabindex, uncomment this -->
+        <!-- <attribute name="tabindex" description="..."> <regexp-list> <regexp name="number"/> </regexp-list> </attribute> -->
+
+
+        <!-- Input/form related common attributes -->
+
+        <attribute name="disabled">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="readonly">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="accesskey">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="size">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+
+        <attribute name="autocomplete">
+            <literal-list>
+                <literal value="on" />
+                <literal value="off" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="rows">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cols">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+    </common-attributes>
+
+
+    <!-- This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue this 
+        is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after a while? Even wars of 
+        attrition, surely? -->
+
+    <global-tag-attributes>
+        <!-- Not valid in base, head, html, meta, param, script, style, and title elements. -->
+        <attribute name="id" />
+        <attribute name="style" />
+        <attribute name="title" />
+        <attribute name="class" />
+        <!-- Not valid in base, br, frame, frameset, hr, iframe, param, and script elements. -->
+        <attribute name="lang" />
+    </global-tag-attributes>
+
+    <tags-to-encode>
+        <tag>g</tag>
+        <tag>grin</tag>
+    </tags-to-encode>
+
+    <tag-rules>
+
+        <!-- Tags related to JavaScript -->
+
+        <tag name="script" action="remove" />
+        <tag name="noscript" action="validate" /> <!-- although no javascript can fire inside a noscript tag, css is still a viable attack vector -->
+
+
+
+        <!-- Frame & related tags -->
+
+        <tag name="iframe" action="remove" />
+        <tag name="frameset" action="remove" />
+        <tag name="frame" action="remove" />
 
-		<attribute name="lang" description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
-		 	<regexp-list>
-		 		<regexp value="[a-zA-Z0-9-]{2,20}"/>
-		 	</regexp-list>
-		 </attribute>
-		 <attribute name="title" description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
-		 	<regexp-list>
-		 		<regexp name="htmlTitle"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="alt" description="The 'alt' attribute provides alternative text to users when its visual representation is not available">
-		 	<regexp-list>
-		 		<regexp name="paragraph"/>
-		 	</regexp-list>
-		 </attribute>
-
-
- 		<!-- the "style" attribute will be validated by an inline stylesheet scanner, so no need to define anything here - i hate having to special case this but no other choice -->
-		 <attribute name="style" description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax"/>
-
-		 <attribute name="media">
-		 	<regexp-list>
-		 		<regexp value="[a-zA-Z0-9,\-\s]+"/>
-		 	</regexp-list>
-		 	
-		 	<literal-list>
-		 		<literal value="screen"/>
-		 		<literal value="tty"/>
-		 		<literal value="tv"/>
-		 		<literal value="projection"/>
-		 		<literal value="handheld"/>
-		 		<literal value="print"/>
-		 		<literal value="braille"/>
-		 		<literal value="aural"/>
-		 		<literal value="all"/>
-		 	</literal-list>
-		 </attribute>
-
-
-		 <!-- Anchor related -->
-
-		 <!--  onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
-		<attribute name="href">
-			<regexp-list>
-				<regexp name="onsiteURL"/>
-				<regexp name="offsiteURL"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="name">
-		 	<regexp-list>
-
-		 		<regexp value="[a-zA-Z0-9\-_\$]+"/>
-
-		 		<!--
-		 		have to allow the $ for .NET controls - although,
-		 		will users be supplying input that has server-generated
-		 		.NET control names? methinks not, but i want to pass my
-		 		test cases
-		 		-->
-
-		 	</regexp-list>
-		 </attribute>
-
-
-		<attribute name="shape" description="The 'shape' attribute defines the shape of the selectable area">
-			<literal-list>
-				<literal value="default"/>
-				<literal value="rect"/>
-				<literal value="circle"/>
-				<literal value="poly"/>
-			</literal-list>
-		</attribute>
-
-
-
-		<!--  Table attributes  -->
-
-		<attribute name="border">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="cellpadding">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="cellspacing">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="colspan">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="rowspan">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="background">
-			<regexp-list>
-				<regexp name="onsiteURL"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="bgcolor">
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-			</regexp-list>
-		</attribute>
-
-		 <attribute name="abbr">
-			<regexp-list>
-			 	<regexp name="paragraph"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="headers" description="The 'headers' attribute is a space-separated list of cell IDs">
-		 	<regexp-list>
-			 	<regexp value="[a-zA-Z0-9\s*]*"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="charoff">
-		 	<regexp-list>
-		 		<regexp value="numberOrPercent"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="char">
-			<regexp-list>
-				<regexp value=".{0,1}"/>
-			</regexp-list>
-		 </attribute>
-
-
-		<attribute name="axis" description="The 'headers' attribute is a comma-separated list of related header cells">
-		 	<regexp-list>
-			 	<regexp value="[a-zA-Z0-9\s*,]*"/>
-		 	</regexp-list>
-		</attribute>
-
-		<attribute name="nowrap" description="The 'nowrap' attribute tells the browser not to wrap text that goes over one line">
-			<regexp-list>
-				<regexp name="anything"/>
-				<!-- <regexp value="(nowrap){0,1}"/>  -->
-			</regexp-list>
-		</attribute>
-
-
-		<!--  Common positioning attributes  -->
-
-		<attribute name="width">
-			<regexp-list>
-				<regexp name="numberOrPercent"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="height">
-			<regexp-list>
-				<regexp name="numberOrPercent"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="align" description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
-			<literal-list>
-				<literal value="center"/>
-				<literal value="middle"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="justify"/>
-				<literal value="char"/>
-			</literal-list>
-		</attribute>
-
-		<attribute name="valign" description="The 'valign' attribute of an HTML attribute is a direction word, like 'baseline','bottom','middle' or 'top'">
-			<literal-list>
-				<literal value="baseline"/>
-				<literal value="bottom"/>
-				<literal value="middle"/>
-				<literal value="top"/>
-			</literal-list>
-		</attribute>
-
-
-
-		<!-- Intrinsic JavaScript Events -->
-
-		<attribute name="onFocus" description="The 'onFocus' event is executed when the control associated with the tag gains focus">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		</attribute>
-
-		<attribute name="onBlur" description="The 'onBlur' event is executed when the control associated with the tag loses focus">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		</attribute>
-
-		 <attribute name="onClick" description="The 'onClick' event is executed when the control associated with the tag is clicked">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		 <attribute name="onDblClick" description="The 'onDblClick' event is executed when the control associated with the tag is clicked twice immediately">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		  <attribute name="onMouseDown" description="The 'onMouseDown' event is executed when the control associated with the tag is clicked but not yet released">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		 <attribute name="onMouseUp" description="The 'onMouseUp' event is executed when the control associated with the tag is clicked after the button is released">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
- 		 <attribute name="onMouseOver" description="The 'onMouseOver' event is executed when the user's mouse hovers over the control associated with the tag">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		 <attribute name="scope" description="The 'scope' attribute defines what's covered by the header cells">
-		 	<literal-list>
-		 		<literal value="row"/>
-		 		<literal value="col"/>
-		 		<literal value="rowgroup"/>
-		 		<literal value="colgroup"/>
-		 	</literal-list>
-		 </attribute>
-
-
-
-		 <!-- If you want users to be able to mess with tabindex, uncomment this -->
-		 <!--
-		 <attribute name="tabindex" description="...">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-		  -->
-
-
-		 <!-- Input/form related common attributes -->
-
-		 <attribute name="disabled">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="readonly">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="accesskey">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="size">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-
-
-		<attribute name="autocomplete">
-			<literal-list>
-				<literal value="on"/>
-				<literal value="off"/>
-			</literal-list>
-		</attribute>
-
-		 <attribute name="rows">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="cols">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-
-	</common-attributes>
-
-
-	<!--
-	This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue
-	this is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after
-	a while? Even wars of attrition, surely?
-	 -->
-
-	<global-tag-attributes>
-		<!-- Not valid in base, head, html, meta, param, script, style, and title elements. -->
-		<attribute name="id"/>
-		<attribute name="style"/>
-		<attribute name="title"/>
-		<attribute name="class"/>
-		<!-- Not valid in base, br, frame, frameset, hr, iframe, param, and script elements.  -->
-		<attribute name="lang"/>
-	</global-tag-attributes>
-
-	<tags-to-encode>
-		<tag>g</tag>
-		<tag>grin</tag>
-	</tags-to-encode>
-
-	<tag-rules>
-
-		<!-- Tags related to JavaScript -->
-
-		<tag name="script" action="remove"/>
-		<tag name="noscript" action="validate"/> <!-- although no javascript can fire inside a noscript tag, css is still a viable attack vector -->
-
-
-
-		<!-- Frame & related tags -->
-
-		<tag name="iframe" action="remove"/>
-		<tag name="frameset" action="remove"/>
-		<tag name="frame" action="remove"/>
-
-
-
-		<!-- Form related tags -->
-
-		<tag name="label" action="validate">
-			<attribute name="for">
-				<regexp-list>
-					<regexp name="htmlId"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-
-
-		<!-- All formatting tags -->
-
-		<tag name="h1" action="validate"/>
-		<tag name="h2" action="validate"/>
-		<tag name="h3" action="validate"/>
-		<tag name="h4" action="validate"/>
-		<tag name="h5" action="validate"/>
-		<tag name="h6" action="validate"/>
-
-		<tag name="p" action="validate">
-			<attribute name="align"/>
-		</tag>
-
-		<tag name="i" action="validate"/>
-		<tag name="b" action="validate"/>
-		<tag name="u" action="validate"/>
-		<tag name="strong" action="validate"/>
-
-		<tag name="em" action="validate"/>
-		<tag name="small" action="validate"/>
-		<tag name="big" action="validate"/>
-		<tag name="pre" action="validate"/>
-		<tag name="code" action="validate"/>
-		<tag name="cite" action="validate"/>
-		<tag name="samp" action="validate"/>
-		<tag name="sub" action="validate"/>
-		<tag name="sup" action="validate"/>
-		<tag name="strike" action="validate"/>
-		<tag name="center" action="validate"/>
-		<tag name="blockquote" action="validate"/>
-
-		<tag name="hr" action="validate"/>
-		<tag name="br" action="validate"/>
-
-		<tag name="font" action="validate">
-			<attribute name="color">
-				<regexp-list>
-					<regexp name="colorName"/>
-					<regexp name="colorCode"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="face">
-				<regexp-list>
-					<regexp value="[\w;, \-]+"/>
-				</regexp-list>
-			</attribute>
 
-			<attribute name="size">
-				<regexp-list>
-					<regexp value="(\+|-){0,1}(\d)+"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-
-
-		<!-- Anchor and anchor related tags -->
-
-		<tag name="a" action="validate">
-
-			<!--  onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
-			<attribute name="href"/>
-			<attribute name="onFocus"/>
-			<attribute name="onBlur"/>
-			<attribute name="nohref">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="rel">
-				<literal-list>
-					<literal value="nofollow"/>
-				</literal-list>
-			</attribute>
-			<attribute name="name"/>
 
-		</tag>
+        <!-- Form related tags -->
 
-		<tag name="map" action="validate"/>
+        <tag name="label" action="validate">
+            <attribute name="for">
+                <regexp-list>
+                    <regexp name="htmlId" />
+                </regexp-list>
+            </attribute>
+        </tag>
 
-		<!-- base tag removed per demo - this could be enabled with literal-list values you allow -->
-		<!--
-		<tag name="base" action="validate">
-			<attribute name="href"/>
-		</tag>
-		-->
 
+        <!-- All formatting tags -->
 
+        <tag name="h1" action="validate" />
+        <tag name="h2" action="validate" />
+        <tag name="h3" action="validate" />
+        <tag name="h4" action="validate" />
+        <tag name="h5" action="validate" />
+        <tag name="h6" action="validate" />
 
-		<!-- Stylesheet Tags -->
+        <tag name="p" action="validate">
+            <attribute name="align" />
+        </tag>
+
+        <tag name="i" action="validate" />
+        <tag name="b" action="validate" />
+        <tag name="u" action="validate" />
+        <tag name="strong" action="validate" />
+
+        <tag name="em" action="validate" />
+        <tag name="small" action="validate" />
+        <tag name="big" action="validate" />
+        <tag name="pre" action="validate" />
+        <tag name="code" action="validate" />
+        <tag name="cite" action="validate" />
+        <tag name="samp" action="validate" />
+        <tag name="sub" action="validate" />
+        <tag name="sup" action="validate" />
+        <tag name="strike" action="validate" />
+        <tag name="center" action="validate" />
+        <tag name="blockquote" action="validate" />
+
+        <tag name="hr" action="validate" />
+        <tag name="br" action="validate" />
+
+        <tag name="font" action="validate">
+            <attribute name="color">
+                <regexp-list>
+                    <regexp name="colorName" />
+                    <regexp name="colorCode" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="face">
+                <regexp-list>
+                    <regexp value="[\w;, \-]+" />
+                </regexp-list>
+            </attribute>
 
-		<tag name="style" action="validate">
-			<attribute name="type">
-				<literal-list>
-					<literal value="text/css"/>
-				</literal-list>
-			</attribute>
-			<attribute name="media"/>
-		</tag>
+            <attribute name="size">
+                <regexp-list>
+                    <regexp value="(\+|-){0,1}(\d)+" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+
+        <!-- Anchor and anchor related tags -->
+
+        <tag name="a" action="validate">
+
+            <!-- onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
+            <attribute name="href" />
+            <attribute name="onFocus" />
+            <attribute name="onBlur" />
+            <attribute name="nohref">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+            <attribute name="rel">
+                <literal-list>
+                    <literal value="nofollow" />
+                </literal-list>
+            </attribute>
+            <attribute name="name" />
 
-		<tag name="span" action="validate"/>
+        </tag>
 
-		<tag name="div" action="validate">
-			<attribute name="align"/>
-		</tag>
+        <tag name="map" action="validate" />
 
-		<!-- <attribute name="id"/>  what could an attacker do if they could overwrite an existing div definition? prolly something bad -->
-		<!-- <attribute name="class"/> what could an attacker do if they could specify any class in the namespace? prolly something bad -->
+        <!-- base tag removed per demo - this could be enabled with literal-list values you allow -->
+        <!-- <tag name="base" action="validate"> <attribute name="href"/> </tag> -->
 
-
-		<!-- Image & image related tags -->
-
-		<tag name="img" action="validate">
-			<attribute name="src" onInvalid="removeTag">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="offsiteURL"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="name"/>
-			<attribute name="alt"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="border"/>
-			<attribute name="align"/>
-
-			<attribute name="hspace">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="vspace">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-
-		<!-- no way to do this safely without hooking up the same code to @import to embed the remote stylesheet (malicious user could change offsite resource to be malicious after validation -->
-		<!-- <attribute name="href" onInvalid="removeTag"/>  -->
-
-		<tag name="link" action="validate">
-
-			<!-- <attribute name="href" onInvalid="removeTag"/>  -->
-
-			<attribute name="media"/>
-
-			<attribute name="type" onInvalid="removeTag">
-				<literal-list>
-					<literal value="text/css"/>
-					<literal value="application/rss+xml"/>
-					<literal value="image/x-icon"/>
-				</literal-list>
-			</attribute>
-
-			<attribute name="rel">
-				<literal-list>
-					<literal value="stylesheet"/>
-					<literal value="shortcut icon"/>
-					<literal value="search"/>
-					<literal value="copyright"/>
-					<literal value="top"/>
-					<literal value="alternate"/>
-				</literal-list>
-			</attribute>
-		</tag>
-
-
-
-
-
-		<!-- List tags -->
-
-		<tag name="ul" action="validate"/>
-		<tag name="ol" action="validate"/>
-		<tag name="li" action="validate"/>
-
-
-
-
-		<!-- Dictionary tags -->
-
-		<tag name="dd" action="truncate"/>
-		<tag name="dl" action="truncate"/>
-		<tag name="dt" action="truncate"/>
-
-
-
-
-		<!-- Table tags (tbody, thead, tfoot)-->
-
-		<tag name="thead" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="tbody" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="tfoot" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="table" action="validate">
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="border"/>
-			<attribute name="bgcolor"/>
-			<attribute name="cellpadding"/>
-			<attribute name="cellspacing"/>
-			<attribute name="background"/>
-			<attribute name="align"/>
-			<attribute name="noresize">
-				<literal-list>
-					<literal value="noresize"/>
-					<literal value=""/>
-				</literal-list>
-			</attribute>
-		</tag>
-
-		<tag name="td" action="validate">
-			<attribute name="background"/>
-			<attribute name="bgcolor"/>
-			<attribute name="abbr"/>
-			<attribute name="axis"/>
-			<attribute name="headers"/>
-			<attribute name="scope"/>
-			<attribute name="nowrap"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-			<attribute name="colspan"/>
-			<attribute name="rowspan"/>
-		</tag>
-
-		<tag name="th" action="validate">
-			<attribute name="abbr"/>
-			<attribute name="axis"/>
-			<attribute name="headers"/>
-			<attribute name="scope"/>
-			<attribute name="nowrap"/>
-			<attribute name="bgcolor"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-			<attribute name="colspan"/>
-			<attribute name="rowspan"/>
-		</tag>
-
-		<tag name="tr" action="validate">
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="valign"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="background"/>
-		</tag>
-
-		<tag name="colgroup" action="validate">
-
-			<attribute name="span">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="col" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-			<attribute name="span">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="width"/>
-		</tag>
-
-		<tag name="fieldset" action="validate"/>
-		<tag name="legend" action="validate"/>
-
-	</tag-rules>
-
-
-	<!--  CSS validation processing rules  -->
-
-	<css-rules>
-
-		<property name="azimuth" description="This property is most likely to be implemented by mixing the same signal into different channels at differing volumes.">
-			<literal-list>
-				<literal value="left-side"/>
-				<literal value="far-left"/>
-				<literal value="left"/>
-				<literal value="center-left"/>
-				<literal value="center"/>
-				<literal value="center-right"/>
-				<literal value="right"/>
-				<literal value="far-right"/>
-				<literal value="right-side"/>
-				<literal value="behind"/>
-				<literal value="leftwards"/>
-				<literal value="rightwards"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="angle"/>
-			</regexp-list>
-		</property>
-
-		<property name="background" description="The 'background' property is a shorthand property for setting the individual background properties (i.e., 'background-color', 'background-image', 'background-repeat', 'background-attachment' and 'background-position') at the same place in the style sheet.">
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="background-color"/>
-				<shorthand name="background-image"/>
-				<shorthand name="background-repeat"/>
-				<shorthand name="background-attachment"/>
-				<shorthand name="background-position"/>
-			</shorthand-list>
-		</property>
-
-		<property name="background-attachment" description="If a background image is specified, this property specifies whether it is fixed with regard to the viewport ('fixed') or scrolls along with the document ('scroll').">
-			<literal-list>
-				<literal value="scroll"/>
-				<literal value="fixed"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-
-		<property name="background-color" description="This property sets the background color of an element, either a &lt;color&gt; value or the keyword 'transparent', to make the underlying colors shine through.">
-			<literal-list>
-				<literal value="transparent"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-
-		<property name="background-image" description="This property sets the background image of an element.">
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-
-		<property name="background-position" description="If a background image has been specified, this property specifies its initial position.">
-			<literal-list>
-				<literal value="top"/>
-				<literal value="center"/>
-				<literal value="bottom"/>
-				<literal value="left"/>
-				<literal value="center"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="percentage"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-
-		<property name="background-repeat" description="If a background image is specified, this property specifies whether the image is repeated (tiled), and how.">
-			<literal-list>
-				<literal value="repeat"/>
-				<literal value="repeat-x"/>
-				<literal value="repeat-y"/>
-				<literal value="no-repeat"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-
-		<!-- Begin simple properties -->
-		<property name="border-collapse" default="collapse" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="collapse"/>
-				<literal value="separate"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="border-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="transparent"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-top-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-right-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-bottom-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-left-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="bottom" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="caption-side" default="top" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="top"/>
-				<literal value="bottom"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="clear" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="both"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="cue-after" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="cue-before" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="direction" default="ltr" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="ltr"/>
-				<literal value="rtl"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="display" default="inline" description="">
-			<category-list>
-				<category value="all"/>
-			</category-list>
-			<literal-list>
-				<literal value="inline"/>
-				<literal value="block"/>
-				<literal value="list-item"/>
-				<literal value="run-in"/>
-				<literal value="compact"/>
-				<literal value="marker"/>
-				<literal value="table"/>
-				<literal value="inline-table"/>
-				<literal value="table-row-group"/>
-				<literal value="table-header-group"/>
-				<literal value="table-footer-group"/>
-				<literal value="table-row"/>
-				<literal value="table-column-group"/>
-				<literal value="table-column"/>
-				<literal value="table-cell"/>
-				<literal value="table-caption"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="elevation" default="level" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="below"/>
-				<literal value="level"/>
-				<literal value="above"/>
-				<literal value="higher"/>
-				<literal value="lower"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="angle"/>
-			</regexp-list>
-		</property>
-		<property name="empty-cells" default="show" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="show"/>
-				<literal value="hide"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="float" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-size" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="absolute-size"/>
-				<regexp name="relative-size"/>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="font-size-adjust" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="font-stretch" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="wider"/>
-				<literal value="narrower"/>
-				<literal value="ultra-condensed"/>
-				<literal value="extra-condensed"/>
-				<literal value="condensed"/>
-				<literal value="semi-condensed"/>
-				<literal value="semi-expanded"/>
-				<literal value="expanded"/>
-				<literal value="extra-expanded"/>
-				<literal value="ultra-expanded"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-style" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="italic"/>
-				<literal value="oblique"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-variant" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="small-caps"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-weight" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="bold"/>
-				<literal value="bolder"/>
-				<literal value="lighter"/>
-				<literal value="100"/>
-				<literal value="200"/>
-				<literal value="300"/>
-				<literal value="400"/>
-				<literal value="500"/>
-				<literal value="600"/>
-				<literal value="700"/>
-				<literal value="800"/>
-				<literal value="900"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="height" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="left" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="letter-spacing" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="line-height" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="list-style-image" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="list-style-position" default="outside" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inside"/>
-				<literal value="outside"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="list-style-type" default="disc" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="disc"/>
-				<literal value="circle"/>
-				<literal value="square"/>
-				<literal value="decimal"/>
-				<literal value="decimal-leading-zero"/>
-				<literal value="lower-roman"/>
-				<literal value="upper-roman"/>
-				<literal value="lower-greek"/>
-				<literal value="lower-alpha"/>
-				<literal value="lower-latin"/>
-				<literal value="upper-alpha"/>
-				<literal value="upper-latin"/>
-				<literal value="hebrew"/>
-				<literal value="armenian"/>
-				<literal value="georgian"/>
-				<literal value="cjk-ideographic"/>
-				<literal value="hiragana"/>
-				<literal value="katakana"/>
-				<literal value="hiragana-iroha"/>
-				<literal value="katakana-iroha"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="marker-offset" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="max-height" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="max-width" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="min-height" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="min-width" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="orphans" default="2" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="outline-color" default="invert" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="invert"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="overflow" default="visible" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="visible"/>
-				<literal value="hidden"/>
-				<literal value="scroll"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-after" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="always"/>
-				<literal value="avoid"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-before" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="always"/>
-				<literal value="avoid"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-inside" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="avoid"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="pause-after" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="pause-before" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="pitch" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="x-low"/>
-				<literal value="low"/>
-				<literal value="medium"/>
-				<literal value="high"/>
-				<literal value="x-high"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="frequency"/>
-			</regexp-list>
-		</property>
-		<property name="pitch-range" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="position" default="static" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="static"/>
-				<!-- possible to perform phishing attacks with the following -->
-				<!--
-				<literal value="relative"/>
-				<literal value="absolute"/>
-				<literal value="fixed"/>
-				 -->
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="richness" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="right" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="size" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="portrait"/>
-				<literal value="landscape"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="speak" default="normal" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="none"/>
-				<literal value="spell-out"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-header" default="once" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="once"/>
-				<literal value="always"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-numeral" default="continuous" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="digits"/>
-				<literal value="continuous"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-punctuation" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="code"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speech-rate" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="x-slow"/>
-				<literal value="slow"/>
-				<literal value="medium"/>
-				<literal value="fast"/>
-				<literal value="x-fast"/>
-				<literal value="faster"/>
-				<literal value="slower"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="stress" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="table-layout" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="fixed"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="text-indent" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="text-transform" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="capitalize"/>
-				<literal value="uppercase"/>
-				<literal value="lowercase"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="top" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="unicode-bidi" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="embed"/>
-				<literal value="bidi-override"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="vertical-align" default="baseline" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="baseline"/>
-				<literal value="sub"/>
-				<literal value="super"/>
-				<literal value="top"/>
-				<literal value="text-top"/>
-				<literal value="middle"/>
-				<literal value="bottom"/>
-				<literal value="text-bottom"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="percentage"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="visibility" default="inherit" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="visible"/>
-				<literal value="hidden"/>
-				<literal value="collapse"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="volume" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="silent"/>
-				<literal value="x-soft"/>
-				<literal value="soft"/>
-				<literal value="medium"/>
-				<literal value="loud"/>
-				<literal value="x-loud"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="white-space" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="pre"/>
-				<literal value="nowrap"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="widows" default="2" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="width" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="word-spacing" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-
-		<!-- end simple properties -->
-
-		<!-- begin medium properties -->
-		<property name="border-style" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="none"/>
-				<literal value="hidden"/>
-				<literal value="dotted"/>
-				<literal value="dashed"/>
-				<literal value="solid"/>
-				<literal value="double"/>
-				<literal value="groove"/>
-				<literal value="ridge"/>
-				<literal value="inset"/>
-				<literal value="outset"/>
-			</literal-list>
-		</property>
-		<property name="border-top-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="border-right-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-top-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-right-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-width" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="thin"/>
-				<literal value="medium"/>
-				<literal value="thick"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="margin" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="auto"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="positiveLength"/>
-				<regexp name="positivePercentage"/>
-			</regexp-list>
-		</property>
-		<property name="margin-top" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-right" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-bottom" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-left" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="outline-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="outline-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="padding" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="padding-top" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-right" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-bottom" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-left" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<!-- end medium properties -->
-
-		<!-- begin hard properties -->
-		<property name="border" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-top" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-right" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="cue" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="cue-before"/>
-				<shorthand name="cue-after"/>
-			</shorthand-list>
-		</property>
-		<property name="list-style" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="list-style-type"/>
-				<shorthand name="list-style-position"/>
-				<shorthand name="list-style-image"/>
-			</shorthand-list>
-		</property>
-		<property name="marks" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="crop"/>
-				<literal value="cross"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="outline" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="outline-color"/>
-				<shorthand name="outline-style"/>
-				<shorthand name="outline-width"/>
-			</shorthand-list>
-		</property>
-		<property name="pause" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="text-decoration" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="underline"/>
-				<literal value="overline"/>
-				<literal value="line-through"/>
-				<literal value="blink"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<!-- end hard properties -->
-		<!--  begin manual properties -->
-		<property name="border-spacing" default="0" description="The lengths specify the distance that separates adjacent cell borders. If one length is specified, it gives both the horizontal and vertical spacing. If two are specified, the first gives the horizontal spacing and the second the vertical spacing. Lengths may not be negative.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="clip" default="auto" description="The 'clip' property applies to elements that have a 'overflow' property with a value other than 'visible'.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="counter-increment" default="none" description="The 'counter-increment' property accepts one or more names of counters (identifiers), each one optionally followed by an integer.">
-			<category-list>
-				<category value="all"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssIdentifier"/>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="cursor" default="auto" description="This property specifies the type of cursor to be displayed for the pointing device.">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-				<literal value="crosshair"/>
-				<literal value="default"/>
-				<literal value="pointer"/>
-				<literal value="move"/>
-				<literal value="e-resize"/>
-				<literal value="ne-resize"/>
-				<literal value="nw-resize"/>
-				<literal value="n-resize"/>
-				<literal value="se-resize"/>
-				<literal value="sw-resize"/>
-				<literal value="s-resize"/>
-				<literal value="w-resize| text"/>
-				<literal value="wait"/>
-				<literal value="help"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-
-		<property name="text-shadow" default="none" description="This property accepts a comma-separated list of shadow effects to be applied to the text of the element.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-
-		<property name="font" description="The 'font' property is, except as described below, a shorthand property for setting 'font-style', 'font-variant', 'font-weight', 'font-size', 'line-height', and 'font-family', at the same place in the style sheet.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="/"/>
-				<literal value="caption"/>
-				<literal value="icon"/>
-				<literal value="menu"/>
-				<literal value="message-box"/>
-				<literal value="small-caption"/>
-				<literal value="status-bar"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="font-style"/>
-				<shorthand name="font-variant"/>
-				<shorthand name="font-weight"/>
-				<shorthand name="font-size"/>
-				<shorthand name="line-height"/>
-				<shorthand name="font-family"/>
-			</shorthand-list>
-		</property>
-
-		<property name="font-family" description="This property specifies a prioritized list of font family names and/or generic family names.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<!-- allowing only generic font families -->
-			<literal-list>
-				<literal value="serif"/>
-				<literal value="arial"/>
-				<literal value="lucida console"/>
-				<literal value="sans-serif"/>
-				<literal value="cursive"/>
-				<literal value="verdana"/>
-				<literal value="fantasy"/>
-				<literal value="monospace"/>
-			</literal-list>
-
-
-			<regexp-list>
-				<regexp value="[\w,\-&apos;&quot; ]+"/>
-			</regexp-list>
-
-		</property>
-		<property name="page" description="The 'page' property can be used to specify a particular type of page where an element should be displayed.">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssIdentifier"/>
-			</regexp-list>
-		</property>
-		<property name="play-during" default="auto" description="Similar to the 'cue-before' and 'cue-after' properties, this property specifies a sound to be played as a background while an element's content is spoken.">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="mix"/>
-				<literal value="repeat"/>
-				<literal value="none"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="text-align" description="This property describes how inline content of a block is aligned.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<!--  For safety, ignoring string alignment which can be used to line table cells on characters -->
-			<literal-list>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="center"/>
-				<literal value="justify"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="voice-family" description="The value is a comma-separated, prioritized list of voice family names (compare with 'font-family').">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<!--  Allowing only generic voice family -->
-			<literal-list>
-				<literal value="male"/>
-				<literal value="female"/>
-				<literal value="child"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<!--  end manual properties -->
-	</css-rules>
-<allowed-empty-tags>
+
+
+        <!-- Stylesheet Tags -->
+
+        <tag name="style" action="validate">
+            <attribute name="type">
+                <literal-list>
+                    <literal value="text/css" />
+                </literal-list>
+            </attribute>
+            <attribute name="media" />
+        </tag>
+
+        <tag name="span" action="validate" />
+
+        <tag name="div" action="validate">
+            <attribute name="align" />
+        </tag>
+
+        <!-- <attribute name="id"/> what could an attacker do if they could overwrite an existing div definition? prolly something bad -->
+        <!-- <attribute name="class"/> what could an attacker do if they could specify any class in the namespace? prolly something bad -->
+
+
+        <!-- Image & image related tags -->
+
+        <tag name="img" action="validate">
+            <attribute name="src" onInvalid="removeTag">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="offsiteURL" />
+                </regexp-list>
+            </attribute>
+            <attribute name="name" />
+            <attribute name="alt" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="border" />
+            <attribute name="align" />
+
+            <attribute name="hspace">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="vspace">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+        <!-- no way to do this safely without hooking up the same code to @import to embed the remote stylesheet (malicious user could change 
+            offsite resource to be malicious after validation -->
+        <!-- <attribute name="href" onInvalid="removeTag"/> -->
+
+        <tag name="link" action="validate">
+
+            <!-- <attribute name="href" onInvalid="removeTag"/> -->
+
+            <attribute name="media" />
+
+            <attribute name="type" onInvalid="removeTag">
+                <literal-list>
+                    <literal value="text/css" />
+                    <literal value="application/rss+xml" />
+                    <literal value="image/x-icon" />
+                </literal-list>
+            </attribute>
+
+            <attribute name="rel">
+                <literal-list>
+                    <literal value="stylesheet" />
+                    <literal value="shortcut icon" />
+                    <literal value="search" />
+                    <literal value="copyright" />
+                    <literal value="top" />
+                    <literal value="alternate" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+
+
+
+
+        <!-- List tags -->
+
+        <tag name="ul" action="validate" />
+        <tag name="ol" action="validate" />
+        <tag name="li" action="validate" />
+
+
+
+
+        <!-- Dictionary tags -->
+
+        <tag name="dd" action="truncate" />
+        <tag name="dl" action="truncate" />
+        <tag name="dt" action="truncate" />
+
+
+
+
+        <!-- Table tags (tbody, thead, tfoot) -->
+
+        <tag name="thead" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="tbody" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="tfoot" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="table" action="validate">
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="border" />
+            <attribute name="bgcolor" />
+            <attribute name="cellpadding" />
+            <attribute name="cellspacing" />
+            <attribute name="background" />
+            <attribute name="align" />
+            <attribute name="noresize">
+                <literal-list>
+                    <literal value="noresize" />
+                    <literal value="" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+        <tag name="td" action="validate">
+            <attribute name="background" />
+            <attribute name="bgcolor" />
+            <attribute name="abbr" />
+            <attribute name="axis" />
+            <attribute name="headers" />
+            <attribute name="scope" />
+            <attribute name="nowrap" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="colspan" />
+            <attribute name="rowspan" />
+        </tag>
+
+        <tag name="th" action="validate">
+            <attribute name="abbr" />
+            <attribute name="axis" />
+            <attribute name="headers" />
+            <attribute name="scope" />
+            <attribute name="nowrap" />
+            <attribute name="bgcolor" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="colspan" />
+            <attribute name="rowspan" />
+        </tag>
+
+        <tag name="tr" action="validate">
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="valign" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="background" />
+        </tag>
+
+        <tag name="colgroup" action="validate">
+
+            <attribute name="span">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="col" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="span">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+            <attribute name="width" />
+        </tag>
+
+        <tag name="fieldset" action="validate" />
+        <tag name="legend" action="validate" />
+
+    </tag-rules>
+
+
+    <!-- CSS validation processing rules -->
+
+    <css-rules>
+
+        <property name="azimuth"
+            description="This property is most likely to be implemented by mixing the same signal into different channels at differing volumes.">
+            <literal-list>
+                <literal value="left-side" />
+                <literal value="far-left" />
+                <literal value="left" />
+                <literal value="center-left" />
+                <literal value="center" />
+                <literal value="center-right" />
+                <literal value="right" />
+                <literal value="far-right" />
+                <literal value="right-side" />
+                <literal value="behind" />
+                <literal value="leftwards" />
+                <literal value="rightwards" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="angle" />
+            </regexp-list>
+        </property>
+
+        <property name="background"
+            description="The 'background' property is a shorthand property for setting the individual background properties (i.e., 'background-color', 'background-image', 'background-repeat', 'background-attachment' and 'background-position') at the same place in the style sheet.">
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="background-color" />
+                <shorthand name="background-image" />
+                <shorthand name="background-repeat" />
+                <shorthand name="background-attachment" />
+                <shorthand name="background-position" />
+            </shorthand-list>
+        </property>
+
+        <property name="background-attachment"
+            description="If a background image is specified, this property specifies whether it is fixed with regard to the viewport ('fixed') or scrolls along with the document ('scroll').">
+            <literal-list>
+                <literal value="scroll" />
+                <literal value="fixed" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+
+        <property name="background-color"
+            description="This property sets the background color of an element, either a &lt;color&gt; value or the keyword 'transparent', to make the underlying colors shine through.">
+            <literal-list>
+                <literal value="transparent" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+
+        <property name="background-image" description="This property sets the background image of an element.">
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+
+        <property name="background-position"
+            description="If a background image has been specified, this property specifies its initial position.">
+            <literal-list>
+                <literal value="top" />
+                <literal value="center" />
+                <literal value="bottom" />
+                <literal value="left" />
+                <literal value="center" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="percentage" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <property name="background-repeat"
+            description="If a background image is specified, this property specifies whether the image is repeated (tiled), and how.">
+            <literal-list>
+                <literal value="repeat" />
+                <literal value="repeat-x" />
+                <literal value="repeat-y" />
+                <literal value="no-repeat" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+
+        <!-- Begin simple properties -->
+        <property name="border-collapse" default="collapse" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="collapse" />
+                <literal value="separate" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="border-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="transparent" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-top-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-right-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-bottom-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-left-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="bottom" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="caption-side" default="top" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="top" />
+                <literal value="bottom" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="clear" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="both" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="cue-after" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="cue-before" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="direction" default="ltr" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="ltr" />
+                <literal value="rtl" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="display" default="inline" description="">
+            <category-list>
+                <category value="all" />
+            </category-list>
+            <literal-list>
+                <literal value="inline" />
+                <literal value="block" />
+                <literal value="list-item" />
+                <literal value="run-in" />
+                <literal value="compact" />
+                <literal value="marker" />
+                <literal value="table" />
+                <literal value="inline-table" />
+                <literal value="table-row-group" />
+                <literal value="table-header-group" />
+                <literal value="table-footer-group" />
+                <literal value="table-row" />
+                <literal value="table-column-group" />
+                <literal value="table-column" />
+                <literal value="table-cell" />
+                <literal value="table-caption" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="elevation" default="level" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="below" />
+                <literal value="level" />
+                <literal value="above" />
+                <literal value="higher" />
+                <literal value="lower" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="angle" />
+            </regexp-list>
+        </property>
+        <property name="empty-cells" default="show" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="show" />
+                <literal value="hide" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="float" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-size" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="absolute-size" />
+                <regexp name="relative-size" />
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="font-size-adjust" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="font-stretch" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="wider" />
+                <literal value="narrower" />
+                <literal value="ultra-condensed" />
+                <literal value="extra-condensed" />
+                <literal value="condensed" />
+                <literal value="semi-condensed" />
+                <literal value="semi-expanded" />
+                <literal value="expanded" />
+                <literal value="extra-expanded" />
+                <literal value="ultra-expanded" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-style" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="italic" />
+                <literal value="oblique" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-variant" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="small-caps" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-weight" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="bold" />
+                <literal value="bolder" />
+                <literal value="lighter" />
+                <literal value="100" />
+                <literal value="200" />
+                <literal value="300" />
+                <literal value="400" />
+                <literal value="500" />
+                <literal value="600" />
+                <literal value="700" />
+                <literal value="800" />
+                <literal value="900" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="height" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="left" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="letter-spacing" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="line-height" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="list-style-image" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="list-style-position" default="outside" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inside" />
+                <literal value="outside" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="list-style-type" default="disc" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="disc" />
+                <literal value="circle" />
+                <literal value="square" />
+                <literal value="decimal" />
+                <literal value="decimal-leading-zero" />
+                <literal value="lower-roman" />
+                <literal value="upper-roman" />
+                <literal value="lower-greek" />
+                <literal value="lower-alpha" />
+                <literal value="lower-latin" />
+                <literal value="upper-alpha" />
+                <literal value="upper-latin" />
+                <literal value="hebrew" />
+                <literal value="armenian" />
+                <literal value="georgian" />
+                <literal value="cjk-ideographic" />
+                <literal value="hiragana" />
+                <literal value="katakana" />
+                <literal value="hiragana-iroha" />
+                <literal value="katakana-iroha" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="marker-offset" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="max-height" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="max-width" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="min-height" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="min-width" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="orphans" default="2" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="outline-color" default="invert" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="invert" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="overflow" default="visible" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="visible" />
+                <literal value="hidden" />
+                <literal value="scroll" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-after" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="always" />
+                <literal value="avoid" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-before" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="always" />
+                <literal value="avoid" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-inside" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="avoid" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="pause-after" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="pause-before" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="pitch" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="x-low" />
+                <literal value="low" />
+                <literal value="medium" />
+                <literal value="high" />
+                <literal value="x-high" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="frequency" />
+            </regexp-list>
+        </property>
+        <property name="pitch-range" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="position" default="static" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="static" />
+                <!-- possible to perform phishing attacks with the following -->
+                <!-- <literal value="relative"/> <literal value="absolute"/> <literal value="fixed"/> -->
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="richness" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="right" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="size" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="portrait" />
+                <literal value="landscape" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="speak" default="normal" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="none" />
+                <literal value="spell-out" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-header" default="once" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="once" />
+                <literal value="always" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-numeral" default="continuous" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="digits" />
+                <literal value="continuous" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-punctuation" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="code" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speech-rate" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="x-slow" />
+                <literal value="slow" />
+                <literal value="medium" />
+                <literal value="fast" />
+                <literal value="x-fast" />
+                <literal value="faster" />
+                <literal value="slower" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="stress" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="table-layout" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="fixed" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="text-indent" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="text-transform" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="capitalize" />
+                <literal value="uppercase" />
+                <literal value="lowercase" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="top" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="unicode-bidi" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="embed" />
+                <literal value="bidi-override" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="vertical-align" default="baseline" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="baseline" />
+                <literal value="sub" />
+                <literal value="super" />
+                <literal value="top" />
+                <literal value="text-top" />
+                <literal value="middle" />
+                <literal value="bottom" />
+                <literal value="text-bottom" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="percentage" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="visibility" default="inherit" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="visible" />
+                <literal value="hidden" />
+                <literal value="collapse" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="volume" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="silent" />
+                <literal value="x-soft" />
+                <literal value="soft" />
+                <literal value="medium" />
+                <literal value="loud" />
+                <literal value="x-loud" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="white-space" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="pre" />
+                <literal value="nowrap" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="widows" default="2" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="width" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="word-spacing" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <!-- end simple properties -->
+
+        <!-- begin medium properties -->
+        <property name="border-style" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="none" />
+                <literal value="hidden" />
+                <literal value="dotted" />
+                <literal value="dashed" />
+                <literal value="solid" />
+                <literal value="double" />
+                <literal value="groove" />
+                <literal value="ridge" />
+                <literal value="inset" />
+                <literal value="outset" />
+            </literal-list>
+        </property>
+        <property name="border-top-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="border-right-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-left-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-top-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-right-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-left-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-width" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="thin" />
+                <literal value="medium" />
+                <literal value="thick" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="margin" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="auto" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="positiveLength" />
+                <regexp name="positivePercentage" />
+            </regexp-list>
+        </property>
+        <property name="margin-top" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-right" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-bottom" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-left" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="outline-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="outline-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="padding" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="padding-top" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-right" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-bottom" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-left" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <!-- end medium properties -->
+
+        <!-- begin hard properties -->
+        <property name="border" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-top" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-right" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-left" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="cue" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="cue-before" />
+                <shorthand name="cue-after" />
+            </shorthand-list>
+        </property>
+        <property name="list-style" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="list-style-type" />
+                <shorthand name="list-style-position" />
+                <shorthand name="list-style-image" />
+            </shorthand-list>
+        </property>
+        <property name="marks" default="none" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="crop" />
+                <literal value="cross" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="outline" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="outline-color" />
+                <shorthand name="outline-style" />
+                <shorthand name="outline-width" />
+            </shorthand-list>
+        </property>
+        <property name="pause" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="text-decoration" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="underline" />
+                <literal value="overline" />
+                <literal value="line-through" />
+                <literal value="blink" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <!-- end hard properties -->
+        <!-- begin manual properties -->
+        <property name="border-spacing" default="0"
+            description="The lengths specify the distance that separates adjacent cell borders. If one length is specified, it gives both the horizontal and vertical spacing. If two are specified, the first gives the horizontal spacing and the second the vertical spacing. Lengths may not be negative.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="clip" default="auto"
+            description="The 'clip' property applies to elements that have a 'overflow' property with a value other than 'visible'.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="counter-increment" default="none"
+            description="The 'counter-increment' property accepts one or more names of counters (identifiers), each one optionally followed by an integer.">
+            <category-list>
+                <category value="all" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssIdentifier" />
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="cursor" default="auto"
+            description="This property specifies the type of cursor to be displayed for the pointing device.">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+                <literal value="crosshair" />
+                <literal value="default" />
+                <literal value="pointer" />
+                <literal value="move" />
+                <literal value="e-resize" />
+                <literal value="ne-resize" />
+                <literal value="nw-resize" />
+                <literal value="n-resize" />
+                <literal value="se-resize" />
+                <literal value="sw-resize" />
+                <literal value="s-resize" />
+                <literal value="w-resize| text" />
+                <literal value="wait" />
+                <literal value="help" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+
+        <property name="text-shadow" default="none"
+            description="This property accepts a comma-separated list of shadow effects to be applied to the text of the element.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <property name="font"
+            description="The 'font' property is, except as described below, a shorthand property for setting 'font-style', 'font-variant', 'font-weight', 'font-size', 'line-height', and 'font-family', at the same place in the style sheet.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="/" />
+                <literal value="caption" />
+                <literal value="icon" />
+                <literal value="menu" />
+                <literal value="message-box" />
+                <literal value="small-caption" />
+                <literal value="status-bar" />
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="font-style" />
+                <shorthand name="font-variant" />
+                <shorthand name="font-weight" />
+                <shorthand name="font-size" />
+                <shorthand name="line-height" />
+                <shorthand name="font-family" />
+            </shorthand-list>
+        </property>
+
+        <property name="font-family"
+            description="This property specifies a prioritized list of font family names and/or generic family names.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <!-- allowing only generic font families -->
+            <literal-list>
+                <literal value="serif" />
+                <literal value="arial" />
+                <literal value="lucida console" />
+                <literal value="sans-serif" />
+                <literal value="cursive" />
+                <literal value="verdana" />
+                <literal value="fantasy" />
+                <literal value="monospace" />
+            </literal-list>
+
+
+            <regexp-list>
+                <regexp value="[\w,\-&apos;&quot; ]+" />
+            </regexp-list>
+
+        </property>
+        <property name="page"
+            description="The 'page' property can be used to specify a particular type of page where an element should be displayed.">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssIdentifier" />
+            </regexp-list>
+        </property>
+        <property name="play-during" default="auto"
+            description="Similar to the 'cue-before' and 'cue-after' properties, this property specifies a sound to be played as a background while an element's content is spoken.">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="mix" />
+                <literal value="repeat" />
+                <literal value="none" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="text-align" description="This property describes how inline content of a block is aligned.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <!-- For safety, ignoring string alignment which can be used to line table cells on characters -->
+            <literal-list>
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="center" />
+                <literal value="justify" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="voice-family"
+            description="The value is a comma-separated, prioritized list of voice family names (compare with 'font-family').">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <!-- Allowing only generic voice family -->
+            <literal-list>
+                <literal value="male" />
+                <literal value="female" />
+                <literal value="child" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <!-- end manual properties -->
+    </css-rules>
+    <allowed-empty-tags>
         <literal-list>
-            <literal value="br"/>
-            <literal value="hr"/>
-            <literal value="a"/>
-            <literal value="img"/>
-            <literal value="link"/>
-            <literal value="iframe"/>
-            <literal value="script"/>
-            <literal value="object"/>
-            <literal value="applet"/>
-            <literal value="frame"/>
-            <literal value="base"/>
-            <literal value="param"/>
-            <literal value="meta"/>
-            <literal value="input"/>
-            <literal value="textarea"/>
-            <literal value="embed"/>
-            <literal value="basefont"/>
-            <literal value="col"/>
-            <literal value="div"/>
+            <literal value="br" />
+            <literal value="hr" />
+            <literal value="a" />
+            <literal value="img" />
+            <literal value="link" />
+            <literal value="iframe" />
+            <literal value="script" />
+            <literal value="object" />
+            <literal value="applet" />
+            <literal value="frame" />
+            <literal value="base" />
+            <literal value="param" />
+            <literal value="meta" />
+            <literal value="input" />
+            <literal value="textarea" />
+            <literal value="embed" />
+            <literal value="basefont" />
+            <literal value="col" />
+            <literal value="div" />
         </literal-list>
     </allowed-empty-tags>
 </anti-samy-rules>
diff --git a/src/main/resources/antisamy-myspace.xml b/src/main/resources/antisamy-myspace.xml
index d26bb8d4..8cf1c630 100644
--- a/src/main/resources/antisamy-myspace.xml
+++ b/src/main/resources/antisamy-myspace.xml
@@ -1,2609 +1,2605 @@
 <?xml version="1.0" encoding="ISO-8859-1" ?>
 
 
-<!--
-W3C rules retrieved from:
-http://www.w3.org/TR/html401/struct/global.html
--->
+<!-- W3C rules retrieved from: http://www.w3.org/TR/html401/struct/global.html -->
 
 
-<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-		xsi:noNamespaceSchemaLocation="antisamy.xsd">
+<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="antisamy.xsd">
 
-	<directives>
-		<directive name="omitXmlDeclaration" value="true"/>
-		<directive name="omitDoctypeDeclaration" value="true"/>
-		<directive name="maxInputSize" value="15000"/>
-		<directive name="formatOutput" value="true"/>
+    <directives>
+        <directive name="omitXmlDeclaration" value="true" />
+        <directive name="omitDoctypeDeclaration" value="true" />
+        <directive name="maxInputSize" value="15000" />
+        <directive name="formatOutput" value="true" />
 
-		<!--
-		remember, this won't work for relative URIs - AntiSamy doesn't
-		know anything about the URL or your web structure
-		-->
-		<directive name="embedStyleSheets" value="false"/>
-		<directive name="connectionTimeout" value="5000"/>
-		<directive name="maxStyleSheetImports" value="3"/>
+        <!-- remember, this won't work for relative URIs - AntiSamy doesn't know anything about the URL or your web structure -->
+        <directive name="embedStyleSheets" value="false" />
+        <directive name="connectionTimeout" value="5000" />
+        <directive name="maxStyleSheetImports" value="3" />
 
-	</directives>
+    </directives>
 
-	<common-regexps>
+    <common-regexps>
 
-		<!--
-		From W3C:
-		This attribute assigns a class name or set of class names to an
-		element. Any number of elements may be assigned the same class
-		name or names. Multiple class names must be separated by white
-		space characters.
-		-->
+        <!-- From W3C: This attribute assigns a class name or set of class names to an element. Any number of elements may be assigned the same 
+            class name or names. Multiple class names must be separated by white space characters. -->
 
-		<!-- The 16 colors defined by the HTML Spec (also used by the CSS Spec) -->
-		<regexp name="colorName" value="(aqua|black|blue|fuchsia|gray|grey|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow)"/>
+        <!-- The 16 colors defined by the HTML Spec (also used by the CSS Spec) -->
+        <regexp name="colorName"
+            value="(aqua|black|blue|fuchsia|gray|grey|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow)" />
 
-		<!-- HTML/CSS Spec allows 3 or 6 digit hex to specify color -->
-		<regexp name="colorCode" value="(#([0-9a-fA-F]{6}|[0-9a-fA-F]{3}))"/>
+        <!-- HTML/CSS Spec allows 3 or 6 digit hex to specify color -->
+        <regexp name="colorCode" value="(#([0-9a-fA-F]{6}|[0-9a-fA-F]{3}))" />
 
-		<regexp name="anything" value=".*"/>
-		<regexp name="numberOrPercent" value="(\d)+(%{0,1})"/>
-		<regexp name="paragraph" value="([\p{L}\p{N},'\.\s\-_\(\)]|&amp;[0-9]{2};)*"/>
-		<regexp name="htmlId" value="[a-zA-Z0-9\:\-_\.]+"/>
-		<regexp name="htmlTitle" value="[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&amp;]*"/> <!-- force non-empty with a '+' at the end instead of '*' -->
-		<regexp name="htmlClass" value="[a-zA-Z0-9\s,\-_]+"/>
+        <regexp name="anything" value=".*" />
+        <regexp name="numberOrPercent" value="(\d)+(%{0,1})" />
+        <regexp name="paragraph" value="([\p{L}\p{N},'\.\s\-_\(\)]|&amp;[0-9]{2};)*" />
+        <regexp name="htmlId" value="[a-zA-Z0-9\:\-_\.]+" />
+        <regexp name="htmlTitle" value="[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&amp;]*" /> <!-- force non-empty with a '+' at the end instead of '*' -->
+        <regexp name="htmlClass" value="[a-zA-Z0-9\s,\-_]+" />
 
-		<regexp name="onsiteURL" value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*"/>
-		<regexp name="offsiteURL" value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&amp;;:\-_~,\?=/!\(\)]*(\s)*"/>
+        <regexp name="onsiteURL"
+            value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*" />
+        <regexp name="offsiteURL"
+            value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&amp;;:\-_~,\?=/!\(\)]*(\s)*" />
 
-		<regexp name="boolean" value="(true|false)"/>
-		<regexp name="singlePrintable" value="[a-zA-Z0-9]{1}"/> <!-- \w allows the '_' character -->
+        <regexp name="boolean" value="(true|false)" />
+        <regexp name="singlePrintable" value="[a-zA-Z0-9]{1}" /> <!-- \w allows the '_' character -->
 
-		<!-- This is for elements (ex: elemName { ... }) -->
-		<regexp name="cssElementSelector" value="[a-zA-Z0-9\-_]+|\*"/>
+        <!-- This is for elements (ex: elemName { ... }) -->
+        <regexp name="cssElementSelector" value="[a-zA-Z0-9\-_]+|\*" />
 
-		<!--  This is to list out any element names that are *not* valid -->
-		<regexp name="cssElementExclusion" value=""/>
+        <!-- This is to list out any element names that are *not* valid -->
+        <regexp name="cssElementExclusion" value="" />
 
-		<!--  This if for classes (ex: .className { ... }) -->
-		<regexp name="cssClassSelector" value="\.[a-zA-Z0-9\-_]+"/>
+        <!-- This if for classes (ex: .className { ... }) -->
+        <regexp name="cssClassSelector" value="\.[a-zA-Z0-9\-_]+" />
 
-		<!--  This is to list out any class names that are *not* valid -->
-		<regexp name="cssClassExclusion" value=""/>
+        <!-- This is to list out any class names that are *not* valid -->
+        <regexp name="cssClassExclusion" value="" />
 
-		<!--  This is for ID selectors (ex: #myId { ... } -->
-		<regexp name="cssIDSelector" value="#[a-zA-Z0-9\-_]+"/>
+        <!-- This is for ID selectors (ex: #myId { ... } -->
+        <regexp name="cssIDSelector" value="#[a-zA-Z0-9\-_]+" />
 
-		<!--  This is to list out any IDs that are *not* valid - FIXME: What should the default be to avoid div hijacking? *? -->
-		<regexp name="cssIDExclusion" value=""/>
+        <!-- This is to list out any IDs that are *not* valid - FIXME: What should the default be to avoid div hijacking? *? -->
+        <regexp name="cssIDExclusion" value="" />
 
-		<!--  This is for pseudo-element selector (ex. foo:pseudo-element { ... } -->
-		<regexp name="cssPseudoElementSelector" value=":[a-zA-Z0-9\-_]+"/>
+        <!-- This is for pseudo-element selector (ex. foo:pseudo-element { ... } -->
+        <regexp name="cssPseudoElementSelector" value=":[a-zA-Z0-9\-_]+" />
 
-		<!--  This is to list out any psuedo-element names that are *not* valid -->
-		<regexp name="cssPsuedoElementExclusion" value=""/>
+        <!-- This is to list out any psuedo-element names that are *not* valid -->
+        <regexp name="cssPsuedoElementExclusion" value="" />
 
-		<!--  This is for attribute selectors (ex. foo[attr=value] { ... } -->
-		<regexp name="cssAttributeSelector" value="\[[a-zA-Z0-9\-_]+((=|~=|\|=){1}[a-zA-Z0-9\-_]+){1}\]"/>
-
-		<!--  This is to list out any attribute names that are *not* valid -->
-		<regexp name="cssAttributeExclusion" value=""/>
-
-		<!--  This is for resources referenced from CSS (such as background images and other imported stylesheets) -->
-		<regexp name="cssOnsiteUri" value="url\(([\p{L}\p{N}\\/\.\?=\#&amp;;\-_~]+|\#(\w)+)\)"/>
-		<regexp name="cssOffsiteUri" value="url\((\s)*((ht|f)tp(s?)://)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@#$%&amp;;:,\?=/\+!]*(\s)*\)"/>
-
-		<!--  This if for CSS Identifiers -->
-		<regexp name="cssIdentifier" value="[a-zA-Z0-9\-_]+"/>
+        <!-- This is for attribute selectors (ex. foo[attr=value] { ... } -->
+        <regexp name="cssAttributeSelector" value="\[[a-zA-Z0-9\-_]+((=|~=|\|=){1}[a-zA-Z0-9\-_]+){1}\]" />
 
-		<!--  This is for comments within CSS (ex. /* comment */) -->
-		<regexp name="cssCommentText" value="[\p{L}\p{N}\-_,\/\\\.\s\(\)!\?\=\$#%\^&amp;:&quot;']+"/>
-
-		<regexp name="integer" value="(-|\+)?[0-9]+"/>
-		<regexp name="positiveInteger" value="(\+)?[0-9]+"/>
-		<regexp name="number" value="(-|\+)?([0-9]+(\.[0-9]+)?)"/>
-		<regexp name="angle" value="(-|\+)?([0-9]+(\.[0-9]+)?)(deg|grad|rad)"/>
-		<regexp name="time" value="([0-9]+(\.[0-9]+)?)(ms|s)"/>
-		<regexp name="frequency" value="([0-9]+(\.[0-9]+)?)(hz|khz)"/>
-		<regexp name="length" value="((-|\+)?0|(-|\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))"/>
-		<regexp name="positiveLength" value="((\+)?0|(\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))"/>
-		<regexp name="percentage" value="(-|\+)?([0-9]+(\.[0-9]+)?)%"/>
-		<regexp name="positivePercentage" value="(\+)?([0-9]+(\.[0-9]+)?)%"/>
+        <!-- This is to list out any attribute names that are *not* valid -->
+        <regexp name="cssAttributeExclusion" value="" />
 
-		<regexp name="absolute-size" value="(xx-small|x-small|small|medium|large|x-large|xx-large)"/>
-		<regexp name="relative-size" value="(larger|smaller)"/>
-
-		<!-- Used for CSS Color specifications (complex regexp expresses integer values of 0-255) -->
-		<regexp name="rgbCode" value="rgb\(([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\)"/>
-
-		<!-- CSS2 Allowed System Color Values -->
-		<regexp name="systemColor" value="(activeborder|activecaption|appworkspace|background|buttonface|buttonhighlight|buttonshadow|buttontext|captiontext|graytext|highlight|highlighttext|inactiveborder|inactivecaption|inactivecaptiontext|infobackground|infotext|menu|menutext|scrollbar|threeddarkshadow|threedface|threedhighlight|threedlightshadow|threedshadow|window|windowframe|windowtext)"/>
+        <!-- This is for resources referenced from CSS (such as background images and other imported stylesheets) -->
+        <regexp name="cssOnsiteUri" value="url\(([\p{L}\p{N}\\/\.\?=\#&amp;;\-_~]+|\#(\w)+)\)" />
+        <regexp name="cssOffsiteUri"
+            value="url\((\s)*((ht|f)tp(s?)://)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@#$%&amp;;:,\?=/\+!]*(\s)*\)" />
+
+        <!-- This if for CSS Identifiers -->
+        <regexp name="cssIdentifier" value="[a-zA-Z0-9\-_]+" />
 
-	</common-regexps>
-
-	<!--
-
-	Tag.name = a, b, div, body, etc.
-	Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, remove: remove tag and contents
-	Attribute.name = id, class, href, align, width, etc.
-	Attribute.onInvalid = what to do when the attribute is invalid, e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag)
-	Attribute.description = What rules in English you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML
+        <!-- This is for comments within CSS (ex. /* comment */) -->
+        <regexp name="cssCommentText" value="[\p{L}\p{N}\-_,\/\\\.\s\(\)!\?\=\$#%\^&amp;:&quot;']+" />
 
-	 -->
+        <regexp name="integer" value="(-|\+)?[0-9]+" />
+        <regexp name="positiveInteger" value="(\+)?[0-9]+" />
+        <regexp name="number" value="(-|\+)?([0-9]+(\.[0-9]+)?)" />
+        <regexp name="angle" value="(-|\+)?([0-9]+(\.[0-9]+)?)(deg|grad|rad)" />
+        <regexp name="time" value="([0-9]+(\.[0-9]+)?)(ms|s)" />
+        <regexp name="frequency" value="([0-9]+(\.[0-9]+)?)(hz|khz)" />
+        <regexp name="length" value="((-|\+)?0|(-|\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))" />
+        <regexp name="positiveLength" value="((\+)?0|(\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))" />
+        <regexp name="percentage" value="(-|\+)?([0-9]+(\.[0-9]+)?)%" />
+        <regexp name="positivePercentage" value="(\+)?([0-9]+(\.[0-9]+)?)%" />
 
-	<!--
-	Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no
-	collisions between any of these attribute names with attribute names of other tags that are for different purposes.
-	-->
+        <regexp name="absolute-size" value="(xx-small|x-small|small|medium|large|x-large|xx-large)" />
+        <regexp name="relative-size" value="(larger|smaller)" />
 
-	<common-attributes>
+        <!-- Used for CSS Color specifications (complex regexp expresses integer values of 0-255) -->
+        <regexp name="rgbCode"
+            value="rgb\(([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\)" />
 
+        <!-- CSS2 Allowed System Color Values -->
+        <regexp name="systemColor"
+            value="(activeborder|activecaption|appworkspace|background|buttonface|buttonhighlight|buttonshadow|buttontext|captiontext|graytext|highlight|highlighttext|inactiveborder|inactivecaption|inactivecaptiontext|infobackground|infotext|menu|menutext|scrollbar|threeddarkshadow|threedface|threedhighlight|threedlightshadow|threedshadow|window|windowframe|windowtext)" />
+
+    </common-regexps>
+
+    <!-- Tag.name = a, b, div, body, etc. Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, 
+        remove: remove tag and contents Attribute.name = id, class, href, align, width, etc. Attribute.onInvalid = what to do when the attribute is invalid, 
+        e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag) Attribute.description = What rules in English 
+        you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML -->
 
-		<!-- Common to all HTML tags  -->
-
-		<attribute name="id" description="The 'id' of any HTML attribute should not contain anything besides letters and numbers">
-			<regexp-list>
-				<regexp name="htmlId"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="class" description="The 'class' of any HTML attribute is usually a single word, but it can also be a list of class names separated by spaces">
-			<regexp-list>
-				<regexp name="htmlClass"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="lang" description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
-		 	<regexp-list>
-		 		<regexp value="[a-zA-Z0-9-]{2,20}"/>
-		 	</regexp-list>
-		 </attribute>
-		 <attribute name="title" description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
-		 	<regexp-list>
-		 		<regexp name="htmlTitle"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="alt" description="The 'alt' attribute provides alternative text to users when its visual representation is not available">
-		 	<regexp-list>
-		 		<regexp name="paragraph"/>
-		 	</regexp-list>
-		 </attribute>
-
-
- 		<!-- the "style" attribute will be validated by an inline stylesheet scanner, so no need to define anything here - i hate having to special case this but no other choice -->
-		 <attribute name="style" description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax"/>
-
-		 <attribute name="media">
-		 	<regexp-list>
-		 		<regexp value="[a-zA-Z0-9,\-\s]+"/>
-		 	</regexp-list>
-		 	
-		 	<literal-list>
-		 		<literal value="screen"/>
-		 		<literal value="tty"/>
-		 		<literal value="tv"/>
-		 		<literal value="projection"/>
-		 		<literal value="handheld"/>
-		 		<literal value="print"/>
-		 		<literal value="braille"/>
-		 		<literal value="aural"/>
-		 		<literal value="all"/>
-		 	</literal-list>
-		 </attribute>
-
-
-		 <!-- Anchor related -->
-
-		 <!--  onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
-		<attribute name="href">
-			<regexp-list>
-				<regexp name="onsiteURL"/>
-				<regexp name="offsiteURL"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="name">
-		 	<regexp-list>
-
-		 		<regexp value="[a-zA-Z0-9\-_\$]+"/>
-
-		 		<!--
-		 		have to allow the $ for .NET controls - although,
-		 		will users be supplying input that has server-generated
-		 		.NET control names? methinks not, but i want to pass my
-		 		test cases
-		 		-->
-
-		 	</regexp-list>
-		 </attribute>
-
-
-		<attribute name="shape" description="The 'shape' attribute defines the shape of the selectable area">
-			<literal-list>
-				<literal value="default"/>
-				<literal value="rect"/>
-				<literal value="circle"/>
-				<literal value="poly"/>
-			</literal-list>
-		</attribute>
-
-
-
-		<!--  Table attributes  -->
-
-		<attribute name="border">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="cellpadding">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="cellspacing">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="colspan">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="rowspan">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="background">
-			<regexp-list>
-				<regexp name="onsiteURL"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="bgcolor">
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-			</regexp-list>
-		</attribute>
-
-		 <attribute name="abbr">
-			<regexp-list>
-			 	<regexp name="paragraph"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="headers" description="The 'headers' attribute is a space-separated list of cell IDs">
-		 	<regexp-list>
-			 	<regexp value="[a-zA-Z0-9\s*]*"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="charoff">
-		 	<regexp-list>
-		 		<regexp value="numberOrPercent"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="char">
-			<regexp-list>
-				<regexp value=".{0,1}"/>
-			</regexp-list>
-		 </attribute>
-
-
-		<attribute name="axis" description="The 'headers' attribute is a comma-separated list of related header cells">
-		 	<regexp-list>
-			 	<regexp value="[a-zA-Z0-9\s*,]*"/>
-		 	</regexp-list>
-		</attribute>
-
-		<attribute name="nowrap" description="The 'nowrap' attribute tells the browser not to wrap text that goes over one line">
-			<regexp-list>
-				<regexp name="anything"/>
-				<!-- <regexp value="(nowrap){0,1}"/>  -->
-			</regexp-list>
-		</attribute>
-
-
-		<!--  Common positioning attributes  -->
-
-		<attribute name="width">
-			<regexp-list>
-				<regexp name="numberOrPercent"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="height">
-			<regexp-list>
-				<regexp name="numberOrPercent"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="align" description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
-			<literal-list>
-				<literal value="center"/>
-				<literal value="middle"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="justify"/>
-				<literal value="char"/>
-			</literal-list>
-		</attribute>
-
-		<attribute name="valign" description="The 'valign' attribute of an HTML attribute is a direction word, like 'baseline','bottom','middle' or 'top'">
-			<literal-list>
-				<literal value="baseline"/>
-				<literal value="bottom"/>
-				<literal value="middle"/>
-				<literal value="top"/>
-			</literal-list>
-		</attribute>
-
-
-
-		<!-- Intrinsic JavaScript Events -->
-
-		<attribute name="onFocus" description="The 'onFocus' event is executed when the control associated with the tag gains focus">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		</attribute>
-
-		<attribute name="onBlur" description="The 'onBlur' event is executed when the control associated with the tag loses focus">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		</attribute>
-
-		 <attribute name="onClick" description="The 'onClick' event is executed when the control associated with the tag is clicked">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		 <attribute name="onDblClick" description="The 'onDblClick' event is executed when the control associated with the tag is clicked twice immediately">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		  <attribute name="onMouseDown" description="The 'onMouseDown' event is executed when the control associated with the tag is clicked but not yet released">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		 <attribute name="onMouseUp" description="The 'onMouseUp' event is executed when the control associated with the tag is clicked after the button is released">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
- 		 <attribute name="onMouseOver" description="The 'onMouseOver' event is executed when the user's mouse hovers over the control associated with the tag">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		 </attribute>
-
-		 <attribute name="scope" description="The 'scope' attribute defines what's covered by the header cells">
-		 	<literal-list>
-		 		<literal value="row"/>
-		 		<literal value="col"/>
-		 		<literal value="rowgroup"/>
-		 		<literal value="colgroup"/>
-		 	</literal-list>
-		 </attribute>
-
-
-
-		 <!-- If you want users to be able to mess with tabindex, uncomment this -->
-		 <!--
-		 <attribute name="tabindex" description="...">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-		  -->
-
-
-		 <!-- Input/form related common attributes -->
-
-		 <attribute name="disabled">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="readonly">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="accesskey">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="size">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-
-
-		<attribute name="autocomplete">
-			<literal-list>
-				<literal value="on"/>
-				<literal value="off"/>
-			</literal-list>
-		</attribute>
-
-		 <attribute name="rows">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-
-		 <attribute name="cols">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-
-	</common-attributes>
-
-
-	<!--
-	This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue
-	this is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after
-	a while? Even wars of attrition, surely?
-	 -->
-
-	<global-tag-attributes>
-		<!-- Not valid in base, head, html, meta, param, script, style, and title elements. -->
-		<attribute name="id"/>
-		<attribute name="style"/>
-		<attribute name="title"/>
-		<attribute name="class"/>
-		<!-- Not valid in base, br, frame, frameset, hr, iframe, param, and script elements.  -->
-		<attribute name="lang"/>
-	</global-tag-attributes>
-
-	<tags-to-encode>
-		<tag>g</tag>
-		<tag>grin</tag>
-	</tags-to-encode>
-
-	<tag-rules>
-
-		<!-- Tags related to JavaScript -->
-
-		<tag name="script" action="remove"/>
-		<tag name="noscript" action="validate"/> <!-- although no javascript can fire inside a noscript tag, css is still a viable attack vector -->
+    <!-- Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no collisions 
+        between any of these attribute names with attribute names of other tags that are for different purposes. -->
 
+    <common-attributes>
 
 
-		<!-- Frame & related tags -->
-
-		<tag name="iframe" action="remove"/>
-		<tag name="frameset" action="remove"/>
-		<tag name="frame" action="remove"/>
-
-
-
-		<!-- Form related tags -->
-
-		<tag name="label" action="validate">
-			<attribute name="for">
-				<regexp-list>
-					<regexp name="htmlId"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-
-
-		<!--
-			If you wish to enable any of the form related tags, change the tag's action below from "filter" or "remove" to "validate". The attributes have been
-			hardened so this is safe to do, if it's something you want to allow. Beware the <><ing possibilities!
-		 -->
-
-		<tag name="form" action="validate">
-
-			<attribute name="action">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="offsiteURL"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="name"/>
-
-			<attribute name="autocomplete"/>
-
-			<attribute name="method">
-				<literal-list>
-					<literal value="post"/>
-					<literal value="get"/>
-				</literal-list>
-			</attribute>
+        <!-- Common to all HTML tags -->
+
+        <attribute name="id" description="The 'id' of any HTML attribute should not contain anything besides letters and numbers">
+            <regexp-list>
+                <regexp name="htmlId" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="class"
+            description="The 'class' of any HTML attribute is usually a single word, but it can also be a list of class names separated by spaces">
+            <regexp-list>
+                <regexp name="htmlClass" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="lang"
+            description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9-]{2,20}" />
+            </regexp-list>
+        </attribute>
+        <attribute name="title"
+            description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
+            <regexp-list>
+                <regexp name="htmlTitle" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="alt"
+            description="The 'alt' attribute provides alternative text to users when its visual representation is not available">
+            <regexp-list>
+                <regexp name="paragraph" />
+            </regexp-list>
+        </attribute>
+
+
+        <!-- the "style" attribute will be validated by an inline stylesheet scanner, so no need to define anything here - i hate having to special 
+            case this but no other choice -->
+        <attribute name="style"
+            description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax" />
+
+        <attribute name="media">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9,\-\s]+" />
+            </regexp-list>
+
+            <literal-list>
+                <literal value="screen" />
+                <literal value="tty" />
+                <literal value="tv" />
+                <literal value="projection" />
+                <literal value="handheld" />
+                <literal value="print" />
+                <literal value="braille" />
+                <literal value="aural" />
+                <literal value="all" />
+            </literal-list>
+        </attribute>
+
+
+        <!-- Anchor related -->
+
+        <!-- onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
+        <attribute name="href">
+            <regexp-list>
+                <regexp name="onsiteURL" />
+                <regexp name="offsiteURL" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="name">
+            <regexp-list>
+
+                <regexp value="[a-zA-Z0-9\-_\$]+" />
+
+                <!-- have to allow the $ for .NET controls - although, will users be supplying input that has server-generated .NET control names? 
+                    methinks not, but i want to pass my test cases -->
+
+            </regexp-list>
+        </attribute>
+
+
+        <attribute name="shape" description="The 'shape' attribute defines the shape of the selectable area">
+            <literal-list>
+                <literal value="default" />
+                <literal value="rect" />
+                <literal value="circle" />
+                <literal value="poly" />
+            </literal-list>
+        </attribute>
+
+
+
+        <!-- Table attributes -->
+
+        <attribute name="border">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cellpadding">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cellspacing">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="colspan">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="rowspan">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="background">
+            <regexp-list>
+                <regexp name="onsiteURL" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="bgcolor">
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="abbr">
+            <regexp-list>
+                <regexp name="paragraph" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="headers" description="The 'headers' attribute is a space-separated list of cell IDs">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9\s*]*" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="charoff">
+            <regexp-list>
+                <regexp value="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="char">
+            <regexp-list>
+                <regexp value=".{0,1}" />
+            </regexp-list>
+        </attribute>
+
+
+        <attribute name="axis" description="The 'headers' attribute is a comma-separated list of related header cells">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9\s*,]*" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="nowrap" description="The 'nowrap' attribute tells the browser not to wrap text that goes over one line">
+            <regexp-list>
+                <regexp name="anything" />
+                <!-- <regexp value="(nowrap){0,1}"/> -->
+            </regexp-list>
+        </attribute>
+
+
+        <!-- Common positioning attributes -->
+
+        <attribute name="width">
+            <regexp-list>
+                <regexp name="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="height">
+            <regexp-list>
+                <regexp name="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="align"
+            description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
+            <literal-list>
+                <literal value="center" />
+                <literal value="middle" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="justify" />
+                <literal value="char" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="valign"
+            description="The 'valign' attribute of an HTML attribute is a direction word, like 'baseline','bottom','middle' or 'top'">
+            <literal-list>
+                <literal value="baseline" />
+                <literal value="bottom" />
+                <literal value="middle" />
+                <literal value="top" />
+            </literal-list>
+        </attribute>
+
+
+
+        <!-- Intrinsic JavaScript Events -->
+
+        <attribute name="onFocus"
+            description="The 'onFocus' event is executed when the control associated with the tag gains focus">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onBlur" description="The 'onBlur' event is executed when the control associated with the tag loses focus">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onClick"
+            description="The 'onClick' event is executed when the control associated with the tag is clicked">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onDblClick"
+            description="The 'onDblClick' event is executed when the control associated with the tag is clicked twice immediately">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseDown"
+            description="The 'onMouseDown' event is executed when the control associated with the tag is clicked but not yet released">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseUp"
+            description="The 'onMouseUp' event is executed when the control associated with the tag is clicked after the button is released">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseOver"
+            description="The 'onMouseOver' event is executed when the user's mouse hovers over the control associated with the tag">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="scope" description="The 'scope' attribute defines what's covered by the header cells">
+            <literal-list>
+                <literal value="row" />
+                <literal value="col" />
+                <literal value="rowgroup" />
+                <literal value="colgroup" />
+            </literal-list>
+        </attribute>
+
+
+
+        <!-- If you want users to be able to mess with tabindex, uncomment this -->
+        <!-- <attribute name="tabindex" description="..."> <regexp-list> <regexp name="number"/> </regexp-list> </attribute> -->
+
+
+        <!-- Input/form related common attributes -->
+
+        <attribute name="disabled">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="readonly">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="accesskey">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="size">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+
+        <attribute name="autocomplete">
+            <literal-list>
+                <literal value="on" />
+                <literal value="off" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="rows">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cols">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+    </common-attributes>
+
+
+    <!-- This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue this 
+        is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after a while? Even wars of 
+        attrition, surely? -->
+
+    <global-tag-attributes>
+        <!-- Not valid in base, head, html, meta, param, script, style, and title elements. -->
+        <attribute name="id" />
+        <attribute name="style" />
+        <attribute name="title" />
+        <attribute name="class" />
+        <!-- Not valid in base, br, frame, frameset, hr, iframe, param, and script elements. -->
+        <attribute name="lang" />
+    </global-tag-attributes>
 
-		</tag>
+    <tags-to-encode>
+        <tag>g</tag>
+        <tag>grin</tag>
+    </tags-to-encode>
 
-		<tag name="button" action="validate">
-			<attribute name="name"/>
-			<attribute name="value">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
+    <tag-rules>
 
-			<attribute name="disabled"/>
-			<attribute name="accesskey"/>
-			<attribute name="type">
-				<literal-list>
-					<literal value="submit"/>
-					<literal value="reset"/>
-					<literal value="button"/>
-				</literal-list>
-			</attribute>
-		</tag>
+        <!-- Tags related to JavaScript -->
 
-		<tag name="input" action="validate">
+        <tag name="script" action="remove" />
+        <tag name="noscript" action="validate" /> <!-- although no javascript can fire inside a noscript tag, css is still a viable attack vector -->
 
-			<attribute name="name"/>
 
-			<attribute name="size"/>
-
-			<attribute name="maxlength">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="autocomplete"/>
 
-			<attribute name="checked">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
+        <!-- Frame & related tags -->
 
-			<attribute name="alt"/>
+        <tag name="iframe" action="remove" />
+        <tag name="frameset" action="remove" />
+        <tag name="frame" action="remove" />
 
-			<attribute name="src">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="offsiteURL"/>
-				</regexp-list>
-			</attribute>
 
-			<attribute name="usemap">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="type">
-				<literal-list>
-					<literal value="hidden"/>
-					<literal value="text"/>
-					<!-- <literal value="password"/>  --> <!--  no user profiles should have password fields -->
-					<literal value="radio"/>
-					<literal value="checkbox"/>
-					<literal value="submit"/>
-					<literal value="button"/>
-					<literal value="image"/>
-					<literal value="file"/>
-					<literal value="reset"/>
-				</literal-list>
-			</attribute>
-
-			<attribute name="value">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="disabled"/>
-			<attribute name="readonly"/>
-			<attribute name="accesskey"/>
-
-			<attribute name="border"/>
-
-		</tag>
-
-		<tag name="select" action="validate">
-
-			<attribute name="name"/>
-			<attribute name="disabled"/>
-
-			<attribute name="multiple">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="size"/>
-
-		</tag>
-
-		<tag name="option" action="validate">
-
-			<attribute name="disabled"/>
-
-			<attribute name="value">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="label">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="selected">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-
-		<tag name="textarea" action="validate">
-			<attribute name="rows"/>
-			<attribute name="cols"/>
-			<attribute name="name"/>
-			<attribute name="disabled"/>
-			<attribute name="readonly"/>
-			<attribute name="accesskey"/>
-		</tag>
-
-
-
-
-		<!-- All formatting tags -->
-
-		<tag name="h1" action="validate"/>
-		<tag name="h2" action="validate"/>
-		<tag name="h3" action="validate"/>
-		<tag name="h4" action="validate"/>
-		<tag name="h5" action="validate"/>
-		<tag name="h6" action="validate"/>
-
-		<tag name="p" action="validate">
-			<attribute name="align"/>
-		</tag>
-
-		<tag name="i" action="validate"/>
-		<tag name="b" action="validate"/>
-		<tag name="u" action="validate"/>
-		<tag name="strong" action="validate"/>
-
-		<tag name="em" action="validate"/>
-		<tag name="small" action="validate"/>
-		<tag name="big" action="validate"/>
-		<tag name="pre" action="validate"/>
-		<tag name="code" action="validate"/>
-		<tag name="cite" action="validate"/>
-		<tag name="samp" action="validate"/>
-		<tag name="sub" action="validate"/>
-		<tag name="sup" action="validate"/>
-		<tag name="strike" action="validate"/>
-		<tag name="center" action="validate"/>
-		<tag name="blockquote" action="validate"/>
-
-		<tag name="hr" action="validate"/>
-		<tag name="br" action="validate"/>
-
-		<tag name="font" action="validate">
-			<attribute name="color">
-				<regexp-list>
-					<regexp name="colorName"/>
-					<regexp name="colorCode"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="face">
-				<regexp-list>
-					<regexp value="[\w;, \-]+"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="size">
-				<regexp-list>
-					<regexp value="(\+|-){0,1}(\d)+"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-
-
-		<!-- Anchor and anchor related tags -->
-
-		<tag name="a" action="validate">
-
-			<!--  onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
-			<attribute name="href"/>
-			<attribute name="onFocus"/>
-			<attribute name="onBlur"/>
-			<attribute name="nohref">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="rel">
-				<literal-list>
-					<literal value="nofollow"/>
-				</literal-list>
-			</attribute>
-			<attribute name="name"/>
-
-		</tag>
-
-		<!-- base tag removed per demo - this could be enabled with literal-list values you allow -->
-		<!--
-		<tag name="base" action="validate">
-			<attribute name="href"/>
-		</tag>
-		-->
 
+        <!-- Form related tags -->
+
+        <tag name="label" action="validate">
+            <attribute name="for">
+                <regexp-list>
+                    <regexp name="htmlId" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+
+        <!-- If you wish to enable any of the form related tags, change the tag's action below from "filter" or "remove" to "validate". The attributes 
+            have been hardened so this is safe to do, if it's something you want to allow. Beware the <><ing possibilities! -->
+
+        <tag name="form" action="validate">
+
+            <attribute name="action">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="offsiteURL" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="name" />
+
+            <attribute name="autocomplete" />
+
+            <attribute name="method">
+                <literal-list>
+                    <literal value="post" />
+                    <literal value="get" />
+                </literal-list>
+            </attribute>
 
+        </tag>
 
-		<!-- Stylesheet Tags -->
+        <tag name="button" action="validate">
+            <attribute name="name" />
+            <attribute name="value">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
 
-		<tag name="style" action="validate">
-			<attribute name="type">
-				<literal-list>
-					<literal value="text/css"/>
-				</literal-list>
-			</attribute>
-			<attribute name="media"/>
-		</tag>
+            <attribute name="disabled" />
+            <attribute name="accesskey" />
+            <attribute name="type">
+                <literal-list>
+                    <literal value="submit" />
+                    <literal value="reset" />
+                    <literal value="button" />
+                </literal-list>
+            </attribute>
+        </tag>
 
-		<tag name="span" action="validate"/>
-
-		<tag name="div" action="validate">
-			<attribute name="align"/>
-		</tag>
-
-
-		<!-- Image & image related tags -->
-
-		<tag name="img" action="validate">
-			<attribute name="src" onInvalid="removeTag">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="offsiteURL"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="name"/>
-			<attribute name="alt"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="border"/>
-			<attribute name="align"/>
-
-			<attribute name="hspace">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-
-			<attribute name="vspace">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-
-		<!-- no way to do this safely without hooking up the same code to @import to embed the remote stylesheet (malicious user could change offsite resource to be malicious after validation -->
-		<!-- <attribute name="href" onInvalid="removeTag"/>  -->
-
-		<tag name="link" action="validate">
-
-			<!-- <attribute name="href" onInvalid="removeTag"/>  -->
-
-			<attribute name="media"/>
-
-			<attribute name="type" onInvalid="removeTag">
-				<literal-list>
-					<literal value="text/css"/>
-					<literal value="application/rss+xml"/>
-					<literal value="image/x-icon"/>
-				</literal-list>
-			</attribute>
-
-			<attribute name="rel">
-				<literal-list>
-					<literal value="stylesheet"/>
-					<literal value="shortcut icon"/>
-					<literal value="search"/>
-					<literal value="copyright"/>
-					<literal value="top"/>
-					<literal value="alternate"/>
-				</literal-list>
-			</attribute>
-		</tag>
-
-
-
-
-
-		<!-- List tags -->
-
-		<tag name="ul" action="validate"/>
-		<tag name="ol" action="validate"/>
-		<tag name="li" action="validate"/>
-
-
-
-
-		<!-- Dictionary tags -->
-
-		<tag name="dd" action="truncate"/>
-		<tag name="dl" action="truncate"/>
-		<tag name="dt" action="truncate"/>
-
-
-
-
-		<!-- Table tags (tbody, thead, tfoot)-->
-
-		<tag name="thead" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="tbody" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="tfoot" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="table" action="validate">
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="border"/>
-			<attribute name="bgcolor"/>
-			<attribute name="cellpadding"/>
-			<attribute name="cellspacing"/>
-			<attribute name="background"/>
-			<attribute name="align"/>
-			<attribute name="noresize">
-				<literal-list>
-					<literal value="noresize"/>
-					<literal value=""/>
-				</literal-list>
-			</attribute>
-		</tag>
-
-		<tag name="td" action="validate">
-			<attribute name="background"/>
-			<attribute name="bgcolor"/>
-			<attribute name="abbr"/>
-			<attribute name="axis"/>
-			<attribute name="headers"/>
-			<attribute name="scope"/>
-			<attribute name="nowrap"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-			<attribute name="colspan"/>
-			<attribute name="rowspan"/>
-		</tag>
-
-		<tag name="th" action="validate">
-			<attribute name="abbr"/>
-			<attribute name="axis"/>
-			<attribute name="headers"/>
-			<attribute name="scope"/>
-			<attribute name="nowrap"/>
-			<attribute name="bgcolor"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-			<attribute name="colspan"/>
-			<attribute name="rowspan"/>
-		</tag>
-
-		<tag name="tr" action="validate">
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="valign"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="background"/>
-		</tag>
-
-		<tag name="colgroup" action="validate">
-
-			<attribute name="span">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-
-		<tag name="col" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-			<attribute name="span">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="width"/>
-		</tag>
-
-		<tag name="fieldset" action="validate"/>
-		<tag name="legend" action="validate"/>
-
-	</tag-rules>
-
-
-	<!--  CSS validation processing rules  -->
-
-	<css-rules>
-
-		<property name="azimuth" description="This property is most likely to be implemented by mixing the same signal into different channels at differing volumes.">
-			<literal-list>
-				<literal value="left-side"/>
-				<literal value="far-left"/>
-				<literal value="left"/>
-				<literal value="center-left"/>
-				<literal value="center"/>
-				<literal value="center-right"/>
-				<literal value="right"/>
-				<literal value="far-right"/>
-				<literal value="right-side"/>
-				<literal value="behind"/>
-				<literal value="leftwards"/>
-				<literal value="rightwards"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="angle"/>
-			</regexp-list>
-		</property>
-
-		<property name="background" description="The 'background' property is a shorthand property for setting the individual background properties (i.e., 'background-color', 'background-image', 'background-repeat', 'background-attachment' and 'background-position') at the same place in the style sheet.">
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="background-color"/>
-				<shorthand name="background-image"/>
-				<shorthand name="background-repeat"/>
-				<shorthand name="background-attachment"/>
-				<shorthand name="background-position"/>
-			</shorthand-list>
-		</property>
-
-		<property name="background-attachment" description="If a background image is specified, this property specifies whether it is fixed with regard to the viewport ('fixed') or scrolls along with the document ('scroll').">
-			<literal-list>
-				<literal value="scroll"/>
-				<literal value="fixed"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-
-		<property name="background-color" description="This property sets the background color of an element, either a &lt;color&gt; value or the keyword 'transparent', to make the underlying colors shine through.">
-			<literal-list>
-				<literal value="transparent"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-
-		<property name="background-image" description="This property sets the background image of an element.">
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-
-		<property name="background-position" description="If a background image has been specified, this property specifies its initial position.">
-			<literal-list>
-				<literal value="top"/>
-				<literal value="center"/>
-				<literal value="bottom"/>
-				<literal value="left"/>
-				<literal value="center"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="percentage"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-
-		<property name="background-repeat" description="If a background image is specified, this property specifies whether the image is repeated (tiled), and how.">
-			<literal-list>
-				<literal value="repeat"/>
-				<literal value="repeat-x"/>
-				<literal value="repeat-y"/>
-				<literal value="no-repeat"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-
-		<!-- Begin simple properties -->
-		<property name="border-collapse" default="collapse" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="collapse"/>
-				<literal value="separate"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="border-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="transparent"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-top-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-right-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-bottom-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-left-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="bottom" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="caption-side" default="top" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="top"/>
-				<literal value="bottom"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="clear" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="both"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="cue-after" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="cue-before" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="direction" default="ltr" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="ltr"/>
-				<literal value="rtl"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="display" default="inline" description="">
-			<category-list>
-				<category value="all"/>
-			</category-list>
-			<literal-list>
-				<literal value="inline"/>
-				<literal value="block"/>
-				<literal value="list-item"/>
-				<literal value="run-in"/>
-				<literal value="compact"/>
-				<literal value="marker"/>
-				<literal value="table"/>
-				<literal value="inline-table"/>
-				<literal value="table-row-group"/>
-				<literal value="table-header-group"/>
-				<literal value="table-footer-group"/>
-				<literal value="table-row"/>
-				<literal value="table-column-group"/>
-				<literal value="table-column"/>
-				<literal value="table-cell"/>
-				<literal value="table-caption"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="elevation" default="level" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="below"/>
-				<literal value="level"/>
-				<literal value="above"/>
-				<literal value="higher"/>
-				<literal value="lower"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="angle"/>
-			</regexp-list>
-		</property>
-		<property name="empty-cells" default="show" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="show"/>
-				<literal value="hide"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="float" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-size" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="absolute-size"/>
-				<regexp name="relative-size"/>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="font-size-adjust" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="font-stretch" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="wider"/>
-				<literal value="narrower"/>
-				<literal value="ultra-condensed"/>
-				<literal value="extra-condensed"/>
-				<literal value="condensed"/>
-				<literal value="semi-condensed"/>
-				<literal value="semi-expanded"/>
-				<literal value="expanded"/>
-				<literal value="extra-expanded"/>
-				<literal value="ultra-expanded"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-style" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="italic"/>
-				<literal value="oblique"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-variant" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="small-caps"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-weight" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="bold"/>
-				<literal value="bolder"/>
-				<literal value="lighter"/>
-				<literal value="100"/>
-				<literal value="200"/>
-				<literal value="300"/>
-				<literal value="400"/>
-				<literal value="500"/>
-				<literal value="600"/>
-				<literal value="700"/>
-				<literal value="800"/>
-				<literal value="900"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="height" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="left" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="letter-spacing" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="line-height" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="list-style-image" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="list-style-position" default="outside" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inside"/>
-				<literal value="outside"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="list-style-type" default="disc" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="disc"/>
-				<literal value="circle"/>
-				<literal value="square"/>
-				<literal value="decimal"/>
-				<literal value="decimal-leading-zero"/>
-				<literal value="lower-roman"/>
-				<literal value="upper-roman"/>
-				<literal value="lower-greek"/>
-				<literal value="lower-alpha"/>
-				<literal value="lower-latin"/>
-				<literal value="upper-alpha"/>
-				<literal value="upper-latin"/>
-				<literal value="hebrew"/>
-				<literal value="armenian"/>
-				<literal value="georgian"/>
-				<literal value="cjk-ideographic"/>
-				<literal value="hiragana"/>
-				<literal value="katakana"/>
-				<literal value="hiragana-iroha"/>
-				<literal value="katakana-iroha"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="marker-offset" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="max-height" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="max-width" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="min-height" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="min-width" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="orphans" default="2" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="outline-color" default="invert" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="invert"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="overflow" default="visible" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="visible"/>
-				<literal value="hidden"/>
-				<literal value="scroll"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-after" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="always"/>
-				<literal value="avoid"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-before" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="always"/>
-				<literal value="avoid"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-inside" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="avoid"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="pause-after" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="pause-before" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="pitch" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="x-low"/>
-				<literal value="low"/>
-				<literal value="medium"/>
-				<literal value="high"/>
-				<literal value="x-high"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="frequency"/>
-			</regexp-list>
-		</property>
-		<property name="pitch-range" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="position" default="static" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="static"/>
-				<!-- possible to perform phishing attacks with the following -->
-				<!--
-				<literal value="relative"/>
-				<literal value="absolute"/>
-				<literal value="fixed"/>
-				 -->
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="richness" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="right" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="size" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="portrait"/>
-				<literal value="landscape"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="speak" default="normal" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="none"/>
-				<literal value="spell-out"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-header" default="once" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="once"/>
-				<literal value="always"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-numeral" default="continuous" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="digits"/>
-				<literal value="continuous"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-punctuation" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="code"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speech-rate" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="x-slow"/>
-				<literal value="slow"/>
-				<literal value="medium"/>
-				<literal value="fast"/>
-				<literal value="x-fast"/>
-				<literal value="faster"/>
-				<literal value="slower"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="stress" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="table-layout" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="fixed"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="text-indent" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="text-transform" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="capitalize"/>
-				<literal value="uppercase"/>
-				<literal value="lowercase"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="top" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="unicode-bidi" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="embed"/>
-				<literal value="bidi-override"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="vertical-align" default="baseline" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="baseline"/>
-				<literal value="sub"/>
-				<literal value="super"/>
-				<literal value="top"/>
-				<literal value="text-top"/>
-				<literal value="middle"/>
-				<literal value="bottom"/>
-				<literal value="text-bottom"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="percentage"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="visibility" default="inherit" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="visible"/>
-				<literal value="hidden"/>
-				<literal value="collapse"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="volume" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="silent"/>
-				<literal value="x-soft"/>
-				<literal value="soft"/>
-				<literal value="medium"/>
-				<literal value="loud"/>
-				<literal value="x-loud"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="white-space" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="pre"/>
-				<literal value="nowrap"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="widows" default="2" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="width" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="word-spacing" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-
-		<!-- end simple properties -->
-
-		<!-- begin medium properties -->
-		<property name="border-style" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="none"/>
-				<literal value="hidden"/>
-				<literal value="dotted"/>
-				<literal value="dashed"/>
-				<literal value="solid"/>
-				<literal value="double"/>
-				<literal value="groove"/>
-				<literal value="ridge"/>
-				<literal value="inset"/>
-				<literal value="outset"/>
-			</literal-list>
-		</property>
-		<property name="border-top-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="border-right-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-top-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-right-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-width" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="thin"/>
-				<literal value="medium"/>
-				<literal value="thick"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="margin" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="auto"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="positiveLength"/>
-				<regexp name="positivePercentage"/>
-			</regexp-list>
-		</property>
-		<property name="margin-top" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-right" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-bottom" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-left" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="outline-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="outline-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="padding" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="padding-top" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-right" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-bottom" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-left" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<!-- end medium properties -->
-
-		<!-- begin hard properties -->
-		<property name="border" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-top" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-right" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="cue" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="cue-before"/>
-				<shorthand name="cue-after"/>
-			</shorthand-list>
-		</property>
-		<property name="list-style" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="list-style-type"/>
-				<shorthand name="list-style-position"/>
-				<shorthand name="list-style-image"/>
-			</shorthand-list>
-		</property>
-		<property name="marks" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="crop"/>
-				<literal value="cross"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="outline" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="outline-color"/>
-				<shorthand name="outline-style"/>
-				<shorthand name="outline-width"/>
-			</shorthand-list>
-		</property>
-		<property name="pause" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="text-decoration" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="underline"/>
-				<literal value="overline"/>
-				<literal value="line-through"/>
-				<literal value="blink"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<!-- end hard properties -->
-		<!--  begin manual properties -->
-		<property name="border-spacing" default="0" description="The lengths specify the distance that separates adjacent cell borders. If one length is specified, it gives both the horizontal and vertical spacing. If two are specified, the first gives the horizontal spacing and the second the vertical spacing. Lengths may not be negative.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="clip" default="auto" description="The 'clip' property applies to elements that have a 'overflow' property with a value other than 'visible'.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="counter-increment" default="none" description="The 'counter-increment' property accepts one or more names of counters (identifiers), each one optionally followed by an integer.">
-			<category-list>
-				<category value="all"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssIdentifier"/>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="cursor" default="auto" description="This property specifies the type of cursor to be displayed for the pointing device.">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-				<literal value="crosshair"/>
-				<literal value="default"/>
-				<literal value="pointer"/>
-				<literal value="move"/>
-				<literal value="e-resize"/>
-				<literal value="ne-resize"/>
-				<literal value="nw-resize"/>
-				<literal value="n-resize"/>
-				<literal value="se-resize"/>
-				<literal value="sw-resize"/>
-				<literal value="s-resize"/>
-				<literal value="w-resize| text"/>
-				<literal value="wait"/>
-				<literal value="help"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-
-		<property name="text-shadow" default="none" description="This property accepts a comma-separated list of shadow effects to be applied to the text of the element.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-
-		<property name="font" description="The 'font' property is, except as described below, a shorthand property for setting 'font-style', 'font-variant', 'font-weight', 'font-size', 'line-height', and 'font-family', at the same place in the style sheet.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="/"/>
-				<literal value="caption"/>
-				<literal value="icon"/>
-				<literal value="menu"/>
-				<literal value="message-box"/>
-				<literal value="small-caption"/>
-				<literal value="status-bar"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="font-style"/>
-				<shorthand name="font-variant"/>
-				<shorthand name="font-weight"/>
-				<shorthand name="font-size"/>
-				<shorthand name="line-height"/>
-				<shorthand name="font-family"/>
-			</shorthand-list>
-		</property>
-
-		<property name="font-family" description="This property specifies a prioritized list of font family names and/or generic family names.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<!-- allowing only generic font families -->
-			<literal-list>
-				<literal value="serif"/>
-				<literal value="arial"/>
-				<literal value="lucida console"/>
-				<literal value="sans-serif"/>
-				<literal value="cursive"/>
-				<literal value="verdana"/>
-				<literal value="fantasy"/>
-				<literal value="monospace"/>
-			</literal-list>
-
-
-			<regexp-list>
-				<regexp value="[\w,\-&apos;&quot; ]+"/>
-			</regexp-list>
-
-		</property>
-		<property name="page" description="The 'page' property can be used to specify a particular type of page where an element should be displayed.">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssIdentifier"/>
-			</regexp-list>
-		</property>
-		<property name="play-during" default="auto" description="Similar to the 'cue-before' and 'cue-after' properties, this property specifies a sound to be played as a background while an element's content is spoken.">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="mix"/>
-				<literal value="repeat"/>
-				<literal value="none"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="text-align" description="This property describes how inline content of a block is aligned.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<!--  For safety, ignoring string alignment which can be used to line table cells on characters -->
-			<literal-list>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="center"/>
-				<literal value="justify"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="voice-family" description="The value is a comma-separated, prioritized list of voice family names (compare with 'font-family').">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<!--  Allowing only generic voice family -->
-			<literal-list>
-				<literal value="male"/>
-				<literal value="female"/>
-				<literal value="child"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<!--  end manual properties -->
-	</css-rules>
-<allowed-empty-tags>
+        <tag name="input" action="validate">
+
+            <attribute name="name" />
+
+            <attribute name="size" />
+
+            <attribute name="maxlength">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="autocomplete" />
+
+            <attribute name="checked">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="alt" />
+
+            <attribute name="src">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="offsiteURL" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="usemap">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="type">
+                <literal-list>
+                    <literal value="hidden" />
+                    <literal value="text" />
+                    <!-- <literal value="password"/> --> <!-- no user profiles should have password fields -->
+                    <literal value="radio" />
+                    <literal value="checkbox" />
+                    <literal value="submit" />
+                    <literal value="button" />
+                    <literal value="image" />
+                    <literal value="file" />
+                    <literal value="reset" />
+                </literal-list>
+            </attribute>
+
+            <attribute name="value">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="disabled" />
+            <attribute name="readonly" />
+            <attribute name="accesskey" />
+
+            <attribute name="border" />
+
+        </tag>
+
+        <tag name="select" action="validate">
+
+            <attribute name="name" />
+            <attribute name="disabled" />
+
+            <attribute name="multiple">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="size" />
+
+        </tag>
+
+        <tag name="option" action="validate">
+
+            <attribute name="disabled" />
+
+            <attribute name="value">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="label">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="selected">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+        <tag name="textarea" action="validate">
+            <attribute name="rows" />
+            <attribute name="cols" />
+            <attribute name="name" />
+            <attribute name="disabled" />
+            <attribute name="readonly" />
+            <attribute name="accesskey" />
+        </tag>
+
+
+
+
+        <!-- All formatting tags -->
+
+        <tag name="h1" action="validate" />
+        <tag name="h2" action="validate" />
+        <tag name="h3" action="validate" />
+        <tag name="h4" action="validate" />
+        <tag name="h5" action="validate" />
+        <tag name="h6" action="validate" />
+
+        <tag name="p" action="validate">
+            <attribute name="align" />
+        </tag>
+
+        <tag name="i" action="validate" />
+        <tag name="b" action="validate" />
+        <tag name="u" action="validate" />
+        <tag name="strong" action="validate" />
+
+        <tag name="em" action="validate" />
+        <tag name="small" action="validate" />
+        <tag name="big" action="validate" />
+        <tag name="pre" action="validate" />
+        <tag name="code" action="validate" />
+        <tag name="cite" action="validate" />
+        <tag name="samp" action="validate" />
+        <tag name="sub" action="validate" />
+        <tag name="sup" action="validate" />
+        <tag name="strike" action="validate" />
+        <tag name="center" action="validate" />
+        <tag name="blockquote" action="validate" />
+
+        <tag name="hr" action="validate" />
+        <tag name="br" action="validate" />
+
+        <tag name="font" action="validate">
+            <attribute name="color">
+                <regexp-list>
+                    <regexp name="colorName" />
+                    <regexp name="colorCode" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="face">
+                <regexp-list>
+                    <regexp value="[\w;, \-]+" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="size">
+                <regexp-list>
+                    <regexp value="(\+|-){0,1}(\d)+" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+
+        <!-- Anchor and anchor related tags -->
+
+        <tag name="a" action="validate">
+
+            <!-- onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
+            <attribute name="href" />
+            <attribute name="onFocus" />
+            <attribute name="onBlur" />
+            <attribute name="nohref">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+            <attribute name="rel">
+                <literal-list>
+                    <literal value="nofollow" />
+                </literal-list>
+            </attribute>
+            <attribute name="name" />
+
+        </tag>
+
+        <!-- base tag removed per demo - this could be enabled with literal-list values you allow -->
+        <!-- <tag name="base" action="validate"> <attribute name="href"/> </tag> -->
+
+
+
+        <!-- Stylesheet Tags -->
+
+        <tag name="style" action="validate">
+            <attribute name="type">
+                <literal-list>
+                    <literal value="text/css" />
+                </literal-list>
+            </attribute>
+            <attribute name="media" />
+        </tag>
+
+        <tag name="span" action="validate" />
+
+        <tag name="div" action="validate">
+            <attribute name="align" />
+        </tag>
+
+
+        <!-- Image & image related tags -->
+
+        <tag name="img" action="validate">
+            <attribute name="src" onInvalid="removeTag">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="offsiteURL" />
+                </regexp-list>
+            </attribute>
+            <attribute name="name" />
+            <attribute name="alt" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="border" />
+            <attribute name="align" />
+
+            <attribute name="hspace">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="vspace">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+        <!-- no way to do this safely without hooking up the same code to @import to embed the remote stylesheet (malicious user could change 
+            offsite resource to be malicious after validation -->
+        <!-- <attribute name="href" onInvalid="removeTag"/> -->
+
+        <tag name="link" action="validate">
+
+            <!-- <attribute name="href" onInvalid="removeTag"/> -->
+
+            <attribute name="media" />
+
+            <attribute name="type" onInvalid="removeTag">
+                <literal-list>
+                    <literal value="text/css" />
+                    <literal value="application/rss+xml" />
+                    <literal value="image/x-icon" />
+                </literal-list>
+            </attribute>
+
+            <attribute name="rel">
+                <literal-list>
+                    <literal value="stylesheet" />
+                    <literal value="shortcut icon" />
+                    <literal value="search" />
+                    <literal value="copyright" />
+                    <literal value="top" />
+                    <literal value="alternate" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+
+
+
+
+        <!-- List tags -->
+
+        <tag name="ul" action="validate" />
+        <tag name="ol" action="validate" />
+        <tag name="li" action="validate" />
+
+
+
+
+        <!-- Dictionary tags -->
+
+        <tag name="dd" action="truncate" />
+        <tag name="dl" action="truncate" />
+        <tag name="dt" action="truncate" />
+
+
+
+
+        <!-- Table tags (tbody, thead, tfoot) -->
+
+        <tag name="thead" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="tbody" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="tfoot" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="table" action="validate">
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="border" />
+            <attribute name="bgcolor" />
+            <attribute name="cellpadding" />
+            <attribute name="cellspacing" />
+            <attribute name="background" />
+            <attribute name="align" />
+            <attribute name="noresize">
+                <literal-list>
+                    <literal value="noresize" />
+                    <literal value="" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+        <tag name="td" action="validate">
+            <attribute name="background" />
+            <attribute name="bgcolor" />
+            <attribute name="abbr" />
+            <attribute name="axis" />
+            <attribute name="headers" />
+            <attribute name="scope" />
+            <attribute name="nowrap" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="colspan" />
+            <attribute name="rowspan" />
+        </tag>
+
+        <tag name="th" action="validate">
+            <attribute name="abbr" />
+            <attribute name="axis" />
+            <attribute name="headers" />
+            <attribute name="scope" />
+            <attribute name="nowrap" />
+            <attribute name="bgcolor" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="colspan" />
+            <attribute name="rowspan" />
+        </tag>
+
+        <tag name="tr" action="validate">
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="valign" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="background" />
+        </tag>
+
+        <tag name="colgroup" action="validate">
+
+            <attribute name="span">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="col" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="span">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+            <attribute name="width" />
+        </tag>
+
+        <tag name="fieldset" action="validate" />
+        <tag name="legend" action="validate" />
+
+    </tag-rules>
+
+
+    <!-- CSS validation processing rules -->
+
+    <css-rules>
+
+        <property name="azimuth"
+            description="This property is most likely to be implemented by mixing the same signal into different channels at differing volumes.">
+            <literal-list>
+                <literal value="left-side" />
+                <literal value="far-left" />
+                <literal value="left" />
+                <literal value="center-left" />
+                <literal value="center" />
+                <literal value="center-right" />
+                <literal value="right" />
+                <literal value="far-right" />
+                <literal value="right-side" />
+                <literal value="behind" />
+                <literal value="leftwards" />
+                <literal value="rightwards" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="angle" />
+            </regexp-list>
+        </property>
+
+        <property name="background"
+            description="The 'background' property is a shorthand property for setting the individual background properties (i.e., 'background-color', 'background-image', 'background-repeat', 'background-attachment' and 'background-position') at the same place in the style sheet.">
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="background-color" />
+                <shorthand name="background-image" />
+                <shorthand name="background-repeat" />
+                <shorthand name="background-attachment" />
+                <shorthand name="background-position" />
+            </shorthand-list>
+        </property>
+
+        <property name="background-attachment"
+            description="If a background image is specified, this property specifies whether it is fixed with regard to the viewport ('fixed') or scrolls along with the document ('scroll').">
+            <literal-list>
+                <literal value="scroll" />
+                <literal value="fixed" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+
+        <property name="background-color"
+            description="This property sets the background color of an element, either a &lt;color&gt; value or the keyword 'transparent', to make the underlying colors shine through.">
+            <literal-list>
+                <literal value="transparent" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+
+        <property name="background-image" description="This property sets the background image of an element.">
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+
+        <property name="background-position"
+            description="If a background image has been specified, this property specifies its initial position.">
+            <literal-list>
+                <literal value="top" />
+                <literal value="center" />
+                <literal value="bottom" />
+                <literal value="left" />
+                <literal value="center" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="percentage" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <property name="background-repeat"
+            description="If a background image is specified, this property specifies whether the image is repeated (tiled), and how.">
+            <literal-list>
+                <literal value="repeat" />
+                <literal value="repeat-x" />
+                <literal value="repeat-y" />
+                <literal value="no-repeat" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+
+        <!-- Begin simple properties -->
+        <property name="border-collapse" default="collapse" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="collapse" />
+                <literal value="separate" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="border-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="transparent" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-top-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-right-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-bottom-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-left-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="bottom" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="caption-side" default="top" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="top" />
+                <literal value="bottom" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="clear" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="both" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="cue-after" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="cue-before" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="direction" default="ltr" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="ltr" />
+                <literal value="rtl" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="display" default="inline" description="">
+            <category-list>
+                <category value="all" />
+            </category-list>
+            <literal-list>
+                <literal value="inline" />
+                <literal value="block" />
+                <literal value="list-item" />
+                <literal value="run-in" />
+                <literal value="compact" />
+                <literal value="marker" />
+                <literal value="table" />
+                <literal value="inline-table" />
+                <literal value="table-row-group" />
+                <literal value="table-header-group" />
+                <literal value="table-footer-group" />
+                <literal value="table-row" />
+                <literal value="table-column-group" />
+                <literal value="table-column" />
+                <literal value="table-cell" />
+                <literal value="table-caption" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="elevation" default="level" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="below" />
+                <literal value="level" />
+                <literal value="above" />
+                <literal value="higher" />
+                <literal value="lower" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="angle" />
+            </regexp-list>
+        </property>
+        <property name="empty-cells" default="show" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="show" />
+                <literal value="hide" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="float" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-size" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="absolute-size" />
+                <regexp name="relative-size" />
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="font-size-adjust" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="font-stretch" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="wider" />
+                <literal value="narrower" />
+                <literal value="ultra-condensed" />
+                <literal value="extra-condensed" />
+                <literal value="condensed" />
+                <literal value="semi-condensed" />
+                <literal value="semi-expanded" />
+                <literal value="expanded" />
+                <literal value="extra-expanded" />
+                <literal value="ultra-expanded" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-style" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="italic" />
+                <literal value="oblique" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-variant" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="small-caps" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-weight" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="bold" />
+                <literal value="bolder" />
+                <literal value="lighter" />
+                <literal value="100" />
+                <literal value="200" />
+                <literal value="300" />
+                <literal value="400" />
+                <literal value="500" />
+                <literal value="600" />
+                <literal value="700" />
+                <literal value="800" />
+                <literal value="900" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="height" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="left" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="letter-spacing" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="line-height" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="list-style-image" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="list-style-position" default="outside" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inside" />
+                <literal value="outside" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="list-style-type" default="disc" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="disc" />
+                <literal value="circle" />
+                <literal value="square" />
+                <literal value="decimal" />
+                <literal value="decimal-leading-zero" />
+                <literal value="lower-roman" />
+                <literal value="upper-roman" />
+                <literal value="lower-greek" />
+                <literal value="lower-alpha" />
+                <literal value="lower-latin" />
+                <literal value="upper-alpha" />
+                <literal value="upper-latin" />
+                <literal value="hebrew" />
+                <literal value="armenian" />
+                <literal value="georgian" />
+                <literal value="cjk-ideographic" />
+                <literal value="hiragana" />
+                <literal value="katakana" />
+                <literal value="hiragana-iroha" />
+                <literal value="katakana-iroha" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="marker-offset" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="max-height" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="max-width" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="min-height" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="min-width" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="orphans" default="2" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="outline-color" default="invert" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="invert" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="overflow" default="visible" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="visible" />
+                <literal value="hidden" />
+                <literal value="scroll" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-after" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="always" />
+                <literal value="avoid" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-before" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="always" />
+                <literal value="avoid" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-inside" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="avoid" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="pause-after" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="pause-before" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="pitch" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="x-low" />
+                <literal value="low" />
+                <literal value="medium" />
+                <literal value="high" />
+                <literal value="x-high" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="frequency" />
+            </regexp-list>
+        </property>
+        <property name="pitch-range" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="position" default="static" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="static" />
+                <!-- possible to perform phishing attacks with the following -->
+                <!-- <literal value="relative"/> <literal value="absolute"/> <literal value="fixed"/> -->
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="richness" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="right" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="size" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="portrait" />
+                <literal value="landscape" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="speak" default="normal" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="none" />
+                <literal value="spell-out" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-header" default="once" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="once" />
+                <literal value="always" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-numeral" default="continuous" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="digits" />
+                <literal value="continuous" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-punctuation" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="code" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speech-rate" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="x-slow" />
+                <literal value="slow" />
+                <literal value="medium" />
+                <literal value="fast" />
+                <literal value="x-fast" />
+                <literal value="faster" />
+                <literal value="slower" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="stress" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="table-layout" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="fixed" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="text-indent" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="text-transform" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="capitalize" />
+                <literal value="uppercase" />
+                <literal value="lowercase" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="top" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="unicode-bidi" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="embed" />
+                <literal value="bidi-override" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="vertical-align" default="baseline" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="baseline" />
+                <literal value="sub" />
+                <literal value="super" />
+                <literal value="top" />
+                <literal value="text-top" />
+                <literal value="middle" />
+                <literal value="bottom" />
+                <literal value="text-bottom" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="percentage" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="visibility" default="inherit" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="visible" />
+                <literal value="hidden" />
+                <literal value="collapse" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="volume" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="silent" />
+                <literal value="x-soft" />
+                <literal value="soft" />
+                <literal value="medium" />
+                <literal value="loud" />
+                <literal value="x-loud" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="white-space" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="pre" />
+                <literal value="nowrap" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="widows" default="2" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="width" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="word-spacing" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <!-- end simple properties -->
+
+        <!-- begin medium properties -->
+        <property name="border-style" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="none" />
+                <literal value="hidden" />
+                <literal value="dotted" />
+                <literal value="dashed" />
+                <literal value="solid" />
+                <literal value="double" />
+                <literal value="groove" />
+                <literal value="ridge" />
+                <literal value="inset" />
+                <literal value="outset" />
+            </literal-list>
+        </property>
+        <property name="border-top-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="border-right-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-left-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-top-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-right-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-left-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-width" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="thin" />
+                <literal value="medium" />
+                <literal value="thick" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="margin" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="auto" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="positiveLength" />
+                <regexp name="positivePercentage" />
+            </regexp-list>
+        </property>
+        <property name="margin-top" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-right" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-bottom" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-left" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="outline-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="outline-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="padding" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="padding-top" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-right" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-bottom" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-left" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <!-- end medium properties -->
+
+        <!-- begin hard properties -->
+        <property name="border" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-top" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-right" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-left" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="cue" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="cue-before" />
+                <shorthand name="cue-after" />
+            </shorthand-list>
+        </property>
+        <property name="list-style" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="list-style-type" />
+                <shorthand name="list-style-position" />
+                <shorthand name="list-style-image" />
+            </shorthand-list>
+        </property>
+        <property name="marks" default="none" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="crop" />
+                <literal value="cross" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="outline" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="outline-color" />
+                <shorthand name="outline-style" />
+                <shorthand name="outline-width" />
+            </shorthand-list>
+        </property>
+        <property name="pause" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="text-decoration" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="underline" />
+                <literal value="overline" />
+                <literal value="line-through" />
+                <literal value="blink" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <!-- end hard properties -->
+        <!-- begin manual properties -->
+        <property name="border-spacing" default="0"
+            description="The lengths specify the distance that separates adjacent cell borders. If one length is specified, it gives both the horizontal and vertical spacing. If two are specified, the first gives the horizontal spacing and the second the vertical spacing. Lengths may not be negative.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="clip" default="auto"
+            description="The 'clip' property applies to elements that have a 'overflow' property with a value other than 'visible'.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="counter-increment" default="none"
+            description="The 'counter-increment' property accepts one or more names of counters (identifiers), each one optionally followed by an integer.">
+            <category-list>
+                <category value="all" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssIdentifier" />
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="cursor" default="auto"
+            description="This property specifies the type of cursor to be displayed for the pointing device.">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+                <literal value="crosshair" />
+                <literal value="default" />
+                <literal value="pointer" />
+                <literal value="move" />
+                <literal value="e-resize" />
+                <literal value="ne-resize" />
+                <literal value="nw-resize" />
+                <literal value="n-resize" />
+                <literal value="se-resize" />
+                <literal value="sw-resize" />
+                <literal value="s-resize" />
+                <literal value="w-resize| text" />
+                <literal value="wait" />
+                <literal value="help" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+
+        <property name="text-shadow" default="none"
+            description="This property accepts a comma-separated list of shadow effects to be applied to the text of the element.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <property name="font"
+            description="The 'font' property is, except as described below, a shorthand property for setting 'font-style', 'font-variant', 'font-weight', 'font-size', 'line-height', and 'font-family', at the same place in the style sheet.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="/" />
+                <literal value="caption" />
+                <literal value="icon" />
+                <literal value="menu" />
+                <literal value="message-box" />
+                <literal value="small-caption" />
+                <literal value="status-bar" />
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="font-style" />
+                <shorthand name="font-variant" />
+                <shorthand name="font-weight" />
+                <shorthand name="font-size" />
+                <shorthand name="line-height" />
+                <shorthand name="font-family" />
+            </shorthand-list>
+        </property>
+
+        <property name="font-family"
+            description="This property specifies a prioritized list of font family names and/or generic family names.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <!-- allowing only generic font families -->
+            <literal-list>
+                <literal value="serif" />
+                <literal value="arial" />
+                <literal value="lucida console" />
+                <literal value="sans-serif" />
+                <literal value="cursive" />
+                <literal value="verdana" />
+                <literal value="fantasy" />
+                <literal value="monospace" />
+            </literal-list>
+
+
+            <regexp-list>
+                <regexp value="[\w,\-&apos;&quot; ]+" />
+            </regexp-list>
+
+        </property>
+        <property name="page"
+            description="The 'page' property can be used to specify a particular type of page where an element should be displayed.">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssIdentifier" />
+            </regexp-list>
+        </property>
+        <property name="play-during" default="auto"
+            description="Similar to the 'cue-before' and 'cue-after' properties, this property specifies a sound to be played as a background while an element's content is spoken.">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="mix" />
+                <literal value="repeat" />
+                <literal value="none" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="text-align" description="This property describes how inline content of a block is aligned.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <!-- For safety, ignoring string alignment which can be used to line table cells on characters -->
+            <literal-list>
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="center" />
+                <literal value="justify" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="voice-family"
+            description="The value is a comma-separated, prioritized list of voice family names (compare with 'font-family').">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <!-- Allowing only generic voice family -->
+            <literal-list>
+                <literal value="male" />
+                <literal value="female" />
+                <literal value="child" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <!-- end manual properties -->
+    </css-rules>
+    <allowed-empty-tags>
         <literal-list>
-            <literal value="br"/>
-            <literal value="hr"/>
-            <literal value="a"/>
-            <literal value="img"/>
-            <literal value="link"/>
-            <literal value="iframe"/>
-            <literal value="script"/>
-            <literal value="object"/>
-            <literal value="applet"/>
-            <literal value="frame"/>
-            <literal value="base"/>
-            <literal value="param"/>
-            <literal value="meta"/>
-            <literal value="input"/>
-            <literal value="textarea"/>
-            <literal value="embed"/>
-            <literal value="basefont"/>
-            <literal value="col"/>
-            <literal value="div"/>
+            <literal value="br" />
+            <literal value="hr" />
+            <literal value="a" />
+            <literal value="img" />
+            <literal value="link" />
+            <literal value="iframe" />
+            <literal value="script" />
+            <literal value="object" />
+            <literal value="applet" />
+            <literal value="frame" />
+            <literal value="base" />
+            <literal value="param" />
+            <literal value="meta" />
+            <literal value="input" />
+            <literal value="textarea" />
+            <literal value="embed" />
+            <literal value="basefont" />
+            <literal value="col" />
+            <literal value="div" />
         </literal-list>
     </allowed-empty-tags>
 </anti-samy-rules>
diff --git a/src/main/resources/antisamy-slashdot.xml b/src/main/resources/antisamy-slashdot.xml
index 2cbe9f00..dbe5e6ab 100644
--- a/src/main/resources/antisamy-slashdot.xml
+++ b/src/main/resources/antisamy-slashdot.xml
@@ -1,201 +1,185 @@
 <?xml version="1.0" encoding="ISO-8859-1"?>
-	
-<!-- 
-W3C rules retrieved from:
-http://www.w3.org/TR/html401/struct/global.html
--->
-	
-<!--
-Slashdot allowed tags taken from "Reply" page:
-<b> <i> <p> <br> <a> <ol> <ul> <li> <dl> <dt> <dd> <em> <strong> <tt> <blockquote> <div> <ecode> <quote>
--->
-
-<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-		xsi:noNamespaceSchemaLocation="antisamy.xsd">
-	
-	<directives>
-		<directive name="omitXmlDeclaration" value="true"/>
-		<directive name="omitDoctypeDeclaration" value="true"/>
-		<directive name="maxInputSize" value="5000"/>
-		<directive name="formatOutput" value="true"/>
-		
-		<directive name="embedStyleSheets" value="false"/>
-	</directives>
-	
-	<common-regexps>
-		
-		<!-- 
-		From W3C:
-		This attribute assigns a class name or set of class names to an
-		element. Any number of elements may be assigned the same class
-		name or names. Multiple class names must be separated by white 
-		space characters.
-		-->
-		
-		<regexp name="htmlTitle" value="[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&amp;]*"/> <!-- force non-empty with a '+' at the end instead of '*' -->
-		<regexp name="onsiteURL" value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*"/>
-		<regexp name="offsiteURL" value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@\#\$%&amp;;:,\?=/\+!\(\)]*(\s)*"/>
-	
-	</common-regexps>
-	
-	<!-- 
-	
-	Tag.name = a, b, div, body, etc.
-	Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, remove: remove tag and contents
-	Attribute.name = id, class, href, align, width, etc.
-	Attribute.onInvalid = what to do when the attribute is invalid, e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag)
-	Attribute.description = What rules in English you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML
-	 
-	 -->
-
-	<!-- 
-	Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no
-	collisions between any of these attribute names with attribute names of other tags that are for different purposes.
-	-->
-
-	<common-attributes>
-		
-
-		<attribute name="lang" description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
-		 	<regexp-list>
-		 		<regexp value="[a-zA-Z0-9-]{2,20}"/>
-		 	</regexp-list>
-		 </attribute>
-		 
-		 <attribute name="title" description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
-		 	<regexp-list>
-		 		<regexp name="htmlTitle"/>
-		 	</regexp-list>
-		 </attribute>
-
-		<attribute name="href" onInvalid="filterTag">
-			<regexp-list>
-				<regexp name="onsiteURL"/>
-				<regexp name="offsiteURL"/>
-			</regexp-list>
-		</attribute>
-	
-		<attribute name="align" description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
-			<literal-list>
-				<literal value="center"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="justify"/>
-				<literal value="char"/>
-			</literal-list>
-		</attribute>
-
-	</common-attributes>
-
-
-	<!--
-	This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue
-	this is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after 
-	a while?
-	 -->
-	
-	<global-tag-attributes>
-		<attribute name="title"/>
-		<attribute name="lang"/>
-	</global-tag-attributes>
-
-	<tags-to-encode>
-		<tag>g</tag>
-		<tag>grin</tag>
-	</tags-to-encode>
-	
-	<tag-rules>
-
-		<!-- Tags related to JavaScript -->
-
-		<tag name="script" action="remove"/>
-		<tag name="noscript" action="remove"/>
-		
-		<!-- Frame & related tags -->
-		
-		<tag name="iframe" action="remove"/>
-		<tag name="frameset" action="remove"/>
-		<tag name="frame" action="remove"/>
-		<tag name="noframes" action="remove"/>
-		
-		<!-- CSS related tags -->
-		<tag name="style" action="remove"/>
-
-		<!-- All reasonable formatting tags -->
-		
-		<tag name="p" action="validate">
-			<attribute name="align"/>
-		</tag>
-
-		<tag name="div" action="validate"/>		
-		<tag name="i" action="validate"/>
-		<tag name="b" action="validate"/>
-		<tag name="em" action="validate"/>
-		<tag name="blockquote" action="validate"/>
-		<tag name="tt" action="validate"/>
-		<tag name="strong" action="validate"/>
-		
-		<tag name="br" action="truncate"/>
-
-		<!-- Custom Slashdot tags, though we're trimming the idea of having a possible mismatching end tag with the endtag="" attribute -->
-		
-		<tag name="quote" action="validate"/>
-		<tag name="ecode" action="validate"/> 
-		
-						
-		<!-- Anchor and anchor related tags -->
-		
-		<tag name="a" action="validate">
-
-			<attribute name="href" onInvalid="filterTag"/>
-			<attribute name="nohref">
-				<literal-list>
-					<literal value="nohref"/>
-					<literal value=""/>
-				</literal-list>
-			</attribute>
-			<attribute name="rel">
-				<literal-list>
-					<literal value="nofollow"/>
-				</literal-list>
-			</attribute>
-		</tag>
-
-		<!-- List tags -->
-
-		<tag name="ul" action="validate"/>
-		<tag name="ol" action="validate"/>
-		<tag name="li" action="validate"/>
-		
-	</tag-rules>
-
-
-
-	<!--  No CSS on Slashdot posts -->
-
-	<css-rules>
-	</css-rules>
-<allowed-empty-tags>
+
+<!-- W3C rules retrieved from: http://www.w3.org/TR/html401/struct/global.html -->
+
+<!-- Slashdot allowed tags taken from "Reply" page: <b> <i> <p> <br> <a> <ol> <ul> <li> <dl> <dt> <dd> <em> <strong> <tt> <blockquote> <div> 
+    <ecode> <quote> -->
+
+<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="antisamy.xsd">
+
+    <directives>
+        <directive name="omitXmlDeclaration" value="true" />
+        <directive name="omitDoctypeDeclaration" value="true" />
+        <directive name="maxInputSize" value="5000" />
+        <directive name="formatOutput" value="true" />
+
+        <directive name="embedStyleSheets" value="false" />
+    </directives>
+
+    <common-regexps>
+
+        <!-- From W3C: This attribute assigns a class name or set of class names to an element. Any number of elements may be assigned the same 
+            class name or names. Multiple class names must be separated by white space characters. -->
+
+        <regexp name="htmlTitle" value="[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&amp;]*" /> <!-- force non-empty with a '+' at the end instead of '*' -->
+        <regexp name="onsiteURL"
+            value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*" />
+        <regexp name="offsiteURL"
+            value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@\#\$%&amp;;:,\?=/\+!\(\)]*(\s)*" />
+
+    </common-regexps>
+
+    <!-- Tag.name = a, b, div, body, etc. Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, 
+        remove: remove tag and contents Attribute.name = id, class, href, align, width, etc. Attribute.onInvalid = what to do when the attribute is invalid, 
+        e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag) Attribute.description = What rules in English 
+        you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML -->
+
+    <!-- Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no collisions 
+        between any of these attribute names with attribute names of other tags that are for different purposes. -->
+
+    <common-attributes>
+
+
+        <attribute name="lang"
+            description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9-]{2,20}" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="title"
+            description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
+            <regexp-list>
+                <regexp name="htmlTitle" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="href" onInvalid="filterTag">
+            <regexp-list>
+                <regexp name="onsiteURL" />
+                <regexp name="offsiteURL" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="align"
+            description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
+            <literal-list>
+                <literal value="center" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="justify" />
+                <literal value="char" />
+            </literal-list>
+        </attribute>
+
+    </common-attributes>
+
+
+    <!-- This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue this 
+        is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after a while? -->
+
+    <global-tag-attributes>
+        <attribute name="title" />
+        <attribute name="lang" />
+    </global-tag-attributes>
+
+    <tags-to-encode>
+        <tag>g</tag>
+        <tag>grin</tag>
+    </tags-to-encode>
+
+    <tag-rules>
+
+        <!-- Tags related to JavaScript -->
+
+        <tag name="script" action="remove" />
+        <tag name="noscript" action="remove" />
+
+        <!-- Frame & related tags -->
+
+        <tag name="iframe" action="remove" />
+        <tag name="frameset" action="remove" />
+        <tag name="frame" action="remove" />
+        <tag name="noframes" action="remove" />
+
+        <!-- CSS related tags -->
+        <tag name="style" action="remove" />
+
+        <!-- All reasonable formatting tags -->
+
+        <tag name="p" action="validate">
+            <attribute name="align" />
+        </tag>
+
+        <tag name="div" action="validate" />
+        <tag name="i" action="validate" />
+        <tag name="b" action="validate" />
+        <tag name="em" action="validate" />
+        <tag name="blockquote" action="validate" />
+        <tag name="tt" action="validate" />
+        <tag name="strong" action="validate" />
+
+        <tag name="br" action="truncate" />
+
+        <!-- Custom Slashdot tags, though we're trimming the idea of having a possible mismatching end tag with the endtag="" attribute -->
+
+        <tag name="quote" action="validate" />
+        <tag name="ecode" action="validate" />
+
+
+        <!-- Anchor and anchor related tags -->
+
+        <tag name="a" action="validate">
+
+            <attribute name="href" onInvalid="filterTag" />
+            <attribute name="nohref">
+                <literal-list>
+                    <literal value="nohref" />
+                    <literal value="" />
+                </literal-list>
+            </attribute>
+            <attribute name="rel">
+                <literal-list>
+                    <literal value="nofollow" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+        <!-- List tags -->
+
+        <tag name="ul" action="validate" />
+        <tag name="ol" action="validate" />
+        <tag name="li" action="validate" />
+
+    </tag-rules>
+
+
+
+    <!-- No CSS on Slashdot posts -->
+
+    <css-rules>
+    </css-rules>
+    <allowed-empty-tags>
         <literal-list>
-            <literal value="br"/>
-            <literal value="hr"/>
-            <literal value="a"/>
-            <literal value="img"/>
-            <literal value="link"/>
-            <literal value="iframe"/>
-            <literal value="script"/>
-            <literal value="object"/>
-            <literal value="applet"/>
-            <literal value="frame"/>
-            <literal value="base"/>
-            <literal value="param"/>
-            <literal value="meta"/>
-            <literal value="input"/>
-            <literal value="textarea"/>
-            <literal value="embed"/>
-            <literal value="basefont"/>
-            <literal value="col"/>
-            <literal value="div"/>
+            <literal value="br" />
+            <literal value="hr" />
+            <literal value="a" />
+            <literal value="img" />
+            <literal value="link" />
+            <literal value="iframe" />
+            <literal value="script" />
+            <literal value="object" />
+            <literal value="applet" />
+            <literal value="frame" />
+            <literal value="base" />
+            <literal value="param" />
+            <literal value="meta" />
+            <literal value="input" />
+            <literal value="textarea" />
+            <literal value="embed" />
+            <literal value="basefont" />
+            <literal value="col" />
+            <literal value="div" />
         </literal-list>
     </allowed-empty-tags>
 
diff --git a/src/main/resources/antisamy-tinymce.xml b/src/main/resources/antisamy-tinymce.xml
index 0b494e03..7ca9eb5f 100644
--- a/src/main/resources/antisamy-tinymce.xml
+++ b/src/main/resources/antisamy-tinymce.xml
@@ -1,224 +1,201 @@
 <?xml version="1.0" encoding="UTF-8" ?>
 
-<!--
-	TinyMCE
--->
-
-<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:noNamespaceSchemaLocation="antisamy.xsd">
-
-	<directives>
-		<directive name="omitXmlDeclaration" value="true" />
-		<directive name="omitDoctypeDeclaration" value="false" />
-		<directive name="maxInputSize" value="100000" />
-		<directive name="embedStyleSheets" value="false" />
-		<directive name="formatOutput" value="true" />
-	</directives>
-
-	<common-regexps>
-
-		<!--
-			From W3C:
-			This attribute assigns a class name or set of class names to an
-			element. Any number of elements may be assigned the same class
-			name or names. Multiple class names must be separated by white
-			space characters.
-		-->
-		<regexp name="htmlTitle" value="[a-zA-Z0-9\s\-_',:\[\]!\./\\\(\)&amp;]*" />
-
-		<!--  force non-empty with a '+' at the end instead of '*'
-		-->
-		<regexp name="onsiteURL" value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*"/>
-
-		<!--  ([\w\\/\.\?=&amp;;\#-~]+|\#(\w)+)
-		-->
-
-		<!--  ([\p{L}/ 0-9&amp;\#-.?=])*
-		-->
-		<regexp name="offsiteURL" value="(\s)*((ht|f)tp(s?)://|mailto:)[A-Za-z0-9]+[~a-zA-Z0-9-_\.@\#\$%&amp;;:,\?=/\+!\(\)]*(\s)*" />
-	</common-regexps>
-
-	<!--
-		Tag.name = a, b, div, body, etc.
-		Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, remove: remove tag and contents
-		Attribute.name = id, class, href, align, width, etc.
-		Attribute.onInvalid = what to do when the attribute is invalid, e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag)
-		Attribute.description = What rules in English you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML
-	-->
-
-	<!--
-		Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no
-		collisions between any of these attribute names with attribute names of other tags that are for different purposes.
-	-->
-
-	<common-attributes>
-
-		<attribute name="lang"
-			description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
-
-			<regexp-list>
-				<regexp value="[a-zA-Z0-9-]{2,20}" />
-			</regexp-list>
-		</attribute>
-
-		<attribute name="title"
-			description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
-
-			<regexp-list>
-				<regexp name="htmlTitle" />
-			</regexp-list>
-		</attribute>
-
-		<attribute name="href" onInvalid="filterTag">
-
-			<regexp-list>
-				<regexp name="onsiteURL" />
-				<regexp name="offsiteURL" />
-
-				<!--
-				-->
-			</regexp-list>
-		</attribute>
-
-		<attribute name="align"
-			description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
-
-			<literal-list>
-				<literal value="center" />
-				<literal value="left" />
-				<literal value="right" />
-				<literal value="justify" />
-				<literal value="char" />
-			</literal-list>
-		</attribute>
-		<attribute name="style"
-			description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax" />
-	</common-attributes>
-
-	<!--
-		This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue
-		this is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after
-		a while?
-
-
-	-->
-
-	<global-tag-attributes>
-		<attribute name="title" />
-		<attribute name="lang" />
-		<attribute name="style" />
-	</global-tag-attributes>
-
-	<tags-to-encode>
-		<tag>g</tag>
-		<tag>grin</tag>
-	</tags-to-encode>
-
-	<tag-rules>
-
-		<!--  Remove  -->
-
-		<tag name="script" action="remove" />
-		<tag name="noscript" action="remove" />
-		<tag name="iframe" action="remove" />
-		<tag name="frameset" action="remove" />
-		<tag name="frame" action="remove" />
-		<tag name="noframes" action="remove" />
-		<tag name="head" action="remove" />
-		<tag name="title" action="remove" />
-		<tag name="base" action="remove" />
-		<tag name="style" action="remove" />
-		<tag name="link" action="remove" />
-		<tag name="input" action="remove" />
-		<tag name="textarea" action="remove" />
-
-		<!--  Truncate  -->
-		<tag name="br" action="truncate" />
-
-		<!--  Validate -->
-
-		<tag name="p" action="validate">
-			<attribute name="align" />
-		</tag>
-		<tag name="div" action="validate" />
-		<tag name="span" action="validate" />
-		<tag name="i" action="validate" />
-		<tag name="b" action="validate" />
-		<tag name="strong" action="validate" />
-		<tag name="s" action="validate" />
-		<tag name="strike" action="validate" />
-		<tag name="u" action="validate" />
-		<tag name="em" action="validate" />
-		<tag name="blockquote" action="validate" />
-		<tag name="tt" action="truncate" />
-
-		<tag name="a" action="validate">
-			<attribute name="href" onInvalid="filterTag" />
-
-			<attribute name="nohref">
-
-				<literal-list>
-					<literal value="nohref" />
-					<literal value="" />
-				</literal-list>
-			</attribute>
-
-			<attribute name="rel">
-
-				<literal-list>
-					<literal value="nofollow" />
-				</literal-list>
-			</attribute>
-		</tag>
-
-		<!--  List tags
-		-->
-		<tag name="ul" action="validate" />
-		<tag name="ol" action="validate" />
-		<tag name="li" action="validate" />
-		<tag name="dl" action="validate" />
-		<tag name="dt" action="validate" />
-		<tag name="dd" action="validate" />
-	</tag-rules>
-
-	<css-rules>
-
-		<property name="text-decoration" default="none"
-			description="">
-
-			<category-list>
-				<category value="visual" />
-			</category-list>
-
-			<literal-list>
-				<literal value="underline" />
-				<literal value="overline" />
-				<literal value="line-through" />
-			</literal-list>
-		</property>
-	</css-rules>
-
-        <allowed-empty-tags>
+<!-- TinyMCE -->
+
+<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="antisamy.xsd">
+
+    <directives>
+        <directive name="omitXmlDeclaration" value="true" />
+        <directive name="omitDoctypeDeclaration" value="false" />
+        <directive name="maxInputSize" value="100000" />
+        <directive name="embedStyleSheets" value="false" />
+        <directive name="formatOutput" value="true" />
+    </directives>
+
+    <common-regexps>
+
+        <!-- From W3C: This attribute assigns a class name or set of class names to an element. Any number of elements may be assigned the same 
+            class name or names. Multiple class names must be separated by white space characters. -->
+        <regexp name="htmlTitle" value="[a-zA-Z0-9\s\-_',:\[\]!\./\\\(\)&amp;]*" />
+
+        <!-- force non-empty with a '+' at the end instead of '*' -->
+        <regexp name="onsiteURL"
+            value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*" />
+
+        <!-- ([\w\\/\.\?=&amp;;\#-~]+|\#(\w)+) -->
+
+        <!-- ([\p{L}/ 0-9&amp;\#-.?=])* -->
+        <regexp name="offsiteURL" value="(\s)*((ht|f)tp(s?)://|mailto:)[A-Za-z0-9]+[~a-zA-Z0-9-_\.@\#\$%&amp;;:,\?=/\+!\(\)]*(\s)*" />
+    </common-regexps>
+
+    <!-- Tag.name = a, b, div, body, etc. Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, 
+        remove: remove tag and contents Attribute.name = id, class, href, align, width, etc. Attribute.onInvalid = what to do when the attribute is invalid, 
+        e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag) Attribute.description = What rules in English 
+        you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML -->
+
+    <!-- Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no collisions 
+        between any of these attribute names with attribute names of other tags that are for different purposes. -->
+
+    <common-attributes>
+
+        <attribute name="lang"
+            description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
+
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9-]{2,20}" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="title"
+            description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
+
+            <regexp-list>
+                <regexp name="htmlTitle" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="href" onInvalid="filterTag">
+
+            <regexp-list>
+                <regexp name="onsiteURL" />
+                <regexp name="offsiteURL" />
+
+                <!-- -->
+            </regexp-list>
+        </attribute>
+
+        <attribute name="align"
+            description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
+
+            <literal-list>
+                <literal value="center" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="justify" />
+                <literal value="char" />
+            </literal-list>
+        </attribute>
+        <attribute name="style"
+            description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax" />
+    </common-attributes>
+
+    <!-- This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue this 
+        is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after a while? -->
+
+    <global-tag-attributes>
+        <attribute name="title" />
+        <attribute name="lang" />
+        <attribute name="style" />
+    </global-tag-attributes>
+
+    <tags-to-encode>
+        <tag>g</tag>
+        <tag>grin</tag>
+    </tags-to-encode>
+
+    <tag-rules>
+
+        <!-- Remove -->
+
+        <tag name="script" action="remove" />
+        <tag name="noscript" action="remove" />
+        <tag name="iframe" action="remove" />
+        <tag name="frameset" action="remove" />
+        <tag name="frame" action="remove" />
+        <tag name="noframes" action="remove" />
+        <tag name="head" action="remove" />
+        <tag name="title" action="remove" />
+        <tag name="base" action="remove" />
+        <tag name="style" action="remove" />
+        <tag name="link" action="remove" />
+        <tag name="input" action="remove" />
+        <tag name="textarea" action="remove" />
+
+        <!-- Truncate -->
+        <tag name="br" action="truncate" />
+
+        <!-- Validate -->
+
+        <tag name="p" action="validate">
+            <attribute name="align" />
+        </tag>
+        <tag name="div" action="validate" />
+        <tag name="span" action="validate" />
+        <tag name="i" action="validate" />
+        <tag name="b" action="validate" />
+        <tag name="strong" action="validate" />
+        <tag name="s" action="validate" />
+        <tag name="strike" action="validate" />
+        <tag name="u" action="validate" />
+        <tag name="em" action="validate" />
+        <tag name="blockquote" action="validate" />
+        <tag name="tt" action="truncate" />
+
+        <tag name="a" action="validate">
+            <attribute name="href" onInvalid="filterTag" />
+
+            <attribute name="nohref">
+
+                <literal-list>
+                    <literal value="nohref" />
+                    <literal value="" />
+                </literal-list>
+            </attribute>
+
+            <attribute name="rel">
+
+                <literal-list>
+                    <literal value="nofollow" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+        <!-- List tags -->
+        <tag name="ul" action="validate" />
+        <tag name="ol" action="validate" />
+        <tag name="li" action="validate" />
+        <tag name="dl" action="validate" />
+        <tag name="dt" action="validate" />
+        <tag name="dd" action="validate" />
+    </tag-rules>
+
+    <css-rules>
+
+        <property name="text-decoration" default="none" description="">
+
+            <category-list>
+                <category value="visual" />
+            </category-list>
+
+            <literal-list>
+                <literal value="underline" />
+                <literal value="overline" />
+                <literal value="line-through" />
+            </literal-list>
+        </property>
+    </css-rules>
+
+    <allowed-empty-tags>
         <literal-list>
-            <literal value="br"/>
-            <literal value="hr"/>
-            <literal value="a"/>
-            <literal value="img"/>
-            <literal value="link"/>
-            <literal value="iframe"/>
-            <literal value="script"/>
-            <literal value="object"/>
-            <literal value="applet"/>
-            <literal value="frame"/>
-            <literal value="base"/>
-            <literal value="param"/>
-            <literal value="meta"/>
-            <literal value="input"/>
-            <literal value="textarea"/>
-            <literal value="embed"/>
-            <literal value="basefont"/>
-            <literal value="col"/>
-            <literal value="div"/>
+            <literal value="br" />
+            <literal value="hr" />
+            <literal value="a" />
+            <literal value="img" />
+            <literal value="link" />
+            <literal value="iframe" />
+            <literal value="script" />
+            <literal value="object" />
+            <literal value="applet" />
+            <literal value="frame" />
+            <literal value="base" />
+            <literal value="param" />
+            <literal value="meta" />
+            <literal value="input" />
+            <literal value="textarea" />
+            <literal value="embed" />
+            <literal value="basefont" />
+            <literal value="col" />
+            <literal value="div" />
         </literal-list>
     </allowed-empty-tags>
 </anti-samy-rules>
\ No newline at end of file
diff --git a/src/main/resources/antisamy.xml b/src/main/resources/antisamy.xml
index 80b5ef14..4284625b 100644
--- a/src/main/resources/antisamy.xml
+++ b/src/main/resources/antisamy.xml
@@ -1,2773 +1,2727 @@
 <?xml version="1.0" encoding="ISO-8859-1" ?>
 
+<!-- W3C rules retrieved from: http://www.w3.org/TR/html401/struct/global.html -->
 
-<!-- 
-W3C rules retrieved from:
-http://www.w3.org/TR/html401/struct/global.html
--->
+<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="antisamy.xsd">
 
+    <directives>
+        <directive name="omitXmlDeclaration" value="true" />
+        <directive name="omitDoctypeDeclaration" value="true" />
+        <directive name="maxInputSize" value="200000" />
+        <directive name="formatOutput" value="true" />
+        <directive name="nofollowAnchors" value="true" />
+        <directive name="validateParamAsEmbed" value="true" />
+        <directive name="noopenerAndNoreferrerAnchors" value="true" />
 
-<anti-samy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-		xsi:noNamespaceSchemaLocation="antisamy.xsd">
+        <!-- remember, this won't work for relative URIs - AntiSamy doesn't know anything about the URL or your web structure -->
+        <directive name="embedStyleSheets" value="false" />
+        <directive name="connectionTimeout" value="5000" />
+        <directive name="maxStyleSheetImports" value="3" />
 
-	<directives>
-		<directive name="omitXmlDeclaration" value="true"/>
-		<directive name="omitDoctypeDeclaration" value="true"/>
-		<directive name="maxInputSize" value="200000"/>
-		<directive name="formatOutput" value="true"/>
-		<directive name="nofollowAnchors" value="true" />
-		<directive name="validateParamAsEmbed" value="true" />
-		<directive name="noopenerAndNoreferrerAnchors" value="true" />
+        <!-- Allows the use of dynamic attributes (i.e. HTML5 "data-") -->
+        <directive name="allowDynamicAttributes" value="true" />
+    </directives>
 
-		<!--
-		remember, this won't work for relative URIs - AntiSamy doesn't
-		know anything about the URL or your web structure
-		-->
-		<directive name="embedStyleSheets" value="false"/> 
-		<directive name="connectionTimeout" value="5000"/>
-		<directive name="maxStyleSheetImports" value="3"/>
+    <common-regexps>
 
-		<!-- Allows the use of dynamic attributes (i.e. HTML5 "data-") -->
-		<directive name="allowDynamicAttributes" value="true" />
-	</directives>
+        <!-- From W3C: This attribute assigns a class name or set of class names to an element. Any number of elements may be assigned the same 
+            class name or names. Multiple class names must be separated by white space characters. -->
 
-	<common-regexps>
+        <!-- The 16 colors defined by the HTML Spec (also used by the CSS Spec) -->
+        <regexp name="colorName"
+            value="(aqua|black|blue|fuchsia|gray|grey|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow)" />
 
-		<!-- 
-		From W3C:
-		This attribute assigns a class name or set of class names to an
-		element. Any number of elements may be assigned the same class
-		name or names. Multiple class names must be separated by white 
-		space characters.
-		-->
+        <!-- HTML/CSS Spec allows 3 or 6 digit hex to specify color -->
+        <regexp name="colorCode" value="(#([0-9a-fA-F]{6}|[0-9a-fA-F]{3}))" />
 
-		<!-- The 16 colors defined by the HTML Spec (also used by the CSS Spec) -->
-		<regexp name="colorName" value="(aqua|black|blue|fuchsia|gray|grey|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow)"/>
+        <regexp name="anything" value=".*" />
+        <regexp name="numberOrPercent" value="(\d)+(%{0,1})" />
+        <regexp name="paragraph" value="([\p{L}\p{N},'\.\s\-_\(\)]|&amp;[0-9]{2};)*" />
+        <regexp name="htmlId" value="[a-zA-Z0-9\:\-_\.]+" />
+        <regexp name="htmlTitle" value="[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&amp;]*" /> <!-- force non-empty with a '+' at the end instead of '*' -->
+        <regexp name="htmlClass" value="[a-zA-Z0-9\s,\-_]+" />
 
-		<!-- HTML/CSS Spec allows 3 or 6 digit hex to specify color -->
-		<regexp name="colorCode" value="(#([0-9a-fA-F]{6}|[0-9a-fA-F]{3}))"/>
+        <regexp name="onsiteURL"
+            value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*" />
+        <regexp name="anchoredURL" value="#(\w)+" />
+        <regexp name="offsiteURL"
+            value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&amp;;:\-_~,\?=/!\(\)]*(\s)*" />
 
-		<regexp name="anything" value=".*"/>
-		<regexp name="numberOrPercent" value="(\d)+(%{0,1})"/>
-		<regexp name="paragraph" value="([\p{L}\p{N},'\.\s\-_\(\)]|&amp;[0-9]{2};)*"/>
-		<regexp name="htmlId" value="[a-zA-Z0-9\:\-_\.]+"/>
-		<regexp name="htmlTitle" value="[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&amp;]*"/> <!-- force non-empty with a '+' at the end instead of '*' -->
-		<regexp name="htmlClass" value="[a-zA-Z0-9\s,\-_]+"/>
-
-		<regexp name="onsiteURL" value="^(?!//)(?![\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*(&amp;colon))[\p{L}\p{N}\\\.\#@\$%\+&amp;;\-_~,\?=/!]*"/>
-		<regexp name="anchoredURL" value="#(\w)+"/>
-		<regexp name="offsiteURL" value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&amp;;:\-_~,\?=/!\(\)]*(\s)*"/>
-
-		<regexp name="boolean" value="(true|false)"/>
-		<regexp name="singlePrintable" value="[a-zA-Z0-9]{1}"/> <!-- \w allows the '_' character -->
-
-		<!-- This is for elements (ex: elemName { ... }) -->
-		<regexp name="cssElementSelector" value="[a-zA-Z0-9\-_]+|\*"/>
-
-		<!--  This is to list out any element names that are *not* valid -->
-		<regexp name="cssElementExclusion" value=""/>
-
-		<!--  This if for classes (ex: .className { ... }) -->
-		<regexp name="cssClassSelector" value="\.[a-zA-Z0-9\-_]+"/>
-
-		<!--  This is to list out any class names that are *not* valid -->
-		<regexp name="cssClassExclusion" value=""/>
-
-		<!--  This is for ID selectors (ex: #myId { ... } -->
-		<regexp name="cssIDSelector" value="#[a-zA-Z0-9\-_]+"/>
-
-		<!--  This is to list out any IDs that are *not* valid - FIXME: What should the default be to avoid div hijacking? *? -->
-		<regexp name="cssIDExclusion" value=""/>
-
-		<!--  This is for pseudo-element selector (ex. foo:pseudo-element { ... } -->
-		<regexp name="cssPseudoElementSelector" value=":[a-zA-Z0-9\-_]+"/>
-
-		<!--  This is to list out any psuedo-element names that are *not* valid -->
-		<regexp name="cssPsuedoElementExclusion" value=""/>
-
-		<!--  This is for attribute selectors (ex. foo[attr=value] { ... } -->
-		<regexp name="cssAttributeSelector" value="\[[a-zA-Z0-9\-_]+((=|~=|\|=){1}[a-zA-Z0-9\-_]+){1}\]"/>
-
-		<!--  This is to list out any attribute names that are *not* valid -->
-		<regexp name="cssAttributeExclusion" value=""/>
-
-		<!--  This is for resources referenced from CSS (such as background images and other imported stylesheets) -->
-		<regexp name="cssOnsiteUri" value="url\(([\p{L}\p{N}\\/\.\?=\#&amp;;\-_~]+|\#(\w)+)\)"/>
-		<regexp name="cssOffsiteUri" value="url\((\s)*((ht|f)tp(s?)://)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@#$%&amp;;:,\?=/\+!]*(\s)*\)"/>
-
-		<!--  This if for CSS Identifiers -->
-		<regexp name="cssIdentifier" value="[a-zA-Z0-9\-_]+"/>
-
-		<!--  This is for comments within CSS (ex. /* comment */) -->
-		<regexp name="cssCommentText" value="[\p{L}\p{N}\-_,\/\\\.\s\(\)!\?\=\$#%\^&amp;:&quot;']+"/>
-
-		<regexp name="integer" value="(-|\+)?[0-9]+"/>
-		<regexp name="positiveInteger" value="(\+)?[0-9]+"/>
-		<regexp name="number" value="(-|\+)?([0-9]+(\.[0-9]+)?)"/>
-		<regexp name="angle" value="(-|\+)?([0-9]+(\.[0-9]+)?)(deg|grad|rad)"/>
-		<regexp name="time" value="([0-9]+(\.[0-9]+)?)(ms|s)"/>
-		<regexp name="frequency" value="([0-9]+(\.[0-9]+)?)(hz|khz)"/>
-		<regexp name="length" value="((-|\+)?0|(-|\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))"/>
-		<regexp name="positiveLength" value="((\+)?0|(\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))"/>
-		<regexp name="percentage" value="(-|\+)?([0-9]+(\.[0-9]+)?)%"/>
-		<regexp name="positivePercentage" value="(\+)?([0-9]+(\.[0-9]+)?)%"/>
-
-		<regexp name="absolute-size" value="(xx-small|x-small|small|medium|large|x-large|xx-large)"/>
-		<regexp name="relative-size" value="(larger|smaller)"/>
-
-		<!-- Used for CSS Color specifications (complex regexp expresses integer values of 0-255) -->
-		<regexp name="rgbCode" value="rgb\(([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\)"/>
-
-		<!-- CSS2 Allowed System Color Values -->		
-		<regexp name="systemColor" value="(activeborder|activecaption|appworkspace|background|buttonface|buttonhighlight|buttonshadow|buttontext|captiontext|graytext|highlight|highlighttext|inactiveborder|inactivecaption|inactivecaptiontext|infobackground|infotext|menu|menutext|scrollbar|threeddarkshadow|threedface|threedhighlight|threedlightshadow|threedshadow|window|windowframe|windowtext)"/>
-
-		<!-- This is where we specify what Flash src to allow -->
-		<regexp name="flashSites" value="http://(download\.macromedia\.com/pub|www\.macromedia\.com/(go|shockwave)|c\.brightcove\.com/services|gamevideos\.1up\.com/swf|www\.youtube\.com/v|vimeo\.com|www\.gametrailers\.com|videomedia\.ign\.com/ev|image\.com\.com/gamespot|www\.hulu\.com/embed|embed\.break\.com|player\.ordienetworks\.com/flash|www\.adultswim\.com/video/vplayer|www\.dailymotion\.com/swf|www\.ustream\.tv/flash/video|cdn-i\.dmdentertainment\.com|media\.mtvnservices\.com|www\.justin\.tv/widgets|www\.viddler\.com/(player|simple_on_site)|static\.twitter\.com/flash|www\.gamepro\.com/bin|www\.divshare\.com/flash|www\.facebook\.com/v)/.*"/>
-	</common-regexps>
-
-	<!-- 
-
-	Tag.name = a, b, div, body, etc.
-	Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, remove: remove tag and contents
-	Attribute.name = id, class, href, align, width, etc.
-	Attribute.onInvalid = what to do when the attribute is invalid, e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag)
-	Attribute.description = What rules in English you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML
-
-	 -->
-
-	<!-- 
-	Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no
-	collisions between any of these attribute names with attribute names of other tags that are for different purposes.
-	-->
-
-	<common-attributes>		
-
-		<!-- Common to all HTML tags  -->
-
-		<attribute name="id" description="The 'id' of any HTML attribute should not contain anything besides letters and numbers">
-			<regexp-list>
-				<regexp name="htmlId"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="classid">
-			<regexp-list>
-				<regexp name="anything" />
-			</regexp-list>
-		</attribute>
-
-		<attribute name="codebase">
-			<regexp-list>
-				<regexp name="flashSites" />
-			</regexp-list>
-		</attribute>
-
-		<attribute name="class" description="The 'class' of any HTML attribute is usually a single word, but it can also be a list of class names separated by spaces">
-			<regexp-list>
-				<regexp name="htmlClass"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="lang" description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
-		 	<regexp-list>
-		 		<regexp value="[a-zA-Z0-9-]{2,20}"/>
-		 	</regexp-list>
-		 </attribute>
-		 <attribute name="title" description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
-		 	<regexp-list>
-		 		<regexp name="htmlTitle"/>
-		 	</regexp-list>
-		 </attribute>
-		 
-		 <attribute name="alt" description="The 'alt' attribute provides alternative text to users when its visual representation is not available">
-		 	<regexp-list>
-		 		<regexp name="paragraph"/>
-		 	</regexp-list>
-		 </attribute>
-
-		<attribute name="data-" description="Allows the HTML5 'data-' attribute to be added to elements">
-			<regexp-list>
-				<regexp name="anything"/>
-			</regexp-list>
-		</attribute>
-
- 		<!-- the "style" attribute will be validated by an inline stylesheet scanner, so no need to define anything here - i hate having to special case this but no other choice -->
-		 <attribute name="style" description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax"/>
-		 
-		 <attribute name="media">
-		 	<regexp-list>
-		 		<regexp value="[a-zA-Z0-9,\-\s]+"/>
-		 	</regexp-list>
-		 	
-		 	<literal-list>
-		 		<literal value="screen"/>
-		 		<literal value="tty"/>
-		 		<literal value="tv"/>
-		 		<literal value="projection"/>
-		 		<literal value="handheld"/>
-		 		<literal value="print"/>
-		 		<literal value="braille"/>
-		 		<literal value="aural"/>
-		 		<literal value="all"/>
-		 	</literal-list>
-		 	
-		 </attribute>
-		 
-		 
-		 <!-- Anchor related -->
-		 
-		 <!--  onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
-		<attribute name="href">
-			<regexp-list>
-				<regexp name="onsiteURL"/>
-				<regexp name="anchoredURL"/>
-				<regexp name="offsiteURL"/>
-			</regexp-list>
-		</attribute>
-		
-		<attribute name="name">
-		 	<regexp-list>
-		 		
-		 		<regexp value="[a-zA-Z0-9\-_\$]+"/>
-		 		
-		 		<!--
-		 		have to allow the $ for .NET controls - although,
-		 		will users be supplying input that has server-generated 
-		 		.NET control names? methinks not, but i want to pass my
-		 		test cases
-		 		-->
-		 		
-		 	</regexp-list>
-		 </attribute>
-		
-		
-		<attribute name="shape" description="The 'shape' attribute defines the shape of the selectable area">
-			<literal-list>
-				<literal value="default"/>
-				<literal value="rect"/>
-				<literal value="circle"/>
-				<literal value="poly"/>
-			</literal-list>
-		</attribute>
-		
-		
-		
-		<!--  Table attributes  -->
-		
-		<attribute name="border">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-		
-		<attribute name="cellpadding">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="cellspacing">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-		
-		<attribute name="colspan">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="rowspan">
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</attribute>
-		
-		<attribute name="background">
-			<regexp-list>
-				<regexp name="onsiteURL"/>
-			</regexp-list>
-		</attribute>
-
-		<attribute name="bgcolor">		
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-			</regexp-list>
-		</attribute>
-		 
-		 <attribute name="abbr">
-			<regexp-list>
-			 	<regexp name="paragraph"/>
-		 	</regexp-list>
-		 </attribute>
-		 
-		 <attribute name="headers" description="The 'headers' attribute is a space-separated list of cell IDs">
-		 	<regexp-list>
-			 	<regexp value="[a-zA-Z0-9\s*]*"/>
-		 	</regexp-list>
-		 </attribute>
-		 
-		 <attribute name="charoff">
-		 	<regexp-list>
-		 		<regexp value="numberOrPercent"/>
-		 	</regexp-list>
-		 </attribute>
-		 
-		 <attribute name="char">
-			<regexp-list>
-				<regexp value=".{0,1}"/>
-			</regexp-list>				
-		 </attribute>
-
-
-		<attribute name="axis" description="The 'headers' attribute is a comma-separated list of related header cells">
-		 	<regexp-list>
-			 	<regexp value="[a-zA-Z0-9\s*,]*"/>
-		 	</regexp-list>		
-		</attribute> 
-		
-		<attribute name="nowrap" description="The 'nowrap' attribute tells the browser not to wrap text that goes over one line">
-			<regexp-list>
-				<regexp name="anything"/>
-				<!-- <regexp value="(nowrap){0,1}"/>  -->
-			</regexp-list>
-		</attribute>
-		
-		
-		<!--  Common positioning attributes  -->
-
-		<attribute name="width">
-			<regexp-list>
-				<regexp name="numberOrPercent"/>
-			</regexp-list>
-		</attribute>
-		
-		<attribute name="height">
-			<regexp-list>
-				<regexp name="numberOrPercent"/>
-			</regexp-list>
-		</attribute>
-		
-		<attribute name="align" description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
-			<literal-list>
-				<literal value="center"/>
-				<literal value="middle"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="justify"/>
-				<literal value="char"/>
-			</literal-list>
-		</attribute>
-		
-		<attribute name="valign" description="The 'valign' attribute of an HTML attribute is a direction word, like 'baseline','bottom','middle' or 'top'">
-			<literal-list>
-				<literal value="baseline"/>
-				<literal value="bottom"/>
-				<literal value="middle"/>
-				<literal value="top"/>
-			</literal-list>
-		</attribute>
-		
-		
-		
-		<!-- Intrinsic JavaScript Events -->
-		
-		<attribute name="onFocus" description="The 'onFocus' event is executed when the control associated with the tag gains focus">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		</attribute>
-
-		<attribute name="onBlur" description="The 'onBlur' event is executed when the control associated with the tag loses focus">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>
-		</attribute>
-		 
-		 <attribute name="onClick" description="The 'onClick' event is executed when the control associated with the tag is clicked">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>		 
-		 </attribute>
-
-		 <attribute name="onDblClick" description="The 'onDblClick' event is executed when the control associated with the tag is clicked twice immediately">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>		 
-		 </attribute>
-		 
-		  <attribute name="onMouseDown" description="The 'onMouseDown' event is executed when the control associated with the tag is clicked but not yet released">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>		 
-		 </attribute>
-		 
-		 <attribute name="onMouseUp" description="The 'onMouseUp' event is executed when the control associated with the tag is clicked after the button is released">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>		 
-		 </attribute>
-		 
- 		 <attribute name="onMouseOver" description="The 'onMouseOver' event is executed when the user's mouse hovers over the control associated with the tag">
-			<literal-list>
-				<literal value="javascript:void(0)"/>
-				<literal value="javascript:history.go(-1)"/>
-			</literal-list>		 
-		 </attribute>
-		 
-		 <attribute name="scope" description="The 'scope' attribute defines what's covered by the header cells">
-		 	<literal-list>
-		 		<literal value="row"/>
-		 		<literal value="col"/>
-		 		<literal value="rowgroup"/>
-		 		<literal value="colgroup"/>
-		 	</literal-list>
-		 </attribute>
-		
-		
-		
-		 <!-- If you want users to be able to mess with tabindex, uncomment this -->
-		 <!--  
-		 <attribute name="tabindex" description="...">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-		  -->
-		 
-		 
-		 <!-- Input/form related common attributes -->
-		 
-		 <attribute name="disabled">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>
-		 </attribute>
-		 
-		 <attribute name="readonly">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>		 
-		 </attribute>
-		 
-		 <attribute name="accesskey">
-		 	<regexp-list>
-		 		<regexp name="anything"/>
-		 	</regexp-list>		 
-		 </attribute>
-		 
-		 <attribute name="size">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>
-		 </attribute>
-		 
-		 
-		<attribute name="autocomplete">
-			<literal-list>
-				<literal value="on"/>
-				<literal value="off"/>
-			</literal-list>
-		</attribute>
-			
-		 <attribute name="rows">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>		 
-		 </attribute>
-
-		 <attribute name="cols">
-		 	<regexp-list>
-		 		<regexp name="number"/>
-		 	</regexp-list>		 
-		 </attribute>
-		 
-	</common-attributes>
-
-
-	<!--
-	This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue
-	this is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after 
-	a while? Even wars of attrition, surely?
-	 -->
-	
-	<global-tag-attributes>
-		<!-- Not valid in base, head, html, meta, param, script, style, and title elements. -->
-		<attribute name="id"/>
-		<attribute name="style"/>
-		<attribute name="title"/>
-		<attribute name="class"/>
-		<!-- Not valid in base, br, frame, frameset, hr, iframe, param, and script elements.  -->
-		<attribute name="lang"/>
-	</global-tag-attributes>
-
-	<!-- Declare "dynamic" tag attributes here. The directive "allowDynamicAttributes" must be set to true -->
-	<dynamic-tag-attributes>
-		<attribute name="data-"/> <!-- HTML5 "data-" tag -->
-	</dynamic-tag-attributes>
-
-	<tags-to-encode>
-		<tag>g</tag>
-		<tag>grin</tag>
-	</tags-to-encode>
-	
-	<tag-rules>
-	
-		<!-- You can mess with this stuff if you know what you're doing -->
-		
-		<tag name="html" action="validate"/>
-		
-		<tag name="body" action="validate">
-			<attribute name="bgcolor"/>
-		</tag>
-		
-		<tag name="meta" action="filter"/>
-
-		<tag name="head" action="validate"/>
-
-		<!-- since we're validating the style sheets this is safe to have - switch to "truncate" if the user's html will appear in the html body -->
-		<tag name="title" action="truncate"/>
-
-
-		<!-- Tags related to JavaScript -->
-
-		<tag name="script" action="remove"/>
-		<tag name="noscript" action="validate"/> <!-- although no javascript can fire inside a noscript tag, css is still a viable attack vector -->
-		
-		
-		
-		<!-- Frame & related tags -->
-		
-		<tag name="iframe" action="remove"/>
-		<tag name="frameset" action="remove"/>
-		<tag name="frame" action="remove"/>
-		
-		
-		
-		<!-- Form related tags -->
-		
-		<tag name="label" action="validate">
-			<attribute name="for">
-				<regexp-list>
-					<regexp name="htmlId"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-		
-
-		<!--
-			If you wish to enable any of the form related tags, change the tag's action below from "filter" or "remove" to "validate". The attributes have been 
-			hardened so this is safe to do, if it's something you want to allow. Beware the <><ing possibilities!
-		 -->
-			
-		<tag name="form" action="validate">
-			
-			<attribute name="action">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="offsiteURL"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="name"/>
-			
-			<attribute name="autocomplete"/>
-			
-			<attribute name="method">
-				<literal-list>
-					<literal value="post"/>
-					<literal value="get"/>
-				</literal-list>
-			</attribute>
-			
-		</tag>
-		
-		<tag name="button" action="validate">
-			<attribute name="name"/>
-			<attribute name="value">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="disabled"/>
-			<attribute name="accesskey"/>
-			<attribute name="type">
-				<literal-list>
-					<literal value="submit"/>
-					<literal value="reset"/>
-					<literal value="button"/>
-				</literal-list>
-			</attribute>
-		</tag>
-		
-		<tag name="input" action="validate">
-			
-			<attribute name="name"/>
-			
-			<attribute name="size"/>
-			
-			<attribute name="maxlength">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="autocomplete"/>
-			
-			<attribute name="checked">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="alt"/>
-			
-			<attribute name="src">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="offsiteURL"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="usemap">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="anchoredURL"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="type">
-				<literal-list>
-					<literal value="hidden"/>
-					<literal value="text"/>
-					<literal value="password"/>
-					<literal value="radio"/>
-					<literal value="checkbox"/>
-					<literal value="submit"/>
-					<literal value="button"/>
-					<literal value="image"/>
-					<literal value="file"/>
-					<literal value="reset"/>
-				</literal-list>
-			</attribute>
-			
-			<attribute name="value">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="disabled"/>
-			<attribute name="readonly"/>
-			<attribute name="accesskey"/>
-			
-			<attribute name="border"/>
-			
-		</tag>
-		
-		<tag name="select" action="validate">
-
-			<attribute name="name"/>
-			<attribute name="disabled"/>
-			
-			<attribute name="multiple">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="size"/>
-			
-		</tag>
-		
-		<tag name="option" action="validate">
-		
-			<attribute name="disabled"/>
-			
-			<attribute name="value">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="label">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="selected">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-		
-		<tag name="textarea" action="validate">
-			<attribute name="rows"/>
-			<attribute name="cols"/>
-			<attribute name="name"/>
-			<attribute name="disabled"/>
-			<attribute name="readonly"/>
-			<attribute name="accesskey"/>
-		</tag>
-		
-		
-		
-		
-		<!-- All formatting tags -->
-		
-		<tag name="h1" action="validate"/>
-		<tag name="h2" action="validate"/>
-		<tag name="h3" action="validate"/>
-		<tag name="h4" action="validate"/>
-		<tag name="h5" action="validate"/>
-		<tag name="h6" action="validate"/>
-
-		<tag name="p" action="validate">
-			<attribute name="align"/>
-		</tag>
-		
-		<tag name="i" action="validate"/>
-		<tag name="b" action="validate"/>
-		<tag name="u" action="validate"/>
-		<tag name="strong" action="validate"/>
-		
-		<tag name="em" action="validate"/>
-		<tag name="small" action="validate"/>
-		<tag name="big" action="validate"/>
-		<tag name="pre" action="validate"/>
-		<tag name="code" action="validate"/>
-		<tag name="cite" action="validate"/>
-		<tag name="samp" action="validate"/>
-		<tag name="sub" action="validate"/>
-		<tag name="sup" action="validate"/>
-		<tag name="strike" action="validate"/>
-		<tag name="center" action="validate"/>
-		<tag name="blockquote" action="validate"/>
-		
-		<tag name="hr" action="validate"/>
-		<tag name="br" action="validate"/>
-		
-		<tag name="font" action="validate">
-			<attribute name="color">
-				<regexp-list>
-					<regexp name="colorName"/>
-					<regexp name="colorCode"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="face">
-				<regexp-list>
-					<regexp value="[\w;, \-]+"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="size">
-				<regexp-list>
-					<regexp value="(\+|-){0,1}(\d)+"/>
-				</regexp-list>
-			</attribute>
-		</tag>
-		
-
-		<!-- Anchor and anchor related tags -->
-		
-		<tag name="a" action="validate">
-
-			<!--  onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
-			<attribute name="href"/>
-			<attribute name="onFocus"/>
-			<attribute name="onBlur"/>
-			<attribute name="nohref">
-				<regexp-list>
-					<regexp name="anything"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="rel">
-				<regexp-list>
-					<regexp value="(\s*(nofollow|noopener|noreferrer)(\s(nofollow|noopener|noreferrer))*\s*)?"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="name"/>
-			
-		</tag>
-
-		<tag name="map" action="validate"/>
-
-		<!-- base tag removed per demo - this could be enabled with literal-list values you allow -->
-		<!-- 
-		<tag name="base" action="validate">
-			<attribute name="href"/>
-		</tag>
-		-->
-		
-		
-		
-		<!-- Stylesheet Tags -->
-		
-		<tag name="style" action="validate">
-			<attribute name="type">
-				<literal-list>
-					<literal value="text/css"/>
-				</literal-list>
-			</attribute>
-			<attribute name="media"/>
-		</tag>
-		
-		<tag name="span" action="validate"/>
-
-		<tag name="div" action="validate">
-			<attribute name="align"/>
-		</tag>
-
-	
-		<!-- Image & image related tags -->
-		
-		<tag name="img" action="validate">
-			<attribute name="src" onInvalid="removeTag">
-				<regexp-list>
-					<regexp name="onsiteURL"/>
-					<regexp name="offsiteURL"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="name"/>
-			<attribute name="alt"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="border"/>
-			<attribute name="align"/>
-			
-			<attribute name="hspace">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-			
-			<attribute name="vspace">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>			
-			</attribute>
-		</tag>
-
-		<!-- no way to do this safely without hooking up the same code to @import to embed the remote stylesheet (malicious user could change offsite resource to be malicious after validation -->
-		<!-- <attribute name="href" onInvalid="removeTag"/>  -->
-			
-		<tag name="link" action="validate">
-
-			<!-- <attribute name="href" onInvalid="removeTag"/>  -->
-			
-			<attribute name="media"/>
-			
-			<attribute name="type" onInvalid="removeTag">
-				<literal-list>
-					<literal value="text/css"/>
-					<literal value="application/rss+xml"/>
-					<literal value="image/x-icon"/>
-				</literal-list>
-			</attribute>
-			
-			<attribute name="rel">
-				<literal-list>
-					<literal value="stylesheet"/>
-					<literal value="shortcut icon"/>
-					<literal value="search"/>
-					<literal value="copyright"/>
-					<literal value="top"/>
-					<literal value="alternate"/>
-				</literal-list>
-			</attribute>
-		</tag>
-		
-		
-		
-				
-
-		<!-- List tags -->
-
-		<tag name="ul" action="validate"/>
-		<tag name="ol" action="validate"/>
-		<tag name="li" action="validate"/>
-		
-
-		
-		
-		<!-- Dictionary tags -->
-		
-		<tag name="dd" action="truncate"/>
-		<tag name="dl" action="truncate"/>
-		<tag name="dt" action="truncate"/>
-		
-
-
-		
-		<!-- Table tags (tbody, thead, tfoot)-->
-		
-		<tag name="thead" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-		
-		<tag name="tbody" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-		
-		<tag name="tfoot" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-		
-		<tag name="table" action="validate">
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="border"/>
-			<attribute name="bgcolor"/>
-			<attribute name="cellpadding"/>
-			<attribute name="cellspacing"/>
-			<attribute name="background"/>
-			<attribute name="align"/>
-			<attribute name="noresize">
-				<literal-list>
-					<literal value="noresize"/>
-					<literal value=""/>
-				</literal-list>
-			</attribute>
-		</tag>
-		
-		<tag name="td" action="validate">
-			<attribute name="background"/>
-			<attribute name="bgcolor"/>
-			<attribute name="abbr"/>
-			<attribute name="axis"/>
-			<attribute name="headers"/>
-			<attribute name="scope"/>
-			<attribute name="nowrap"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>			
-			<attribute name="valign"/>
-			<attribute name="colspan"/>
-			<attribute name="rowspan"/>
-		</tag>
-		
-		<tag name="th" action="validate">
-			<attribute name="abbr"/>
-			<attribute name="axis"/>
-			<attribute name="headers"/>
-			<attribute name="scope"/>
-			<attribute name="nowrap"/>
-			<attribute name="bgcolor"/>
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>			
-			<attribute name="valign"/>
-			<attribute name="colspan"/>
-			<attribute name="rowspan"/>
-		</tag>
-		
-		<tag name="tr" action="validate">
-			<attribute name="height"/>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="valign"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>	
-			<attribute name="background"/>
-		</tag>
-		
-		<tag name="colgroup" action="validate">
-
-			<attribute name="span">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="width"/>
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-		</tag>
-		
-		<tag name="col" action="validate">
-			<attribute name="align"/>
-			<attribute name="char"/>
-			<attribute name="charoff"/>
-			<attribute name="valign"/>
-			<attribute name="span">
-				<regexp-list>
-					<regexp name="number"/>
-				</regexp-list>
-			</attribute>
-			<attribute name="width"/>
-		</tag>
-				
-		<tag name="fieldset" action="validate"/>
-		<tag name="legend" action="validate"/>
-		
-
-		<!-- tags for popular Flash embeds -->
-
-		<tag name="object" action="validate">
-			<attribute name="id" />
-			<attribute name="classid" />
-			<attribute name="codebase" />
-			<attribute name="type" onInvalid="removeTag">
-				<literal-list>
-					<literal value="application/x-shockwave-flash" />
-				</literal-list>
-			</attribute>
-			<attribute name="data" onInvalid="removeTag">
-				<regexp-list>
-					<regexp name="flashSites" />
-				</regexp-list>
-			</attribute>
-			<attribute name="align" />
-			<attribute name="height" />
-			<attribute name="width" />
-			<attribute name="alt" />
-			<attribute name="bgcolor">
-				<regexp-list>
-					<regexp name="colorCode" />
-				</regexp-list>
-			</attribute>
-		</tag>
-
-		<!-- with validateParamAsEmbed=true, this tag rule also covers <param> name/value pairs -->
-		<tag name="embed" action="validate">
-			<attribute name="src" onInvalid="removeTag">
-				<regexp-list>
-					<regexp name="flashSites" />
-				</regexp-list>
-			</attribute>
-			<attribute name="movie" onInvalid="removeTag">
-				<regexp-list>
-					<regexp name="flashSites" />
-				</regexp-list>
-			</attribute>
-			<attribute name="pluginspage">
-				<regexp-list>
-					<regexp name="flashSites" />
-				</regexp-list>
-			</attribute>
-			<attribute name="bgcolor">
-				<regexp-list>
-					<regexp name="colorCode" />
-				</regexp-list>
-			</attribute>
-			<attribute name="base">
-				<literal-list>
-					<literal value="http://admin.brightcove.com" />
-				</literal-list>
-			</attribute>
-			<attribute name="type">
-				<literal-list>
-					<literal value="application/x-shockwave-flash" />
-				</literal-list>
-			</attribute>
-			<attribute name="name">
-				<regexp-list>
-					<regexp name="anything" />
-				</regexp-list>
-			</attribute>
-			<attribute name="flashvars">
-				<regexp-list>
-					<regexp name="anything" /><!-- we could put something complex in here, but this is prolly fine for now-->
-				</regexp-list>
-			</attribute>
-			<attribute name="align" />
-			<attribute name="height" />
-			<attribute name="width" />
-			<attribute name="allowfullscreen">
-				<regexp-list>
-					<regexp name="boolean" />
-				</regexp-list>
-			</attribute>
-			<attribute name="quality">
-				<literal-list>
-					<literal value="high" />
-				</literal-list>
-			</attribute>
-			<attribute name="allowscriptaccess">
-				<literal-list>
-					<literal value="always" />
-					<literal value="samedomain" />
-				</literal-list>
-			</attribute>
-			<attribute name="seamlesstabbing">
-				<regexp-list>
-					<regexp name="boolean" />
-				</regexp-list>
-			</attribute>
-			<attribute name="swliveconnect">
-				<regexp-list>
-					<regexp name="boolean" />
-				</regexp-list>
-			</attribute>
-			<attribute name="wmode">
-				<literal-list>
-					<literal value="transparent" />
-					<literal value="window" />
-				</literal-list>
-			</attribute>
-			<attribute name="allownetworking">
-				<literal-list>
-					<literal value="all" />
-				</literal-list>
-			</attribute>
-		</tag>
-		
-	</tag-rules>
-
-
-	<!--  CSS validation processing rules  -->
-
-	<css-rules>
-	
-		<property name="azimuth" description="This property is most likely to be implemented by mixing the same signal into different channels at differing volumes.">
-			<literal-list>
-				<literal value="left-side"/>
-				<literal value="far-left"/>
-				<literal value="left"/>
-				<literal value="center-left"/>
-				<literal value="center"/>
-				<literal value="center-right"/>
-				<literal value="right"/>
-				<literal value="far-right"/>
-				<literal value="right-side"/>
-				<literal value="behind"/>
-				<literal value="leftwards"/>
-				<literal value="rightwards"/>
-				<literal value="inherit"/>			
-			</literal-list>
-			<regexp-list>
-				<regexp name="angle"/>
-			</regexp-list>
-		</property>
-			
-		<property name="background" description="The 'background' property is a shorthand property for setting the individual background properties (i.e., 'background-color', 'background-image', 'background-repeat', 'background-attachment' and 'background-position') at the same place in the style sheet.">
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="background-color"/>
-				<shorthand name="background-image"/>
-				<shorthand name="background-repeat"/>
-				<shorthand name="background-attachment"/>
-				<shorthand name="background-position"/>												
-			</shorthand-list>
-		</property>
-
-		<property name="background-attachment" description="If a background image is specified, this property specifies whether it is fixed with regard to the viewport ('fixed') or scrolls along with the document ('scroll').">
-			<literal-list>
-				<literal value="scroll"/>
-				<literal value="fixed"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		
-		<property name="background-color" description="This property sets the background color of an element, either a &lt;color&gt; value or the keyword 'transparent', to make the underlying colors shine through.">
-			<literal-list>
-				<literal value="transparent"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		
-		<property name="background-image" description="This property sets the background image of an element.">
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		
-		<property name="background-position" description="If a background image has been specified, this property specifies its initial position.">
-			<literal-list>
-				<literal value="top"/>
-				<literal value="center"/>
-				<literal value="bottom"/>
-				<literal value="left"/>
-				<literal value="center"/>
-				<literal value="right"/>			
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="percentage"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>		
-
-		<property name="background-repeat" description="If a background image is specified, this property specifies whether the image is repeated (tiled), and how.">
-			<literal-list>
-				<literal value="repeat"/>
-				<literal value="repeat-x"/>
-				<literal value="repeat-y"/>
-				<literal value="no-repeat"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-
-		<!-- Begin simple properties -->
-		<property name="border-collapse" default="collapse" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="collapse"/>
-				<literal value="separate"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="border-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="transparent"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-top-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-right-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-bottom-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="border-left-color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="bottom" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="caption-side" default="top" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="top"/>
-				<literal value="bottom"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="clear" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="both"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="color" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="cue-after" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="cue-before" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="direction" default="ltr" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="ltr"/>
-				<literal value="rtl"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="display" default="inline" description="">
-			<category-list>
-				<category value="all"/>
-			</category-list>
-			<literal-list>
-				<literal value="inline"/>
-				<literal value="block"/>
-				<literal value="list-item"/>
-				<literal value="run-in"/>
-				<literal value="compact"/>
-				<literal value="marker"/>
-				<literal value="table"/>
-				<literal value="inline-table"/>
-				<literal value="table-row-group"/>
-				<literal value="table-header-group"/>
-				<literal value="table-footer-group"/>
-				<literal value="table-row"/>
-				<literal value="table-column-group"/>
-				<literal value="table-column"/>
-				<literal value="table-cell"/>
-				<literal value="table-caption"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="elevation" default="level" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="below"/>
-				<literal value="level"/>
-				<literal value="above"/>
-				<literal value="higher"/>
-				<literal value="lower"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="angle"/>
-			</regexp-list>
-		</property>
-		<property name="empty-cells" default="show" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="show"/>
-				<literal value="hide"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="float" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-size" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="absolute-size"/>
-				<regexp name="relative-size"/>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="font-size-adjust" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="font-stretch" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="wider"/>
-				<literal value="narrower"/>
-				<literal value="ultra-condensed"/>
-				<literal value="extra-condensed"/>
-				<literal value="condensed"/>
-				<literal value="semi-condensed"/>
-				<literal value="semi-expanded"/>
-				<literal value="expanded"/>
-				<literal value="extra-expanded"/>
-				<literal value="ultra-expanded"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-style" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="italic"/>
-				<literal value="oblique"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-variant" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="small-caps"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="font-weight" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="bold"/>
-				<literal value="bolder"/>
-				<literal value="lighter"/>
-				<literal value="100"/>
-				<literal value="200"/>
-				<literal value="300"/>
-				<literal value="400"/>
-				<literal value="500"/>
-				<literal value="600"/>
-				<literal value="700"/>
-				<literal value="800"/>
-				<literal value="900"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="height" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="left" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="letter-spacing" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="line-height" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="list-style-image" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="list-style-position" default="outside" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inside"/>
-				<literal value="outside"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="list-style-type" default="disc" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="disc"/>
-				<literal value="circle"/>
-				<literal value="square"/>
-				<literal value="decimal"/>
-				<literal value="decimal-leading-zero"/>
-				<literal value="lower-roman"/>
-				<literal value="upper-roman"/>
-				<literal value="lower-greek"/>
-				<literal value="lower-alpha"/>
-				<literal value="lower-latin"/>
-				<literal value="upper-alpha"/>
-				<literal value="upper-latin"/>
-				<literal value="hebrew"/>
-				<literal value="armenian"/>
-				<literal value="georgian"/>
-				<literal value="cjk-ideographic"/>
-				<literal value="hiragana"/>
-				<literal value="katakana"/>
-				<literal value="hiragana-iroha"/>
-				<literal value="katakana-iroha"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="marker-offset" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="max-height" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="max-width" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="min-height" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="min-width" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="orphans" default="2" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="outline-color" default="invert" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="invert"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-		</property>
-		<property name="overflow" default="visible" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="visible"/>
-				<literal value="hidden"/>
-				<literal value="scroll"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-after" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="always"/>
-				<literal value="avoid"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-before" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="always"/>
-				<literal value="avoid"/>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="page-break-inside" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="avoid"/>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="pause-after" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="pause-before" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="pitch" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="x-low"/>
-				<literal value="low"/>
-				<literal value="medium"/>
-				<literal value="high"/>
-				<literal value="x-high"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="frequency"/>
-			</regexp-list>
-		</property>
-		<property name="pitch-range" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="position" default="static" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="static"/>
-				<!-- possible to perform phishing attacks with the following -->
-				<!--
-				<literal value="relative"/>
-				<literal value="absolute"/>
-				<literal value="fixed"/>
-				 -->
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="richness" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="right" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="size" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="portrait"/>
-				<literal value="landscape"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="speak" default="normal" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="none"/>
-				<literal value="spell-out"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-header" default="once" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="once"/>
-				<literal value="always"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-numeral" default="continuous" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="digits"/>
-				<literal value="continuous"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speak-punctuation" default="none" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="code"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="speech-rate" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="x-slow"/>
-				<literal value="slow"/>
-				<literal value="medium"/>
-				<literal value="fast"/>
-				<literal value="x-fast"/>
-				<literal value="faster"/>
-				<literal value="slower"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="stress" default="50" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-			</regexp-list>
-		</property>
-		<property name="table-layout" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="fixed"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="text-indent" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="text-transform" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="capitalize"/>
-				<literal value="uppercase"/>
-				<literal value="lowercase"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="top" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="unicode-bidi" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="embed"/>
-				<literal value="bidi-override"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="vertical-align" default="baseline" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="baseline"/>
-				<literal value="sub"/>
-				<literal value="super"/>
-				<literal value="top"/>
-				<literal value="text-top"/>
-				<literal value="middle"/>
-				<literal value="bottom"/>
-				<literal value="text-bottom"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="percentage"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="visibility" default="inherit" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="visible"/>
-				<literal value="hidden"/>
-				<literal value="collapse"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="volume" default="medium" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="silent"/>
-				<literal value="x-soft"/>
-				<literal value="soft"/>
-				<literal value="medium"/>
-				<literal value="loud"/>
-				<literal value="x-loud"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="number"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="white-space" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="pre"/>
-				<literal value="nowrap"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="widows" default="2" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="width" default="auto" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="word-spacing" default="normal" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="normal"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		
-		<!-- end simple properties -->
-		
-		<!-- begin medium properties -->
-		<property name="border-style" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="none"/>				
-				<literal value="hidden"/>
-				<literal value="dotted"/>
-				<literal value="dashed"/>
-				<literal value="solid"/>
-				<literal value="double"/>
-				<literal value="groove"/>
-				<literal value="ridge"/>
-				<literal value="inset"/>
-				<literal value="outset"/>
-			</literal-list>
-		</property>
-		<property name="border-top-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="border-right-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-top-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-right-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="border-width" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="thin"/>
-				<literal value="medium"/>
-				<literal value="thick"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="margin" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-				<literal value="auto"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="positiveLength"/>
-				<regexp name="positivePercentage"/>				
-			</regexp-list>
-		</property>
-		<property name="margin-top" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-right" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-bottom" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="margin-left" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="margin"/>
-			</shorthand-list>
-		</property>
-		<property name="outline-style" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="outline-width" default="medium" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-			</shorthand-list>
-		</property>
-		<property name="padding" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-				<regexp name="percentage"/>
-			</regexp-list>			
-		</property>
-		<property name="padding-top" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>				
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-right" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-bottom" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>
-		<property name="padding-left" default="0" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="padding"/>
-			</shorthand-list>
-		</property>		
-		<!-- end medium properties -->
-		
-		<!-- begin hard properties -->
-		<property name="border" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-top" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-right" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-bottom" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="border-left" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-			</regexp-list>
-			<shorthand-list>
-				<shorthand name="border-top-width"/>
-				<shorthand name="border-style"/>
-			</shorthand-list>
-		</property>
-		<property name="cue" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="cue-before"/>
-				<shorthand name="cue-after"/>
-			</shorthand-list>
-		</property>
-		<property name="list-style" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="list-style-type"/>
-				<shorthand name="list-style-position"/>
-				<shorthand name="list-style-image"/>
-			</shorthand-list>
-		</property>
-		<property name="marks" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="crop"/>
-				<literal value="cross"/>
-				<literal value="none"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>
-		<property name="outline" description="">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="outline-color"/>
-				<shorthand name="outline-style"/>
-				<shorthand name="outline-width"/>
-			</shorthand-list>
-		</property>
-		<property name="pause" description="">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="time"/>
-				<regexp name="percentage"/>
-			</regexp-list>
-		</property>
-		<property name="text-decoration" default="none" description="">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>
-				<literal value="underline"/>
-				<literal value="overline"/>
-				<literal value="line-through"/>
-				<literal value="blink"/>
-				<literal value="inherit"/>
-			</literal-list>
-		</property>		
-		<!-- end hard properties -->
-		<!--  begin manual properties -->
-		<property name="border-spacing" default="0" description="The lengths specify the distance that separates adjacent cell borders. If one length is specified, it gives both the horizontal and vertical spacing. If two are specified, the first gives the horizontal spacing and the second the vertical spacing. Lengths may not be negative.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="clip" default="auto" description="The 'clip' property applies to elements that have a 'overflow' property with a value other than 'visible'.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>			
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		<property name="counter-increment" default="none" description="The 'counter-increment' property accepts one or more names of counters (identifiers), each one optionally followed by an integer.">
-			<category-list>
-				<category value="all"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>			
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssIdentifier"/>
-				<regexp name="integer"/>
-			</regexp-list>
-		</property>
-		<property name="cursor" default="auto" description="This property specifies the type of cursor to be displayed for the pointing device.">
-			<category-list>
-				<category value="visual"/>
-				<category value="interactive"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>			
-				<literal value="inherit"/>
-				<literal value="crosshair"/>
-				<literal value="default"/>
-				<literal value="pointer"/>
-				<literal value="move"/>
-				<literal value="e-resize"/>
-				<literal value="ne-resize"/>
-				<literal value="nw-resize"/>
-				<literal value="n-resize"/>
-				<literal value="se-resize"/>
-				<literal value="sw-resize"/>
-				<literal value="s-resize"/>
-				<literal value="w-resize| text"/>
-				<literal value="wait"/>
-				<literal value="help"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>			
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		
-		<property name="text-shadow" default="none" description="This property accepts a comma-separated list of shadow effects to be applied to the text of the element.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="none"/>			
-				<literal value="inherit"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="colorName"/>
-				<regexp name="colorCode"/>
-				<regexp name="rgbCode"/>
-				<regexp name="systemColor"/>
-				<regexp name="length"/>
-			</regexp-list>
-		</property>
-		
-		<property name="font" description="The 'font' property is, except as described below, a shorthand property for setting 'font-style', 'font-variant', 'font-weight', 'font-size', 'line-height', and 'font-family', at the same place in the style sheet.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<literal-list>
-				<literal value="/"/>
-				<literal value="caption"/>
-				<literal value="icon"/>
-				<literal value="menu"/>
-				<literal value="message-box"/>
-				<literal value="small-caption"/>
-				<literal value="status-bar"/>
-				<literal value="inherit"/>
-			</literal-list>
-			<shorthand-list>
-				<shorthand name="font-style"/>
-				<shorthand name="font-variant"/>
-				<shorthand name="font-weight"/>
-				<shorthand name="font-size"/>
-				<shorthand name="line-height"/>	
-				<shorthand name="font-family"/>
-			</shorthand-list>
-		</property>
-		
-		<property name="font-family" description="This property specifies a prioritized list of font family names and/or generic family names.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<!-- allowing only generic font families -->
-			<literal-list>
-				<literal value="serif"/>
-				<literal value="arial"/>
-				<literal value="lucida console"/>
-				<literal value="sans-serif"/>
-				<literal value="cursive"/>
-				<literal value="verdana"/>
-				<literal value="fantasy"/>
-				<literal value="monospace"/>											
-			</literal-list>
-			
-						
-			<regexp-list>
-				<regexp value="[\w,\-&apos;&quot; ]+"/>
-			</regexp-list>
-			
-		</property>
-		<property name="page" description="The 'page' property can be used to specify a particular type of page where an element should be displayed.">
-			<category-list>
-				<category value="visual"/>
-				<category value="paged"/>
-			</category-list>
-			<literal-list>
-				<literal value="auto"/>
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssIdentifier"/>
-			</regexp-list>
-		</property>
-		<property name="play-during" default="auto" description="Similar to the 'cue-before' and 'cue-after' properties, this property specifies a sound to be played as a background while an element's content is spoken.">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<literal-list>
-				<literal value="mix"/>
-				<literal value="repeat"/>
-				<literal value="none"/>		
-				<literal value="auto"/>
-				<literal value="inherit"/>				
-			</literal-list>
-			<regexp-list>
-				<regexp name="cssOffsiteUri"/>
-				<regexp name="cssOnsiteUri"/>
-			</regexp-list>
-		</property>
-		<property name="text-align" description="This property describes how inline content of a block is aligned.">
-			<category-list>
-				<category value="visual"/>
-			</category-list>
-			<!--  For safety, ignoring string alignment which can be used to line table cells on characters -->
-			<literal-list>
-				<literal value="left"/>
-				<literal value="right"/>
-				<literal value="center"/>		
-				<literal value="justify"/>
-				<literal value="inherit"/>				
-			</literal-list>
-		</property>
-		<property name="voice-family" description="The value is a comma-separated, prioritized list of voice family names (compare with 'font-family').">
-			<category-list>
-				<category value="aural"/>
-			</category-list>
-			<!--  Allowing only generic voice family -->
-			<literal-list>
-				<literal value="male"/>
-				<literal value="female"/>
-				<literal value="child"/>		
-				<literal value="inherit"/>				
-			</literal-list>
-		</property>		
-		<!--  end manual properties -->
-	</css-rules>
+        <regexp name="boolean" value="(true|false)" />
+        <regexp name="singlePrintable" value="[a-zA-Z0-9]{1}" /> <!-- \w allows the '_' character -->
 
+        <!-- This is for elements (ex: elemName { ... }) -->
+        <regexp name="cssElementSelector" value="[a-zA-Z0-9\-_]+|\*" />
+
+        <!-- This is to list out any element names that are *not* valid -->
+        <regexp name="cssElementExclusion" value="" />
+
+        <!-- This if for classes (ex: .className { ... }) -->
+        <regexp name="cssClassSelector" value="\.[a-zA-Z0-9\-_]+" />
+
+        <!-- This is to list out any class names that are *not* valid -->
+        <regexp name="cssClassExclusion" value="" />
+
+        <!-- This is for ID selectors (ex: #myId { ... } -->
+        <regexp name="cssIDSelector" value="#[a-zA-Z0-9\-_]+" />
+
+        <!-- This is to list out any IDs that are *not* valid - FIXME: What should the default be to avoid div hijacking? *? -->
+        <regexp name="cssIDExclusion" value="" />
+
+        <!-- This is for pseudo-element selector (ex. foo:pseudo-element { ... } -->
+        <regexp name="cssPseudoElementSelector" value=":[a-zA-Z0-9\-_]+" />
+
+        <!-- This is to list out any psuedo-element names that are *not* valid -->
+        <regexp name="cssPsuedoElementExclusion" value="" />
+
+        <!-- This is for attribute selectors (ex. foo[attr=value] { ... } -->
+        <regexp name="cssAttributeSelector" value="\[[a-zA-Z0-9\-_]+((=|~=|\|=){1}[a-zA-Z0-9\-_]+){1}\]" />
+
+        <!-- This is to list out any attribute names that are *not* valid -->
+        <regexp name="cssAttributeExclusion" value="" />
+
+        <!-- This is for resources referenced from CSS (such as background images and other imported stylesheets) -->
+        <regexp name="cssOnsiteUri" value="url\(([\p{L}\p{N}\\/\.\?=\#&amp;;\-_~]+|\#(\w)+)\)" />
+        <regexp name="cssOffsiteUri"
+            value="url\((\s)*((ht|f)tp(s?)://)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@#$%&amp;;:,\?=/\+!]*(\s)*\)" />
+
+        <!-- This if for CSS Identifiers -->
+        <regexp name="cssIdentifier" value="[a-zA-Z0-9\-_]+" />
+
+        <!-- This is for comments within CSS (ex. /* comment */) -->
+        <regexp name="cssCommentText" value="[\p{L}\p{N}\-_,\/\\\.\s\(\)!\?\=\$#%\^&amp;:&quot;']+" />
+
+        <regexp name="integer" value="(-|\+)?[0-9]+" />
+        <regexp name="positiveInteger" value="(\+)?[0-9]+" />
+        <regexp name="number" value="(-|\+)?([0-9]+(\.[0-9]+)?)" />
+        <regexp name="angle" value="(-|\+)?([0-9]+(\.[0-9]+)?)(deg|grad|rad)" />
+        <regexp name="time" value="([0-9]+(\.[0-9]+)?)(ms|s)" />
+        <regexp name="frequency" value="([0-9]+(\.[0-9]+)?)(hz|khz)" />
+        <regexp name="length" value="((-|\+)?0|(-|\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))" />
+        <regexp name="positiveLength" value="((\+)?0|(\+)?([0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?)(rem|vw|vh|em|ex|px|in|cm|mm|pt|pc))" />
+        <regexp name="percentage" value="(-|\+)?([0-9]+(\.[0-9]+)?)%" />
+        <regexp name="positivePercentage" value="(\+)?([0-9]+(\.[0-9]+)?)%" />
+
+        <regexp name="absolute-size" value="(xx-small|x-small|small|medium|large|x-large|xx-large)" />
+        <regexp name="relative-size" value="(larger|smaller)" />
+
+        <!-- Used for CSS Color specifications (complex regexp expresses integer values of 0-255) -->
+        <regexp name="rgbCode"
+            value="rgb\(([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\)" />
+
+        <!-- CSS2 Allowed System Color Values -->
+        <regexp name="systemColor"
+            value="(activeborder|activecaption|appworkspace|background|buttonface|buttonhighlight|buttonshadow|buttontext|captiontext|graytext|highlight|highlighttext|inactiveborder|inactivecaption|inactivecaptiontext|infobackground|infotext|menu|menutext|scrollbar|threeddarkshadow|threedface|threedhighlight|threedlightshadow|threedshadow|window|windowframe|windowtext)" />
+
+        <!-- This is where we specify what Flash src to allow -->
+        <regexp name="flashSites"
+            value="http://(download\.macromedia\.com/pub|www\.macromedia\.com/(go|shockwave)|c\.brightcove\.com/services|gamevideos\.1up\.com/swf|www\.youtube\.com/v|vimeo\.com|www\.gametrailers\.com|videomedia\.ign\.com/ev|image\.com\.com/gamespot|www\.hulu\.com/embed|embed\.break\.com|player\.ordienetworks\.com/flash|www\.adultswim\.com/video/vplayer|www\.dailymotion\.com/swf|www\.ustream\.tv/flash/video|cdn-i\.dmdentertainment\.com|media\.mtvnservices\.com|www\.justin\.tv/widgets|www\.viddler\.com/(player|simple_on_site)|static\.twitter\.com/flash|www\.gamepro\.com/bin|www\.divshare\.com/flash|www\.facebook\.com/v)/.*" />
+    </common-regexps>
+
+    <!-- Tag.name = a, b, div, body, etc. Tag.action = filter: remove tags, but keep content, validate: keep content as long as it passes rules, 
+        remove: remove tag and contents Attribute.name = id, class, href, align, width, etc. Attribute.onInvalid = what to do when the attribute is invalid, 
+        e.g., remove the tag (removeTag), remove the attribute (removeAttribute), filter the tag (filterTag) Attribute.description = What rules in English 
+        you want to tell the users they can have for this attribute. Include helpful things so they'll be able to tune their HTML -->
+
+    <!-- Some attributes are common to all (or most) HTML tags. There aren't many that qualify for this. You have to make sure there's no collisions 
+        between any of these attribute names with attribute names of other tags that are for different purposes. -->
+
+    <common-attributes>
+
+        <!-- Common to all HTML tags -->
+
+        <attribute name="id" description="The 'id' of any HTML attribute should not contain anything besides letters and numbers">
+            <regexp-list>
+                <regexp name="htmlId" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="classid">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="codebase">
+            <regexp-list>
+                <regexp name="flashSites" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="class"
+            description="The 'class' of any HTML attribute is usually a single word, but it can also be a list of class names separated by spaces">
+            <regexp-list>
+                <regexp name="htmlClass" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="lang"
+            description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9-]{2,20}" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="title"
+            description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element">
+            <regexp-list>
+                <regexp name="htmlTitle" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="alt"
+            description="The 'alt' attribute provides alternative text to users when its visual representation is not available">
+            <regexp-list>
+                <regexp name="paragraph" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="data-" description="Allows the HTML5 'data-' attribute to be added to elements">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <!-- the "style" attribute will be validated by an inline stylesheet scanner, so no need to define anything here - i hate having to special 
+            case this but no other choice -->
+        <attribute name="style"
+            description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax" />
+
+        <attribute name="media">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9,\-\s]+" />
+            </regexp-list>
+
+            <literal-list>
+                <literal value="screen" />
+                <literal value="tty" />
+                <literal value="tv" />
+                <literal value="projection" />
+                <literal value="handheld" />
+                <literal value="print" />
+                <literal value="braille" />
+                <literal value="aural" />
+                <literal value="all" />
+            </literal-list>
+
+        </attribute>
+
+        <!-- Anchor related -->
+
+        <!-- onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
+        <attribute name="href">
+            <regexp-list>
+                <regexp name="onsiteURL" />
+                <regexp name="anchoredURL" />
+                <regexp name="offsiteURL" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="name">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9\-_\$]+" />
+                <!-- have to allow the $ for .NET controls - although, will users be supplying input that has server-generated .NET control names? 
+                    methinks not, but i want to pass my test cases -->
+            </regexp-list>
+        </attribute>
+
+        <attribute name="shape" description="The 'shape' attribute defines the shape of the selectable area">
+            <literal-list>
+                <literal value="default" />
+                <literal value="rect" />
+                <literal value="circle" />
+                <literal value="poly" />
+            </literal-list>
+        </attribute>
+
+        <!-- Table attributes -->
+
+        <attribute name="border">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cellpadding">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cellspacing">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="colspan">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="rowspan">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="background">
+            <regexp-list>
+                <regexp name="onsiteURL" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="bgcolor">
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="abbr">
+            <regexp-list>
+                <regexp name="paragraph" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="headers" description="The 'headers' attribute is a space-separated list of cell IDs">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9\s*]*" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="charoff">
+            <regexp-list>
+                <regexp value="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="char">
+            <regexp-list>
+                <regexp value=".{0,1}" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="axis" description="The 'headers' attribute is a comma-separated list of related header cells">
+            <regexp-list>
+                <regexp value="[a-zA-Z0-9\s*,]*" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="nowrap" description="The 'nowrap' attribute tells the browser not to wrap text that goes over one line">
+            <regexp-list>
+                <regexp name="anything" />
+                <!-- <regexp value="(nowrap){0,1}"/> -->
+            </regexp-list>
+        </attribute>
+
+        <!-- Common positioning attributes -->
+
+        <attribute name="width">
+            <regexp-list>
+                <regexp name="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="height">
+            <regexp-list>
+                <regexp name="numberOrPercent" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="align"
+            description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'">
+            <literal-list>
+                <literal value="center" />
+                <literal value="middle" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="justify" />
+                <literal value="char" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="valign"
+            description="The 'valign' attribute of an HTML attribute is a direction word, like 'baseline','bottom','middle' or 'top'">
+            <literal-list>
+                <literal value="baseline" />
+                <literal value="bottom" />
+                <literal value="middle" />
+                <literal value="top" />
+            </literal-list>
+        </attribute>
+
+        <!-- Intrinsic JavaScript Events -->
+
+        <attribute name="onFocus"
+            description="The 'onFocus' event is executed when the control associated with the tag gains focus">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onBlur" description="The 'onBlur' event is executed when the control associated with the tag loses focus">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onClick"
+            description="The 'onClick' event is executed when the control associated with the tag is clicked">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onDblClick"
+            description="The 'onDblClick' event is executed when the control associated with the tag is clicked twice immediately">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseDown"
+            description="The 'onMouseDown' event is executed when the control associated with the tag is clicked but not yet released">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseUp"
+            description="The 'onMouseUp' event is executed when the control associated with the tag is clicked after the button is released">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="onMouseOver"
+            description="The 'onMouseOver' event is executed when the user's mouse hovers over the control associated with the tag">
+            <literal-list>
+                <literal value="javascript:void(0)" />
+                <literal value="javascript:history.go(-1)" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="scope" description="The 'scope' attribute defines what's covered by the header cells">
+            <literal-list>
+                <literal value="row" />
+                <literal value="col" />
+                <literal value="rowgroup" />
+                <literal value="colgroup" />
+            </literal-list>
+        </attribute>
+
+        <!-- If you want users to be able to mess with tabindex, uncomment this -->
+        <!-- <attribute name="tabindex" description="..."> <regexp-list> <regexp name="number"/> </regexp-list> </attribute> -->
+
+        <!-- Input/form related common attributes -->
+
+        <attribute name="disabled">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="readonly">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="accesskey">
+            <regexp-list>
+                <regexp name="anything" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="size">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="autocomplete">
+            <literal-list>
+                <literal value="on" />
+                <literal value="off" />
+            </literal-list>
+        </attribute>
+
+        <attribute name="rows">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+        <attribute name="cols">
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </attribute>
+
+    </common-attributes>
+
+    <!-- This requires normal updates as browsers continue to diverge from the W3C and each other. As long as the browser wars continue this 
+        is going to continue. I'm not sure war is the right word for what's going on. Doesn't somebody have to win a war after a while? Even wars of 
+        attrition, surely? -->
+
+    <global-tag-attributes>
+        <!-- Not valid in base, head, html, meta, param, script, style, and title elements. -->
+        <attribute name="id" />
+        <attribute name="style" />
+        <attribute name="title" />
+        <attribute name="class" />
+        <!-- Not valid in base, br, frame, frameset, hr, iframe, param, and script elements. -->
+        <attribute name="lang" />
+    </global-tag-attributes>
+
+    <!-- Declare "dynamic" tag attributes here. The directive "allowDynamicAttributes" must be set to true -->
+    <dynamic-tag-attributes>
+        <attribute name="data-" /> <!-- HTML5 "data-" tag -->
+    </dynamic-tag-attributes>
+
+    <tags-to-encode>
+        <tag>g</tag>
+        <tag>grin</tag>
+    </tags-to-encode>
+
+    <tag-rules>
+
+        <!-- You can mess with this stuff if you know what you're doing -->
+
+        <tag name="html" action="validate" />
+
+        <tag name="body" action="validate">
+            <attribute name="bgcolor" />
+        </tag>
+
+        <tag name="meta" action="filter" />
+
+        <tag name="head" action="validate" />
+
+        <!-- since we're validating the style sheets this is safe to have - switch to "truncate" if the user's html will appear in the html body -->
+        <tag name="title" action="truncate" />
+
+        <!-- Tags related to JavaScript -->
+
+        <tag name="script" action="remove" />
+        <tag name="noscript" action="validate" /> <!-- although no javascript can fire inside a noscript tag, css is still a viable attack vector -->
+
+        <!-- Frame & related tags -->
+
+        <tag name="iframe" action="remove" />
+        <tag name="frameset" action="remove" />
+        <tag name="frame" action="remove" />
+
+        <!-- Form related tags -->
+
+        <tag name="label" action="validate">
+            <attribute name="for">
+                <regexp-list>
+                    <regexp name="htmlId" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+        <!-- If you wish to enable any of the form related tags, change the tag's action below from "filter" or "remove" to "validate". The attributes 
+            have been hardened so this is safe to do, if it's something you want to allow. Beware the <><ing possibilities! -->
+
+        <tag name="form" action="validate">
+            <attribute name="action">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="offsiteURL" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="name" />
+
+            <attribute name="autocomplete" />
+
+            <attribute name="method">
+                <literal-list>
+                    <literal value="post" />
+                    <literal value="get" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+        <tag name="button" action="validate">
+            <attribute name="name" />
+            <attribute name="value">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="disabled" />
+            <attribute name="accesskey" />
+            <attribute name="type">
+                <literal-list>
+                    <literal value="submit" />
+                    <literal value="reset" />
+                    <literal value="button" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+        <tag name="input" action="validate">
+
+            <attribute name="name" />
+
+            <attribute name="size" />
+
+            <attribute name="maxlength">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="autocomplete" />
+
+            <attribute name="checked">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="alt" />
+
+            <attribute name="src">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="offsiteURL" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="usemap">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="anchoredURL" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="type">
+                <literal-list>
+                    <literal value="hidden" />
+                    <literal value="text" />
+                    <literal value="password" />
+                    <literal value="radio" />
+                    <literal value="checkbox" />
+                    <literal value="submit" />
+                    <literal value="button" />
+                    <literal value="image" />
+                    <literal value="file" />
+                    <literal value="reset" />
+                </literal-list>
+            </attribute>
+
+            <attribute name="value">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="disabled" />
+            <attribute name="readonly" />
+            <attribute name="accesskey" />
+            <attribute name="border" />
+
+        </tag>
+
+        <tag name="select" action="validate">
+
+            <attribute name="name" />
+            <attribute name="disabled" />
+
+            <attribute name="multiple">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="size" />
+
+        </tag>
+
+        <tag name="option" action="validate">
+
+            <attribute name="disabled" />
+
+            <attribute name="value">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="label">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="selected">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+        <tag name="textarea" action="validate">
+            <attribute name="rows" />
+            <attribute name="cols" />
+            <attribute name="name" />
+            <attribute name="disabled" />
+            <attribute name="readonly" />
+            <attribute name="accesskey" />
+        </tag>
+
+        <!-- All formatting tags -->
+
+        <tag name="h1" action="validate" />
+        <tag name="h2" action="validate" />
+        <tag name="h3" action="validate" />
+        <tag name="h4" action="validate" />
+        <tag name="h5" action="validate" />
+        <tag name="h6" action="validate" />
+
+        <tag name="p" action="validate">
+            <attribute name="align" />
+        </tag>
+
+        <tag name="i" action="validate" />
+        <tag name="b" action="validate" />
+        <tag name="u" action="validate" />
+        <tag name="strong" action="validate" />
+
+        <tag name="em" action="validate" />
+        <tag name="small" action="validate" />
+        <tag name="big" action="validate" />
+        <tag name="pre" action="validate" />
+        <tag name="code" action="validate" />
+        <tag name="cite" action="validate" />
+        <tag name="samp" action="validate" />
+        <tag name="sub" action="validate" />
+        <tag name="sup" action="validate" />
+        <tag name="strike" action="validate" />
+        <tag name="center" action="validate" />
+        <tag name="blockquote" action="validate" />
+
+        <tag name="hr" action="validate" />
+        <tag name="br" action="validate" />
+
+        <tag name="font" action="validate">
+            <attribute name="color">
+                <regexp-list>
+                    <regexp name="colorName" />
+                    <regexp name="colorCode" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="face">
+                <regexp-list>
+                    <regexp value="[\w;, \-]+" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="size">
+                <regexp-list>
+                    <regexp value="(\+|-){0,1}(\d)+" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+        <!-- Anchor and anchor related tags -->
+
+        <tag name="a" action="validate">
+
+            <!-- onInvalid="filterTag" has been removed as per suggestion at OWASP SJ 2007 - just "name" is valid -->
+            <attribute name="href" />
+            <attribute name="onFocus" />
+            <attribute name="onBlur" />
+            <attribute name="nohref">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+            <attribute name="rel">
+                <regexp-list>
+                    <regexp value="(\s*(nofollow|noopener|noreferrer)(\s(nofollow|noopener|noreferrer))*\s*)?" />
+                </regexp-list>
+            </attribute>
+            <attribute name="name" />
+
+        </tag>
+
+        <tag name="map" action="validate" />
+
+        <!-- base tag removed per demo - this could be enabled with literal-list values you allow -->
+        <!-- <tag name="base" action="validate"> <attribute name="href"/> </tag> -->
+
+        <!-- Stylesheet Tags -->
+
+        <tag name="style" action="validate">
+            <attribute name="type">
+                <literal-list>
+                    <literal value="text/css" />
+                </literal-list>
+            </attribute>
+            <attribute name="media" />
+        </tag>
+
+        <tag name="span" action="validate" />
+
+        <tag name="div" action="validate">
+            <attribute name="align" />
+        </tag>
+
+        <!-- Image & image related tags -->
+
+        <tag name="img" action="validate">
+            <attribute name="src" onInvalid="removeTag">
+                <regexp-list>
+                    <regexp name="onsiteURL" />
+                    <regexp name="offsiteURL" />
+                </regexp-list>
+            </attribute>
+            <attribute name="name" />
+            <attribute name="alt" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="border" />
+            <attribute name="align" />
+
+            <attribute name="hspace">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+
+            <attribute name="vspace">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+        <!-- no way to do this safely without hooking up the same code to @import to embed the remote stylesheet (malicious user could change 
+            offsite resource to be malicious after validation -->
+        <!-- <attribute name="href" onInvalid="removeTag"/> -->
+
+        <tag name="link" action="validate">
+
+            <!-- <attribute name="href" onInvalid="removeTag"/> -->
+
+            <attribute name="media" />
+
+            <attribute name="type" onInvalid="removeTag">
+                <literal-list>
+                    <literal value="text/css" />
+                    <literal value="application/rss+xml" />
+                    <literal value="image/x-icon" />
+                </literal-list>
+            </attribute>
+
+            <attribute name="rel">
+                <literal-list>
+                    <literal value="stylesheet" />
+                    <literal value="shortcut icon" />
+                    <literal value="search" />
+                    <literal value="copyright" />
+                    <literal value="top" />
+                    <literal value="alternate" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+        <!-- List tags -->
+
+        <tag name="ul" action="validate" />
+        <tag name="ol" action="validate" />
+        <tag name="li" action="validate" />
+
+        <!-- Dictionary tags -->
+
+        <tag name="dd" action="truncate" />
+        <tag name="dl" action="truncate" />
+        <tag name="dt" action="truncate" />
+
+        <!-- Table tags (tbody, thead, tfoot) -->
+
+        <tag name="thead" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="tbody" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="tfoot" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="table" action="validate">
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="border" />
+            <attribute name="bgcolor" />
+            <attribute name="cellpadding" />
+            <attribute name="cellspacing" />
+            <attribute name="background" />
+            <attribute name="align" />
+            <attribute name="noresize">
+                <literal-list>
+                    <literal value="noresize" />
+                    <literal value="" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+        <tag name="td" action="validate">
+            <attribute name="background" />
+            <attribute name="bgcolor" />
+            <attribute name="abbr" />
+            <attribute name="axis" />
+            <attribute name="headers" />
+            <attribute name="scope" />
+            <attribute name="nowrap" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="colspan" />
+            <attribute name="rowspan" />
+        </tag>
+
+        <tag name="th" action="validate">
+            <attribute name="abbr" />
+            <attribute name="axis" />
+            <attribute name="headers" />
+            <attribute name="scope" />
+            <attribute name="nowrap" />
+            <attribute name="bgcolor" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="colspan" />
+            <attribute name="rowspan" />
+        </tag>
+
+        <tag name="tr" action="validate">
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="valign" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="background" />
+        </tag>
+
+        <tag name="colgroup" action="validate">
+
+            <attribute name="span">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+            <attribute name="width" />
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+        </tag>
+
+        <tag name="col" action="validate">
+            <attribute name="align" />
+            <attribute name="char" />
+            <attribute name="charoff" />
+            <attribute name="valign" />
+            <attribute name="span">
+                <regexp-list>
+                    <regexp name="number" />
+                </regexp-list>
+            </attribute>
+            <attribute name="width" />
+        </tag>
+
+        <tag name="fieldset" action="validate" />
+        <tag name="legend" action="validate" />
+
+        <!-- tags for popular Flash embeds -->
+
+        <tag name="object" action="validate">
+            <attribute name="id" />
+            <attribute name="classid" />
+            <attribute name="codebase" />
+            <attribute name="type" onInvalid="removeTag">
+                <literal-list>
+                    <literal value="application/x-shockwave-flash" />
+                </literal-list>
+            </attribute>
+            <attribute name="data" onInvalid="removeTag">
+                <regexp-list>
+                    <regexp name="flashSites" />
+                </regexp-list>
+            </attribute>
+            <attribute name="align" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="alt" />
+            <attribute name="bgcolor">
+                <regexp-list>
+                    <regexp name="colorCode" />
+                </regexp-list>
+            </attribute>
+        </tag>
+
+        <!-- with validateParamAsEmbed=true, this tag rule also covers <param> name/value pairs -->
+        <tag name="embed" action="validate">
+            <attribute name="src" onInvalid="removeTag">
+                <regexp-list>
+                    <regexp name="flashSites" />
+                </regexp-list>
+            </attribute>
+            <attribute name="movie" onInvalid="removeTag">
+                <regexp-list>
+                    <regexp name="flashSites" />
+                </regexp-list>
+            </attribute>
+            <attribute name="pluginspage">
+                <regexp-list>
+                    <regexp name="flashSites" />
+                </regexp-list>
+            </attribute>
+            <attribute name="bgcolor">
+                <regexp-list>
+                    <regexp name="colorCode" />
+                </regexp-list>
+            </attribute>
+            <attribute name="base">
+                <literal-list>
+                    <literal value="http://admin.brightcove.com" />
+                </literal-list>
+            </attribute>
+            <attribute name="type">
+                <literal-list>
+                    <literal value="application/x-shockwave-flash" />
+                </literal-list>
+            </attribute>
+            <attribute name="name">
+                <regexp-list>
+                    <regexp name="anything" />
+                </regexp-list>
+            </attribute>
+            <attribute name="flashvars">
+                <regexp-list>
+                    <regexp name="anything" /><!-- we could put something complex in here, but this is prolly fine for now -->
+                </regexp-list>
+            </attribute>
+            <attribute name="align" />
+            <attribute name="height" />
+            <attribute name="width" />
+            <attribute name="allowfullscreen">
+                <regexp-list>
+                    <regexp name="boolean" />
+                </regexp-list>
+            </attribute>
+            <attribute name="quality">
+                <literal-list>
+                    <literal value="high" />
+                </literal-list>
+            </attribute>
+            <attribute name="allowscriptaccess">
+                <literal-list>
+                    <literal value="always" />
+                    <literal value="samedomain" />
+                </literal-list>
+            </attribute>
+            <attribute name="seamlesstabbing">
+                <regexp-list>
+                    <regexp name="boolean" />
+                </regexp-list>
+            </attribute>
+            <attribute name="swliveconnect">
+                <regexp-list>
+                    <regexp name="boolean" />
+                </regexp-list>
+            </attribute>
+            <attribute name="wmode">
+                <literal-list>
+                    <literal value="transparent" />
+                    <literal value="window" />
+                </literal-list>
+            </attribute>
+            <attribute name="allownetworking">
+                <literal-list>
+                    <literal value="all" />
+                </literal-list>
+            </attribute>
+        </tag>
+
+    </tag-rules>
+
+
+    <!-- CSS validation processing rules -->
+
+    <css-rules>
+
+        <property name="azimuth"
+            description="This property is most likely to be implemented by mixing the same signal into different channels at differing volumes.">
+            <literal-list>
+                <literal value="left-side" />
+                <literal value="far-left" />
+                <literal value="left" />
+                <literal value="center-left" />
+                <literal value="center" />
+                <literal value="center-right" />
+                <literal value="right" />
+                <literal value="far-right" />
+                <literal value="right-side" />
+                <literal value="behind" />
+                <literal value="leftwards" />
+                <literal value="rightwards" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="angle" />
+            </regexp-list>
+        </property>
+
+        <property name="background"
+            description="The 'background' property is a shorthand property for setting the individual background properties (i.e., 'background-color', 'background-image', 'background-repeat', 'background-attachment' and 'background-position') at the same place in the style sheet.">
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="background-color" />
+                <shorthand name="background-image" />
+                <shorthand name="background-repeat" />
+                <shorthand name="background-attachment" />
+                <shorthand name="background-position" />
+            </shorthand-list>
+        </property>
+
+        <property name="background-attachment"
+            description="If a background image is specified, this property specifies whether it is fixed with regard to the viewport ('fixed') or scrolls along with the document ('scroll').">
+            <literal-list>
+                <literal value="scroll" />
+                <literal value="fixed" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+
+        <property name="background-color"
+            description="This property sets the background color of an element, either a &lt;color&gt; value or the keyword 'transparent', to make the underlying colors shine through.">
+            <literal-list>
+                <literal value="transparent" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+
+        <property name="background-image" description="This property sets the background image of an element.">
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+
+        <property name="background-position"
+            description="If a background image has been specified, this property specifies its initial position.">
+            <literal-list>
+                <literal value="top" />
+                <literal value="center" />
+                <literal value="bottom" />
+                <literal value="left" />
+                <literal value="center" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="percentage" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <property name="background-repeat"
+            description="If a background image is specified, this property specifies whether the image is repeated (tiled), and how.">
+            <literal-list>
+                <literal value="repeat" />
+                <literal value="repeat-x" />
+                <literal value="repeat-y" />
+                <literal value="no-repeat" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+
+        <!-- Begin simple properties -->
+        <property name="border-collapse" default="collapse" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="collapse" />
+                <literal value="separate" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="border-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="transparent" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-top-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-right-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-bottom-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="border-left-color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="bottom" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="caption-side" default="top" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="top" />
+                <literal value="bottom" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="clear" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="both" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="color" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="cue-after" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="cue-before" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="direction" default="ltr" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="ltr" />
+                <literal value="rtl" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="display" default="inline" description="">
+            <category-list>
+                <category value="all" />
+            </category-list>
+            <literal-list>
+                <literal value="inline" />
+                <literal value="block" />
+                <literal value="list-item" />
+                <literal value="run-in" />
+                <literal value="compact" />
+                <literal value="marker" />
+                <literal value="table" />
+                <literal value="inline-table" />
+                <literal value="table-row-group" />
+                <literal value="table-header-group" />
+                <literal value="table-footer-group" />
+                <literal value="table-row" />
+                <literal value="table-column-group" />
+                <literal value="table-column" />
+                <literal value="table-cell" />
+                <literal value="table-caption" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="elevation" default="level" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="below" />
+                <literal value="level" />
+                <literal value="above" />
+                <literal value="higher" />
+                <literal value="lower" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="angle" />
+            </regexp-list>
+        </property>
+        <property name="empty-cells" default="show" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="show" />
+                <literal value="hide" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="float" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-size" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="absolute-size" />
+                <regexp name="relative-size" />
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="font-size-adjust" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="font-stretch" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="wider" />
+                <literal value="narrower" />
+                <literal value="ultra-condensed" />
+                <literal value="extra-condensed" />
+                <literal value="condensed" />
+                <literal value="semi-condensed" />
+                <literal value="semi-expanded" />
+                <literal value="expanded" />
+                <literal value="extra-expanded" />
+                <literal value="ultra-expanded" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-style" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="italic" />
+                <literal value="oblique" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-variant" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="small-caps" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="font-weight" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="bold" />
+                <literal value="bolder" />
+                <literal value="lighter" />
+                <literal value="100" />
+                <literal value="200" />
+                <literal value="300" />
+                <literal value="400" />
+                <literal value="500" />
+                <literal value="600" />
+                <literal value="700" />
+                <literal value="800" />
+                <literal value="900" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="height" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="left" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="letter-spacing" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="line-height" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="list-style-image" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+        <property name="list-style-position" default="outside" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inside" />
+                <literal value="outside" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="list-style-type" default="disc" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="disc" />
+                <literal value="circle" />
+                <literal value="square" />
+                <literal value="decimal" />
+                <literal value="decimal-leading-zero" />
+                <literal value="lower-roman" />
+                <literal value="upper-roman" />
+                <literal value="lower-greek" />
+                <literal value="lower-alpha" />
+                <literal value="lower-latin" />
+                <literal value="upper-alpha" />
+                <literal value="upper-latin" />
+                <literal value="hebrew" />
+                <literal value="armenian" />
+                <literal value="georgian" />
+                <literal value="cjk-ideographic" />
+                <literal value="hiragana" />
+                <literal value="katakana" />
+                <literal value="hiragana-iroha" />
+                <literal value="katakana-iroha" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="marker-offset" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="max-height" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="max-width" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="min-height" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="min-width" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="orphans" default="2" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="outline-color" default="invert" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="invert" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+        </property>
+        <property name="overflow" default="visible" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="visible" />
+                <literal value="hidden" />
+                <literal value="scroll" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-after" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="always" />
+                <literal value="avoid" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-before" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="always" />
+                <literal value="avoid" />
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="page-break-inside" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="avoid" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="pause-after" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="pause-before" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="pitch" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="x-low" />
+                <literal value="low" />
+                <literal value="medium" />
+                <literal value="high" />
+                <literal value="x-high" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="frequency" />
+            </regexp-list>
+        </property>
+        <property name="pitch-range" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="position" default="static" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="static" />
+                <!-- possible to perform phishing attacks with the following -->
+                <!-- <literal value="relative"/> <literal value="absolute"/> <literal value="fixed"/> -->
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="richness" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="right" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="size" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="portrait" />
+                <literal value="landscape" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="speak" default="normal" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="none" />
+                <literal value="spell-out" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-header" default="once" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="once" />
+                <literal value="always" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-numeral" default="continuous" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="digits" />
+                <literal value="continuous" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speak-punctuation" default="none" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="code" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="speech-rate" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="x-slow" />
+                <literal value="slow" />
+                <literal value="medium" />
+                <literal value="fast" />
+                <literal value="x-fast" />
+                <literal value="faster" />
+                <literal value="slower" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="stress" default="50" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+            </regexp-list>
+        </property>
+        <property name="table-layout" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="fixed" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="text-indent" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="text-transform" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="capitalize" />
+                <literal value="uppercase" />
+                <literal value="lowercase" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="top" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="unicode-bidi" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="embed" />
+                <literal value="bidi-override" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="vertical-align" default="baseline" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="baseline" />
+                <literal value="sub" />
+                <literal value="super" />
+                <literal value="top" />
+                <literal value="text-top" />
+                <literal value="middle" />
+                <literal value="bottom" />
+                <literal value="text-bottom" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="percentage" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="visibility" default="inherit" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="visible" />
+                <literal value="hidden" />
+                <literal value="collapse" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="volume" default="medium" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="silent" />
+                <literal value="x-soft" />
+                <literal value="soft" />
+                <literal value="medium" />
+                <literal value="loud" />
+                <literal value="x-loud" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="number" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="white-space" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="pre" />
+                <literal value="nowrap" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="widows" default="2" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="width" default="auto" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="word-spacing" default="normal" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="normal" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <!-- end simple properties -->
+
+        <!-- begin medium properties -->
+        <property name="border-style" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="none" />
+                <literal value="hidden" />
+                <literal value="dotted" />
+                <literal value="dashed" />
+                <literal value="solid" />
+                <literal value="double" />
+                <literal value="groove" />
+                <literal value="ridge" />
+                <literal value="inset" />
+                <literal value="outset" />
+            </literal-list>
+        </property>
+        <property name="border-top-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="border-right-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-left-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-top-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-right-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-left-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="border-width" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="thin" />
+                <literal value="medium" />
+                <literal value="thick" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="margin" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+                <literal value="auto" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="positiveLength" />
+                <regexp name="positivePercentage" />
+            </regexp-list>
+        </property>
+        <property name="margin-top" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-right" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-bottom" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="margin-left" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="margin" />
+            </shorthand-list>
+        </property>
+        <property name="outline-style" default="none" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="outline-width" default="medium" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+            </shorthand-list>
+        </property>
+        <property name="padding" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="padding-top" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-right" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-bottom" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <property name="padding-left" default="0" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="padding" />
+            </shorthand-list>
+        </property>
+        <!-- end medium properties -->
+
+        <!-- begin hard properties -->
+        <property name="border" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-top" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-right" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-bottom" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="border-left" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+            </regexp-list>
+            <shorthand-list>
+                <shorthand name="border-top-width" />
+                <shorthand name="border-style" />
+            </shorthand-list>
+        </property>
+        <property name="cue" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="cue-before" />
+                <shorthand name="cue-after" />
+            </shorthand-list>
+        </property>
+        <property name="list-style" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="list-style-type" />
+                <shorthand name="list-style-position" />
+                <shorthand name="list-style-image" />
+            </shorthand-list>
+        </property>
+        <property name="marks" default="none" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="crop" />
+                <literal value="cross" />
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <property name="outline" description="">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="outline-color" />
+                <shorthand name="outline-style" />
+                <shorthand name="outline-width" />
+            </shorthand-list>
+        </property>
+        <property name="pause" description="">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="time" />
+                <regexp name="percentage" />
+            </regexp-list>
+        </property>
+        <property name="text-decoration" default="none" description="">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="underline" />
+                <literal value="overline" />
+                <literal value="line-through" />
+                <literal value="blink" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <!-- end hard properties -->
+        <!-- begin manual properties -->
+        <property name="border-spacing" default="0"
+            description="The lengths specify the distance that separates adjacent cell borders. If one length is specified, it gives both the horizontal and vertical spacing. If two are specified, the first gives the horizontal spacing and the second the vertical spacing. Lengths may not be negative.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="clip" default="auto"
+            description="The 'clip' property applies to elements that have a 'overflow' property with a value other than 'visible'.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+        <property name="counter-increment" default="none"
+            description="The 'counter-increment' property accepts one or more names of counters (identifiers), each one optionally followed by an integer.">
+            <category-list>
+                <category value="all" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssIdentifier" />
+                <regexp name="integer" />
+            </regexp-list>
+        </property>
+        <property name="cursor" default="auto"
+            description="This property specifies the type of cursor to be displayed for the pointing device.">
+            <category-list>
+                <category value="visual" />
+                <category value="interactive" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+                <literal value="inherit" />
+                <literal value="crosshair" />
+                <literal value="default" />
+                <literal value="pointer" />
+                <literal value="move" />
+                <literal value="e-resize" />
+                <literal value="ne-resize" />
+                <literal value="nw-resize" />
+                <literal value="n-resize" />
+                <literal value="se-resize" />
+                <literal value="sw-resize" />
+                <literal value="s-resize" />
+                <literal value="w-resize| text" />
+                <literal value="wait" />
+                <literal value="help" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+
+        <property name="text-shadow" default="none"
+            description="This property accepts a comma-separated list of shadow effects to be applied to the text of the element.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="none" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="colorName" />
+                <regexp name="colorCode" />
+                <regexp name="rgbCode" />
+                <regexp name="systemColor" />
+                <regexp name="length" />
+            </regexp-list>
+        </property>
+
+        <property name="font"
+            description="The 'font' property is, except as described below, a shorthand property for setting 'font-style', 'font-variant', 'font-weight', 'font-size', 'line-height', and 'font-family', at the same place in the style sheet.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <literal-list>
+                <literal value="/" />
+                <literal value="caption" />
+                <literal value="icon" />
+                <literal value="menu" />
+                <literal value="message-box" />
+                <literal value="small-caption" />
+                <literal value="status-bar" />
+                <literal value="inherit" />
+            </literal-list>
+            <shorthand-list>
+                <shorthand name="font-style" />
+                <shorthand name="font-variant" />
+                <shorthand name="font-weight" />
+                <shorthand name="font-size" />
+                <shorthand name="line-height" />
+                <shorthand name="font-family" />
+            </shorthand-list>
+        </property>
+
+        <property name="font-family"
+            description="This property specifies a prioritized list of font family names and/or generic family names.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <!-- allowing only generic font families -->
+            <literal-list>
+                <literal value="serif" />
+                <literal value="arial" />
+                <literal value="lucida console" />
+                <literal value="sans-serif" />
+                <literal value="cursive" />
+                <literal value="verdana" />
+                <literal value="fantasy" />
+                <literal value="monospace" />
+            </literal-list>
+
+            <regexp-list>
+                <regexp value="[\w,\-&apos;&quot; ]+" />
+            </regexp-list>
+        </property>
+
+        <property name="page"
+            description="The 'page' property can be used to specify a particular type of page where an element should be displayed.">
+            <category-list>
+                <category value="visual" />
+                <category value="paged" />
+            </category-list>
+            <literal-list>
+                <literal value="auto" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssIdentifier" />
+            </regexp-list>
+        </property>
+
+        <property name="play-during" default="auto"
+            description="Similar to the 'cue-before' and 'cue-after' properties, this property specifies a sound to be played as a background while an element's content is spoken.">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <literal-list>
+                <literal value="mix" />
+                <literal value="repeat" />
+                <literal value="none" />
+                <literal value="auto" />
+                <literal value="inherit" />
+            </literal-list>
+            <regexp-list>
+                <regexp name="cssOffsiteUri" />
+                <regexp name="cssOnsiteUri" />
+            </regexp-list>
+        </property>
+
+        <property name="text-align" description="This property describes how inline content of a block is aligned.">
+            <category-list>
+                <category value="visual" />
+            </category-list>
+            <!-- For safety, ignoring string alignment which can be used to line table cells on characters -->
+            <literal-list>
+                <literal value="left" />
+                <literal value="right" />
+                <literal value="center" />
+                <literal value="justify" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+
+        <property name="voice-family"
+            description="The value is a comma-separated, prioritized list of voice family names (compare with 'font-family').">
+            <category-list>
+                <category value="aural" />
+            </category-list>
+            <!-- Allowing only generic voice family -->
+            <literal-list>
+                <literal value="male" />
+                <literal value="female" />
+                <literal value="child" />
+                <literal value="inherit" />
+            </literal-list>
+        </property>
+        <!-- end manual properties -->
+    </css-rules>
 
     <allowed-empty-tags>
         <literal-list>
-            <literal value="br"/>
-            <literal value="hr"/>
-            <literal value="a"/>
-            <literal value="img"/>
-            <literal value="link"/>
-            <literal value="iframe"/>
-            <literal value="script"/>
-            <literal value="object"/>
-            <literal value="applet"/>
-            <literal value="frame"/>
-            <literal value="base"/>
-            <literal value="param"/>
-            <literal value="meta"/>
-            <literal value="input"/>
-            <literal value="textarea"/>
-            <literal value="embed"/>
-            <literal value="basefont"/>
-            <literal value="col"/>
-            <literal value="div"/>
+            <literal value="br" />
+            <literal value="hr" />
+            <literal value="a" />
+            <literal value="img" />
+            <literal value="link" />
+            <literal value="iframe" />
+            <literal value="script" />
+            <literal value="object" />
+            <literal value="applet" />
+            <literal value="frame" />
+            <literal value="base" />
+            <literal value="param" />
+            <literal value="meta" />
+            <literal value="input" />
+            <literal value="textarea" />
+            <literal value="embed" />
+            <literal value="basefont" />
+            <literal value="col" />
+            <literal value="div" />
         </literal-list>
     </allowed-empty-tags>
 
diff --git a/src/test/java/org/owasp/validator/css/CssScannerTest.java b/src/test/java/org/owasp/validator/css/CssScannerTest.java
index 3de36a28..d7e8d491 100644
--- a/src/test/java/org/owasp/validator/css/CssScannerTest.java
+++ b/src/test/java/org/owasp/validator/css/CssScannerTest.java
@@ -27,90 +27,101 @@
  */
 package org.owasp.validator.css;
 
-import org.junit.Before;
-import org.junit.Test;
-import org.owasp.validator.html.*;
-import org.owasp.validator.html.scan.Constants;
-import org.owasp.validator.html.test.TestPolicy;
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.CoreMatchers.not;
+import static org.hamcrest.MatcherAssert.assertThat;
 
 import java.net.URL;
 import java.util.Locale;
 import java.util.MissingResourceException;
 import java.util.ResourceBundle;
-
-import static org.hamcrest.CoreMatchers.containsString;
-import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.CoreMatchers.not;
-import static org.hamcrest.MatcherAssert.assertThat;
+import org.junit.Before;
+import org.junit.Test;
+import org.owasp.validator.html.*;
+import org.owasp.validator.html.scan.Constants;
+import org.owasp.validator.html.test.TestPolicy;
 
 public class CssScannerTest {
-    private TestPolicy policy = null;
-    private ResourceBundle messages = null;
+  private TestPolicy policy = null;
+  private ResourceBundle messages = null;
 
-    @Before
-    public void setUp() throws Exception {
-        // Load the policy. You may have to change the path to find the Policy file for your environment.
-        URL url = getClass().getResource("/antisamy.xml");
-        policy = TestPolicy.getInstance(url);
-        // Load resource bundle
-        try {
-            messages = ResourceBundle.getBundle("AntiSamy", Locale.getDefault());
-        } catch (MissingResourceException mre) {
-            messages =  ResourceBundle.getBundle("AntiSamy", new Locale(Constants.DEFAULT_LOCALE_LANG,
-                    Constants.DEFAULT_LOCALE_LOC));
-        }
+  @Before
+  public void setUp() throws Exception {
+    // Load the policy. You may have to change the path to find the Policy file for your
+    // environment.
+    URL url = getClass().getResource("/antisamy.xml");
+    policy = TestPolicy.getInstance(url);
+    // Load resource bundle
+    try {
+      messages = ResourceBundle.getBundle("AntiSamy", Locale.getDefault());
+    } catch (MissingResourceException mre) {
+      messages =
+          ResourceBundle.getBundle(
+              "AntiSamy", new Locale(Constants.DEFAULT_LOCALE_LANG, Constants.DEFAULT_LOCALE_LOC));
     }
+  }
 
-    @Test
-    public void testAvoidImportingStyles() throws ScanException {
-        final String input = "@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/classic.css);\n" +
-                ".very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}";
-        // If not passing "shouldParseImportedStyles" then it's false by default.
-        CssScanner scanner = new CssScanner(policy, messages);
-        String result = scanner.scanStyleSheet(input, 1000).getCleanHTML();
-        // If style sheet was imported, .grid_1 class should be there.
-        assertThat(result, not(containsString(".grid_1")));
-        assertThat(result, containsString(".very-specific-antisamy"));
-    }
+  @Test
+  public void testAvoidImportingStyles() throws ScanException {
+    final String input =
+        "@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/classic.css);\n"
+            + ".very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}";
+    // If not passing "shouldParseImportedStyles" then it's false by default.
+    CssScanner scanner = new CssScanner(policy, messages);
+    String result = scanner.scanStyleSheet(input, 1000).getCleanHTML();
+    // If style sheet was imported, .grid_1 class should be there.
+    assertThat(result, not(containsString(".grid_1")));
+    assertThat(result, containsString(".very-specific-antisamy"));
+  }
 
-    @Test
-    public void testReAddCdataIfPresentInStyle() throws ScanException {
-        final String input = "<![CDATA[.very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}]]>";
-        CssScanner scanner = new CssScanner(policy, messages);
-        assertThat(scanner.scanStyleSheet(input, 1000).getCleanHTML(), containsString("CDATA"));
-    }
+  @Test
+  public void testReAddCdataIfPresentInStyle() throws ScanException {
+    final String input = "<![CDATA[.very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}]]>";
+    CssScanner scanner = new CssScanner(policy, messages);
+    assertThat(scanner.scanStyleSheet(input, 1000).getCleanHTML(), containsString("CDATA"));
+  }
 
-    @Test
-    public void testImportLimiting() throws ScanException {
-        final String input = "@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/classic.css);\n" +
-                "@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/providers.css);\n" +
-                ".very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}";
-        TestPolicy revised = policy.cloneWithDirective(Policy.EMBED_STYLESHEETS,"true")
-                .cloneWithDirective(Policy.MAX_INPUT_SIZE,"500")
-                .cloneWithDirective(Policy.MAX_STYLESHEET_IMPORTS,"2");
-        CssScanner scanner = new CssScanner(revised, messages, true);
-        CleanResults result = scanner.scanStyleSheet(input, 500);
-        // Both sheets are larger than 500 bytes
-        assertThat(result.getErrorMessages().size(), is(2));
-        assertThat(result.getErrorMessages().get(0), containsString("500"));
+  @Test
+  public void testImportLimiting() throws ScanException {
+    final String input =
+        "@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/classic.css);\n"
+            + "@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/providers.css);\n"
+            + ".very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}";
+    TestPolicy revised =
+        policy
+            .cloneWithDirective(Policy.EMBED_STYLESHEETS, "true")
+            .cloneWithDirective(Policy.MAX_INPUT_SIZE, "500")
+            .cloneWithDirective(Policy.MAX_STYLESHEET_IMPORTS, "2");
+    CssScanner scanner = new CssScanner(revised, messages, true);
+    CleanResults result = scanner.scanStyleSheet(input, 500);
+    // Both sheets are larger than 500 bytes
+    assertThat(result.getErrorMessages().size(), is(2));
+    assertThat(result.getErrorMessages().get(0), containsString("500"));
 
-        // Limit to only one import
-        revised = policy.cloneWithDirective(Policy.EMBED_STYLESHEETS,"true")
-                .cloneWithDirective(Policy.MAX_STYLESHEET_IMPORTS,"1");
-        scanner = new CssScanner(revised, messages, true);
-        result = scanner.scanStyleSheet(input, 500000);
-        // If only first style sheet was imported, .grid_1 class should be there and .janrain-provider150-sprit classes should not.
-        assertThat(result.getCleanHTML(), containsString(".grid_1"));
-        assertThat(result.getCleanHTML(), not(containsString(".janrain-provider150-sprit")));
+    // Limit to only one import
+    revised =
+        policy
+            .cloneWithDirective(Policy.EMBED_STYLESHEETS, "true")
+            .cloneWithDirective(Policy.MAX_STYLESHEET_IMPORTS, "1");
+    scanner = new CssScanner(revised, messages, true);
+    result = scanner.scanStyleSheet(input, 500000);
+    // If only first style sheet was imported, .grid_1 class should be there and
+    // .janrain-provider150-sprit classes should not.
+    assertThat(result.getCleanHTML(), containsString(".grid_1"));
+    assertThat(result.getCleanHTML(), not(containsString(".janrain-provider150-sprit")));
 
-        // Force timeout errors
-        revised = policy.cloneWithDirective(Policy.EMBED_STYLESHEETS,"true")
-                .cloneWithDirective(Policy.CONNECTION_TIMEOUT,"1");
-        scanner = new CssScanner(revised, messages, true);
-        result = scanner.scanStyleSheet(input, 500000);
-        assertThat(result.getErrorMessages().size(), is(2));
-        // If style sheets were imported, .grid_1 and .janrain-provider150-sprit classes should be there.
-        assertThat(result.getCleanHTML(), not(containsString(".grid_1")));
-        assertThat(result.getCleanHTML(), not(containsString(".janrain-provider150-sprit")));
-    }
+    // Force timeout errors
+    revised =
+        policy
+            .cloneWithDirective(Policy.EMBED_STYLESHEETS, "true")
+            .cloneWithDirective(Policy.CONNECTION_TIMEOUT, "1");
+    scanner = new CssScanner(revised, messages, true);
+    result = scanner.scanStyleSheet(input, 500000);
+    assertThat(result.getErrorMessages().size(), is(2));
+    // If style sheets were imported, .grid_1 and .janrain-provider150-sprit classes should be
+    // there.
+    assertThat(result.getCleanHTML(), not(containsString(".grid_1")));
+    assertThat(result.getCleanHTML(), not(containsString(".janrain-provider150-sprit")));
+  }
 }
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyMalformedPolicyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyMalformedPolicyTest.java
index 90dbddd4..28ecc46a 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyMalformedPolicyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyMalformedPolicyTest.java
@@ -3,36 +3,34 @@
 import static org.junit.Assert.fail;
 
 import java.io.InputStream;
-
 import org.junit.Test;
 import org.owasp.validator.html.Policy;
 import org.owasp.validator.html.PolicyException;
 
-/**
- * @author Gerardo Canedo
- */
+/** @author Gerardo Canedo */
 public class AntiSamyMalformedPolicyTest {
 
-    @Test
-    public void testDirectConfigMalformed() throws Exception {
-        InputStream stream = AntiSamyMalformedPolicyTest.class.getResourceAsStream("/invalidPolicyMalformedXml.xml");
-        try {
-            Policy.getInstance(stream);
-            fail("For Malformed XML, PolicyException expected.");
-        } catch (PolicyException e) {
-			// This is expected, so do nothing. Any other kind of exception is a failed test case.
-        }
+  @Test
+  public void testDirectConfigMalformed() throws Exception {
+    InputStream stream =
+        AntiSamyMalformedPolicyTest.class.getResourceAsStream("/invalidPolicyMalformedXml.xml");
+    try {
+      Policy.getInstance(stream);
+      fail("For Malformed XML, PolicyException expected.");
+    } catch (PolicyException e) {
+      // This is expected, so do nothing. Any other kind of exception is a failed test case.
     }
-    
-	@Test
-	public void testDirectConfigAsBaisMalformed() throws Exception {
-		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/invalidPolicyMalformedXml.xml");
-		try {
-			Policy.getInstance(ESAPIInvalidPolicyTest.toByteArrayStream(stream));
-            fail("For Malformed XML, PolicyException expected.");
-        } catch (PolicyException e) {
-			// This is expected, so do nothing. Any other kind of exception is a failed test case.
-		}
-	}
+  }
 
+  @Test
+  public void testDirectConfigAsBaisMalformed() throws Exception {
+    InputStream stream =
+        ESAPIInvalidPolicyTest.class.getResourceAsStream("/invalidPolicyMalformedXml.xml");
+    try {
+      Policy.getInstance(ESAPIInvalidPolicyTest.toByteArrayStream(stream));
+      fail("For Malformed XML, PolicyException expected.");
+    } catch (PolicyException e) {
+      // This is expected, so do nothing. Any other kind of exception is a failed test case.
+    }
+  }
 }
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyPerformanceTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyPerformanceTest.java
index af13761f..bad3a531 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyPerformanceTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyPerformanceTest.java
@@ -1,8 +1,8 @@
 /*
  * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li
- * 
+ *
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
  *                                                  1
  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
@@ -24,101 +24,96 @@
 
 package org.owasp.validator.html.test;
 
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.net.URL;
+import java.net.URLConnection;
 import org.junit.Before;
 import org.junit.Test;
 import org.owasp.validator.html.AntiSamy;
 import org.owasp.validator.html.PolicyException;
 import org.owasp.validator.html.ScanException;
 
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.net.URL;
-import java.net.URLConnection;
-
 /**
- * This class tests AntiSamy functionality and the basic policy file which
- * should be immune to XSS and CSS phishing attacks.
+ * This class tests AntiSamy functionality and the basic policy file which should be immune to XSS
+ * and CSS phishing attacks.
  *
  * @author Arshan Dabirsiaghi
  * @author Kristian Rosenvold
  */
-
 public class AntiSamyPerformanceTest {
 
+  private AntiSamy as = new AntiSamy();
+  private TestPolicy policy = null;
+
+  @Before
+  public void setUp() throws Exception {
+
+    /*
+     * Load the policy. You may have to change the path to find the Policy
+     * file for your environment.
+     */
+
+    // get Policy instance from a URL.
+    URL url = getClass().getResource("/antisamy.xml");
+    policy = TestPolicy.getInstance(url);
+  }
+
+  @Test
+  public void compareSpeedsLargeFiles() throws IOException, ScanException, PolicyException {
+
+    URL[] urls = {
+      this.getClass().getResource("/s/slashdot.org.htm"),
+      this.getClass().getResource("/s/fark.com"),
+      this.getClass().getResource("/s/cnn.com"),
+      this.getClass().getResource("/s/google.com.html"),
+      this.getClass().getResource("/s/microsoft.com"),
+    };
+
+    double totalDomTime = 0;
+    double totalSaxTime = 0;
+
+    int testReps = 15;
+
+    for (URL url : urls) {
+      URLConnection conn = url.openConnection();
+      InputStreamReader in = new InputStreamReader(conn.getInputStream());
+      StringBuilder out = new StringBuilder();
+      char[] buffer = new char[5000];
+      int read;
+      do {
+        read = in.read(buffer, 0, buffer.length);
+        if (read > 0) {
+          out.append(buffer, 0, read);
+        }
+      } while (read >= 0);
 
-    private AntiSamy as = new AntiSamy();
-    private TestPolicy policy = null;
-
-
-    @Before
-    public void setUp() throws Exception {
-
-          /*
-           * Load the policy. You may have to change the path to find the Policy
-           * file for your environment.
-           */
-
-        //get Policy instance from a URL.
-        URL url = getClass().getResource("/antisamy.xml");
-        policy = TestPolicy.getInstance(url);
-    }
-
-
-    @Test
-    public void compareSpeedsLargeFiles() throws IOException, ScanException, PolicyException {
-
-        URL[] urls = {
-                this.getClass().getResource("/s/slashdot.org.htm"),
-                this.getClass().getResource("/s/fark.com"),
-                this.getClass().getResource("/s/cnn.com"),
-                this.getClass().getResource("/s/google.com.html"),
-                this.getClass().getResource("/s/microsoft.com"),
-        };
-
-        double totalDomTime = 0;
-        double totalSaxTime = 0;
-
-        int testReps = 15;
-
-        for (URL url : urls) {
-            URLConnection conn = url.openConnection();
-            InputStreamReader in = new InputStreamReader(conn.getInputStream());
-            StringBuilder out = new StringBuilder();
-            char[] buffer = new char[5000];
-            int read;
-            do {
-                read = in.read(buffer, 0, buffer.length);
-                if (read > 0) {
-                    out.append(buffer, 0, read);
-                }
-            } while (read >= 0);
-
-            in.close();
-
-            String html = out.toString();
+      in.close();
 
-            System.out.println("About to scan: " + url + " size: " + html.length());
-            if (html.length() > policy.determineMaxInputSize()) {
-                System.out.println("   -Maximum input size exceeded. SKIPPING.");
-                continue;
-            }
+      String html = out.toString();
 
-            double domTime = 0;
-            double saxTime = 0;
+      System.out.println("About to scan: " + url + " size: " + html.length());
+      if (html.length() > policy.determineMaxInputSize()) {
+        System.out.println("   -Maximum input size exceeded. SKIPPING.");
+        continue;
+      }
 
-            for (int j = 0; j < testReps; j++) {
-                domTime += as.scan(html, policy, AntiSamy.DOM).getScanTime();
-                saxTime += as.scan(html, policy, AntiSamy.SAX).getScanTime();
-            }
+      double domTime = 0;
+      double saxTime = 0;
 
-            domTime = domTime / testReps;
-            saxTime = saxTime / testReps;
+      for (int j = 0; j < testReps; j++) {
+        domTime += as.scan(html, policy, AntiSamy.DOM).getScanTime();
+        saxTime += as.scan(html, policy, AntiSamy.SAX).getScanTime();
+      }
 
-            totalDomTime += domTime;
-            totalSaxTime += saxTime;
-        }
+      domTime = domTime / testReps;
+      saxTime = saxTime / testReps;
 
-        System.out.println("Total DOM time: " + totalDomTime);
-        System.out.println("Total SAX time: " + totalSaxTime);
+      totalDomTime += domTime;
+      totalSaxTime += saxTime;
     }
-}
\ No newline at end of file
+
+    System.out.println("Total DOM time: " + totalDomTime);
+    System.out.println("Total SAX time: " + totalSaxTime);
+  }
+}
diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
index 9a6d19cf..aa9dd212 100644
--- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
@@ -28,22 +28,17 @@
 
 package org.owasp.validator.html.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
 import static org.hamcrest.CoreMatchers.both;
 import static org.hamcrest.CoreMatchers.containsString;
-import static org.hamcrest.CoreMatchers.either;
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.not;
 import static org.hamcrest.MatcherAssert.assertThat;
-
-import org.hamcrest.text.MatchesPattern;
-import org.junit.Before;
-import org.junit.Test;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
 
 import java.io.File;
 import java.io.IOException;
@@ -59,9 +54,10 @@
 import java.util.Map;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
-
 import org.apache.commons.codec.binary.Base64;
-
+import org.hamcrest.text.MatchesPattern;
+import org.junit.Before;
+import org.junit.Test;
 import org.owasp.validator.html.AntiSamy;
 import org.owasp.validator.html.CleanResults;
 import org.owasp.validator.html.Policy;
@@ -72,1339 +68,1945 @@
 import org.owasp.validator.html.model.Tag;
 
 /**
- * This class tests AntiSamy functionality and the basic policy file which
- * should be immune to XSS and CSS phishing attacks.
- * 
- * The test cases titled issue##() map to the issues identified in the original AntiSamy 
- * source code repo at: https://code.google.com/archive/p/owaspantisamy/issues.
- * 
- * The test cases titled githubIssue##() map to the issues documented at: 
- *     https://github.com/nahsra/antisamy/issues
+ * This class tests AntiSamy functionality and the basic policy file which should be immune to XSS
+ * and CSS phishing attacks.
+ *
+ * <p>The test cases titled issue##() map to the issues identified in the original AntiSamy source
+ * code repo at: https://code.google.com/archive/p/owaspantisamy/issues.
+ *
+ * <p>The test cases titled githubIssue##() map to the issues documented at:
+ * https://github.com/nahsra/antisamy/issues
  *
  * @author Arshan Dabirsiaghi
  */
-
 public class AntiSamyTest {
 
-    private static final String[] BASE64_BAD_XML_STRINGS = new String[]{
-            // first string is
-            // "<a - href=\"http://www.owasp.org\">click here</a>"
-            "PGEgLSBocmVmPSJodHRwOi8vd3d3Lm93YXNwLm9yZyI+Y2xpY2sgaGVyZTwvYT4=",
-            // the rest are randomly generated 300 byte sequences which generate
-            // parser errors, turned into Strings
-            "uz0sEy5aDiok6oufQRaYPyYOxbtlACRnfrOnUVIbOstiaoB95iw+dJYuO5sI9nudhRtSYLANlcdgO0pRb+65qKDwZ5o6GJRMWv4YajZk+7Q3W/GN295XmyWUpxuyPGVi7d5fhmtYaYNW6vxyKK1Wjn9IEhIrfvNNjtEF90vlERnz3wde4WMaKMeciqgDXuZHEApYmUcu6Wbx4Q6WcNDqohAN/qCli74tvC+Umy0ZsQGU7E+BvJJ1tLfMcSzYiz7Q15ByZOYrA2aa0wDu0no3gSatjGt6aB4h30D9xUP31LuPGZ2GdWwMfZbFcfRgDSh42JPwa1bODmt5cw0Y8ACeyrIbfk9IkX1bPpYfIgtO7TwuXjBbhh2EEixOZ2YkcsvmcOSVTvraChbxv6kP",
-            "PIWjMV4y+MpuNLtcY3vBRG4ZcNaCkB9wXJr3pghmFA6rVXAik+d5lei48TtnHvfvb5rQZVceWKv9cR/9IIsLokMyN0omkd8j3TV0DOh3JyBjPHFCu1Gp4Weo96h5C6RBoB0xsE4QdS2Y1sq/yiha9IebyHThAfnGU8AMC4AvZ7DDBccD2leZy2Q617ekz5grvxEG6tEcZ3fCbJn4leQVVo9MNoerim8KFHGloT+LxdgQR6YN5y1ii3bVGreM51S4TeANujdqJXp8B7B1Gk3PKCRS2T1SNFZedut45y+/w7wp5AUQCBUpIPUj6RLp+y3byWhcbZbJ70KOzTSZuYYIKLLo8047Fej43bIaghJm0F9yIKk3C5gtBcw8T5pciJoVXrTdBAK/8fMVo29P",
-            "uCk7HocubT6KzJw2eXpSUItZFGkr7U+D89mJw70rxdqXP2JaG04SNjx3dd84G4bz+UVPPhPO2gBAx2vHI0xhgJG9T4vffAYh2D1kenmr+8gIHt6WDNeD+HwJeAbJYhfVFMJsTuIGlYIw8+I+TARK0vqjACyRwMDAndhXnDrk4E5U3hyjqS14XX0kIDZYM6FGFPXe/s+ba2886Q8o1a7WosgqqAmt4u6R3IHOvVf5/PIeZrBJKrVptxjdjelP8Xwjq2ujWNtR3/HM1kjRlJi4xedvMRe4Rlxek0NDLC9hNd18RYi0EjzQ0bGSDDl0813yv6s6tcT6xHMzKvDcUcFRkX6BbxmoIcMsVeHM/ur6yRv834o/TT5IdiM9/wpkuICFOWIfM+Y8OWhiU6BK",
-            "Bb6Cqy6stJ0YhtPirRAQ8OXrPFKAeYHeuZXuC1qdHJRlweEzl4F2z/ZFG7hzr5NLZtzrRG3wm5TXl6Aua5G6v0WKcjJiS2V43WB8uY1BFK1d2y68c1gTRSF0u+VTThGjz+q/R6zE8HG8uchO+KPw64RehXDbPQ4uadiL+UwfZ4BzY1OHhvM5+2lVlibG+awtH6qzzx6zOWemTih932Lt9mMnm3FzEw7uGzPEYZ3aBV5xnbQ2a2N4UXIdm7RtIUiYFzHcLe5PZM/utJF8NdHKy0SPaKYkdXHli7g3tarzAabLZqLT4k7oemKYCn/eKRreZjqTB2E8Kc9Swf3jHDkmSvzOYE8wi1vQ3X7JtPcQ2O4muvpSa70NIE+XK1CgnnsL79Qzci1/1xgkBlNq",
-            "FZNVr4nOICD1cNfAvQwZvZWi+P4I2Gubzrt+wK+7gLEY144BosgKeK7snwlA/vJjPAnkFW72APTBjY6kk4EOyoUef0MxRnZEU11vby5Ru19eixZBFB/SVXDJleLK0z3zXXE8U5Zl5RzLActHakG8Psvdt8TDscQc4MPZ1K7mXDhi7FQdpjRTwVxFyCFoybQ9WNJNGPsAkkm84NtFb4KjGpwVC70oq87tM2gYCrNgMhBfdBl0bnQHoNBCp76RKdpq1UAY01t1ipfgt7BoaAr0eTw1S32DezjfkAz04WyPTzkdBKd3b44rX9dXEbm6szAz0SjgztRPDJKSMELjq16W2Ua8d1AHq2Dz8JlsvGzi2jICUjpFsIfRmQ/STSvOT8VsaCFhwL1zDLbn5jCr",
-            "RuiRkvYjH2FcCjNzFPT2PJWh7Q6vUbfMadMIEnw49GvzTmhk4OUFyjY13GL52JVyqdyFrnpgEOtXiTu88Cm+TiBI7JRh0jRs3VJRP3N+5GpyjKX7cJA46w8PrH3ovJo3PES7o8CSYKRa3eUs7BnFt7kUCvMqBBqIhTIKlnQd2JkMNnhhCcYdPygLx7E1Vg+H3KybcETsYWBeUVrhRl/RAyYJkn6LddjPuWkDdgIcnKhNvpQu4MMqF3YbzHgyTh7bdWjy1liZle7xR/uRbOrRIRKTxkUinQGEWyW3bbXOvPO71E7xyKywBanwg2FtvzOoRFRVF7V9mLzPSqdvbM7VMQoLFob2UgeNLbVHkWeQtEqQWIV5RMu3+knhoqGYxP/3Srszp0ELRQy/xyyD",
-            "mqBEVbNnL929CUA3sjkOmPB5dL0/a0spq8LgbIsJa22SfP580XduzUIKnCtdeC9TjPB/GEPp/LvEUFaLTUgPDQQGu3H5UCZyjVTAMHl45me/0qISEf903zFFqW5Lk3TS6iPrithqMMvhdK29Eg5OhhcoHS+ALpn0EjzUe86NywuFNb6ID4o8aF/ztZlKJegnpDAm3JuhCBauJ+0gcOB8GNdWd5a06qkokmwk1tgwWat7cQGFIH1NOvBwRMKhD51MJ7V28806a3zkOVwwhOiyyTXR+EcDA/aq5acX0yailLWB82g/2GR/DiaqNtusV+gpcMTNYemEv3c/xLkClJc29DSfTsJGKsmIDMqeBMM7RRBNinNAriY9iNX1UuHZLr/tUrRNrfuNT5CvvK1K",
-            "IMcfbWZ/iCa/LDcvMlk6LEJ0gDe4ohy2Vi0pVBd9aqR5PnRj8zGit8G2rLuNUkDmQ95bMURasmaPw2Xjf6SQjRk8coIHDLtbg/YNQVMabE8pKd6EaFdsGWJkcFoonxhPR29aH0xvjC4Mp3cJX3mjqyVsOp9xdk6d0Y2hzV3W/oPCq0DV03pm7P3+jH2OzoVVIDYgG1FD12S03otJrCXuzDmE2LOQ0xwgBQ9sREBLXwQzUKfXH8ogZzjdR19pX9qe0rRKMNz8k5lqcF9R2z+XIS1QAfeV9xopXA0CeyrhtoOkXV2i8kBxyodDp7tIeOvbEfvaqZGJgaJyV8UMTDi7zjwNeVdyKa8USH7zrXSoCl+Ud5eflI9vxKS+u9Bt1ufBHJtULOCHGA2vimkU",
-            "AqC2sr44HVueGzgW13zHvJkqOEBWA8XA66ZEb3EoL1ehypSnJ07cFoWZlO8kf3k57L1fuHFWJ6quEdLXQaT9SJKHlUaYQvanvjbBlqWwaH3hODNsBGoK0DatpoQ+FxcSkdVE/ki3rbEUuJiZzU0BnDxH+Q6FiNsBaJuwau29w24MlD28ELJsjCcUVwtTQkaNtUxIlFKHLj0++T+IVrQH8KZlmVLvDefJ6llWbrFNVuh674HfKr/GEUatG6KI4gWNtGKKRYh76mMl5xH5qDfBZqxyRaKylJaDIYbx5xP5I4DDm4gOnxH+h/Pu6dq6FJ/U3eDio/KQ9xwFqTuyjH0BIRBsvWWgbTNURVBheq+am92YBhkj1QmdKTxQ9fQM55O8DpyWzRhky0NevM9j",
-            "qkFfS3WfLyj3QTQT9i/s57uOPQCTN1jrab8bwxaxyeYUlz2tEtYyKGGUufua8WzdBT2VvWTvH0JkK0LfUJ+vChvcnMFna+tEaCKCFMIOWMLYVZSJDcYMIqaIr8d0Bi2bpbVf5z4WNma0pbCKaXpkYgeg1Sb8HpKG0p0fAez7Q/QRASlvyM5vuIOH8/CM4fF5Ga6aWkTRG0lfxiyeZ2vi3q7uNmsZF490J79r/6tnPPXIIC4XGnijwho5NmhZG0XcQeyW5KnT7VmGACFdTHOb9oS5WxZZU29/oZ5Y23rBBoSDX/xZ1LNFiZk6Xfl4ih207jzogv+3nOro93JHQydNeKEwxOtbKqEe7WWJLDw/EzVdJTODrhBYKbjUce10XsavuiTvv+H1Qh4lo2Vx",
-            "O900/Gn82AjyLYqiWZ4ILXBBv/ZaXpTpQL0p9nv7gwF2MWsS2OWEImcVDa+1ElrjUumG6CVEv/rvax53krqJJDg+4Z/XcHxv58w6hNrXiWqFNjxlu5RZHvj1oQQXnS2n8qw8e/c+8ea2TiDIVr4OmgZz1G9uSPBeOZJvySqdgNPMpgfjZwkL2ez9/x31sLuQxi/FW3DFXU6kGSUjaq8g/iGXlaaAcQ0t9Gy+y005Z9wpr2JWWzishL+1JZp9D4SY/r3NHDphN4MNdLHMNBRPSIgfsaSqfLraIt+zWIycsd+nksVxtPv9wcyXy51E1qlHr6Uygz2VZYD9q9zyxEX4wRP2VEewHYUomL9d1F6gGG5fN3z82bQ4hI9uDirWhneWazUOQBRud5otPOm9",
-            "C3c+d5Q9lyTafPLdelG1TKaLFinw1TOjyI6KkrQyHKkttfnO58WFvScl1TiRcB/iHxKahskoE2+VRLUIhctuDU4sUvQh/g9Arw0LAA4QTxuLFt01XYdigurz4FT15ox2oDGGGrRb3VGjDTXK1OWVJoLMW95EVqyMc9F+Fdej85LHE+8WesIfacjUQtTG1tzYVQTfubZq0+qxXws8QrxMLFtVE38tbeXo+Ok1/U5TUa6FjWflEfvKY3XVcl8RKkXua7fVz/Blj8Gh+dWe2cOxa0lpM75ZHyz9adQrB2Pb4571E4u2xI5un0R0MFJZBQuPDc1G5rPhyk+Hb4LRG3dS0m8IASQUOskv93z978L1+Abu9CLP6d6s5p+BzWxhMUqwQXC/CCpTywrkJ0RG",
-    };
-
-    private AntiSamy as = new AntiSamy();
-    private TestPolicy policy = null;
-
-    @Before
-    public void setUp() throws Exception {
-
-        /*
-         * Load the policy. You may have to change the path to find the Policy
-         * file for your environment.
-         */
-
-        //get Policy instance from a URL.
-        URL url = getClass().getResource("/antisamy.xml");
-        policy = TestPolicy.getInstance(url);
-    }
-
-    @Test
-    public void SAX() {
-        try {
-            CleanResults cr = as.scan("<b>test</i></b>test thsidfshidf<script>sdfsdf", policy, AntiSamy.SAX);
-            assertTrue(cr != null && cr.getCleanXMLDocumentFragment() == null && cr.getCleanHTML().length() > 0);
-        } catch (ScanException | PolicyException e) {
-            e.printStackTrace();
-        }
-    }
+  private static final String[] BASE64_BAD_XML_STRINGS =
+      new String[] {
+        // first string is
+        // "<a - href=\"http://www.owasp.org\">click here</a>"
+        "PGEgLSBocmVmPSJodHRwOi8vd3d3Lm93YXNwLm9yZyI+Y2xpY2sgaGVyZTwvYT4=",
+        // the rest are randomly generated 300 byte sequences which generate
+        // parser errors, turned into Strings
+        "uz0sEy5aDiok6oufQRaYPyYOxbtlACRnfrOnUVIbOstiaoB95iw+dJYuO5sI9nudhRtSYLANlcdgO0pRb+65qKDwZ5o6GJRMWv4YajZk+7Q3W/GN295XmyWUpxuyPGVi7d5fhmtYaYNW6vxyKK1Wjn9IEhIrfvNNjtEF90vlERnz3wde4WMaKMeciqgDXuZHEApYmUcu6Wbx4Q6WcNDqohAN/qCli74tvC+Umy0ZsQGU7E+BvJJ1tLfMcSzYiz7Q15ByZOYrA2aa0wDu0no3gSatjGt6aB4h30D9xUP31LuPGZ2GdWwMfZbFcfRgDSh42JPwa1bODmt5cw0Y8ACeyrIbfk9IkX1bPpYfIgtO7TwuXjBbhh2EEixOZ2YkcsvmcOSVTvraChbxv6kP",
+        "PIWjMV4y+MpuNLtcY3vBRG4ZcNaCkB9wXJr3pghmFA6rVXAik+d5lei48TtnHvfvb5rQZVceWKv9cR/9IIsLokMyN0omkd8j3TV0DOh3JyBjPHFCu1Gp4Weo96h5C6RBoB0xsE4QdS2Y1sq/yiha9IebyHThAfnGU8AMC4AvZ7DDBccD2leZy2Q617ekz5grvxEG6tEcZ3fCbJn4leQVVo9MNoerim8KFHGloT+LxdgQR6YN5y1ii3bVGreM51S4TeANujdqJXp8B7B1Gk3PKCRS2T1SNFZedut45y+/w7wp5AUQCBUpIPUj6RLp+y3byWhcbZbJ70KOzTSZuYYIKLLo8047Fej43bIaghJm0F9yIKk3C5gtBcw8T5pciJoVXrTdBAK/8fMVo29P",
+        "uCk7HocubT6KzJw2eXpSUItZFGkr7U+D89mJw70rxdqXP2JaG04SNjx3dd84G4bz+UVPPhPO2gBAx2vHI0xhgJG9T4vffAYh2D1kenmr+8gIHt6WDNeD+HwJeAbJYhfVFMJsTuIGlYIw8+I+TARK0vqjACyRwMDAndhXnDrk4E5U3hyjqS14XX0kIDZYM6FGFPXe/s+ba2886Q8o1a7WosgqqAmt4u6R3IHOvVf5/PIeZrBJKrVptxjdjelP8Xwjq2ujWNtR3/HM1kjRlJi4xedvMRe4Rlxek0NDLC9hNd18RYi0EjzQ0bGSDDl0813yv6s6tcT6xHMzKvDcUcFRkX6BbxmoIcMsVeHM/ur6yRv834o/TT5IdiM9/wpkuICFOWIfM+Y8OWhiU6BK",
+        "Bb6Cqy6stJ0YhtPirRAQ8OXrPFKAeYHeuZXuC1qdHJRlweEzl4F2z/ZFG7hzr5NLZtzrRG3wm5TXl6Aua5G6v0WKcjJiS2V43WB8uY1BFK1d2y68c1gTRSF0u+VTThGjz+q/R6zE8HG8uchO+KPw64RehXDbPQ4uadiL+UwfZ4BzY1OHhvM5+2lVlibG+awtH6qzzx6zOWemTih932Lt9mMnm3FzEw7uGzPEYZ3aBV5xnbQ2a2N4UXIdm7RtIUiYFzHcLe5PZM/utJF8NdHKy0SPaKYkdXHli7g3tarzAabLZqLT4k7oemKYCn/eKRreZjqTB2E8Kc9Swf3jHDkmSvzOYE8wi1vQ3X7JtPcQ2O4muvpSa70NIE+XK1CgnnsL79Qzci1/1xgkBlNq",
+        "FZNVr4nOICD1cNfAvQwZvZWi+P4I2Gubzrt+wK+7gLEY144BosgKeK7snwlA/vJjPAnkFW72APTBjY6kk4EOyoUef0MxRnZEU11vby5Ru19eixZBFB/SVXDJleLK0z3zXXE8U5Zl5RzLActHakG8Psvdt8TDscQc4MPZ1K7mXDhi7FQdpjRTwVxFyCFoybQ9WNJNGPsAkkm84NtFb4KjGpwVC70oq87tM2gYCrNgMhBfdBl0bnQHoNBCp76RKdpq1UAY01t1ipfgt7BoaAr0eTw1S32DezjfkAz04WyPTzkdBKd3b44rX9dXEbm6szAz0SjgztRPDJKSMELjq16W2Ua8d1AHq2Dz8JlsvGzi2jICUjpFsIfRmQ/STSvOT8VsaCFhwL1zDLbn5jCr",
+        "RuiRkvYjH2FcCjNzFPT2PJWh7Q6vUbfMadMIEnw49GvzTmhk4OUFyjY13GL52JVyqdyFrnpgEOtXiTu88Cm+TiBI7JRh0jRs3VJRP3N+5GpyjKX7cJA46w8PrH3ovJo3PES7o8CSYKRa3eUs7BnFt7kUCvMqBBqIhTIKlnQd2JkMNnhhCcYdPygLx7E1Vg+H3KybcETsYWBeUVrhRl/RAyYJkn6LddjPuWkDdgIcnKhNvpQu4MMqF3YbzHgyTh7bdWjy1liZle7xR/uRbOrRIRKTxkUinQGEWyW3bbXOvPO71E7xyKywBanwg2FtvzOoRFRVF7V9mLzPSqdvbM7VMQoLFob2UgeNLbVHkWeQtEqQWIV5RMu3+knhoqGYxP/3Srszp0ELRQy/xyyD",
+        "mqBEVbNnL929CUA3sjkOmPB5dL0/a0spq8LgbIsJa22SfP580XduzUIKnCtdeC9TjPB/GEPp/LvEUFaLTUgPDQQGu3H5UCZyjVTAMHl45me/0qISEf903zFFqW5Lk3TS6iPrithqMMvhdK29Eg5OhhcoHS+ALpn0EjzUe86NywuFNb6ID4o8aF/ztZlKJegnpDAm3JuhCBauJ+0gcOB8GNdWd5a06qkokmwk1tgwWat7cQGFIH1NOvBwRMKhD51MJ7V28806a3zkOVwwhOiyyTXR+EcDA/aq5acX0yailLWB82g/2GR/DiaqNtusV+gpcMTNYemEv3c/xLkClJc29DSfTsJGKsmIDMqeBMM7RRBNinNAriY9iNX1UuHZLr/tUrRNrfuNT5CvvK1K",
+        "IMcfbWZ/iCa/LDcvMlk6LEJ0gDe4ohy2Vi0pVBd9aqR5PnRj8zGit8G2rLuNUkDmQ95bMURasmaPw2Xjf6SQjRk8coIHDLtbg/YNQVMabE8pKd6EaFdsGWJkcFoonxhPR29aH0xvjC4Mp3cJX3mjqyVsOp9xdk6d0Y2hzV3W/oPCq0DV03pm7P3+jH2OzoVVIDYgG1FD12S03otJrCXuzDmE2LOQ0xwgBQ9sREBLXwQzUKfXH8ogZzjdR19pX9qe0rRKMNz8k5lqcF9R2z+XIS1QAfeV9xopXA0CeyrhtoOkXV2i8kBxyodDp7tIeOvbEfvaqZGJgaJyV8UMTDi7zjwNeVdyKa8USH7zrXSoCl+Ud5eflI9vxKS+u9Bt1ufBHJtULOCHGA2vimkU",
+        "AqC2sr44HVueGzgW13zHvJkqOEBWA8XA66ZEb3EoL1ehypSnJ07cFoWZlO8kf3k57L1fuHFWJ6quEdLXQaT9SJKHlUaYQvanvjbBlqWwaH3hODNsBGoK0DatpoQ+FxcSkdVE/ki3rbEUuJiZzU0BnDxH+Q6FiNsBaJuwau29w24MlD28ELJsjCcUVwtTQkaNtUxIlFKHLj0++T+IVrQH8KZlmVLvDefJ6llWbrFNVuh674HfKr/GEUatG6KI4gWNtGKKRYh76mMl5xH5qDfBZqxyRaKylJaDIYbx5xP5I4DDm4gOnxH+h/Pu6dq6FJ/U3eDio/KQ9xwFqTuyjH0BIRBsvWWgbTNURVBheq+am92YBhkj1QmdKTxQ9fQM55O8DpyWzRhky0NevM9j",
+        "qkFfS3WfLyj3QTQT9i/s57uOPQCTN1jrab8bwxaxyeYUlz2tEtYyKGGUufua8WzdBT2VvWTvH0JkK0LfUJ+vChvcnMFna+tEaCKCFMIOWMLYVZSJDcYMIqaIr8d0Bi2bpbVf5z4WNma0pbCKaXpkYgeg1Sb8HpKG0p0fAez7Q/QRASlvyM5vuIOH8/CM4fF5Ga6aWkTRG0lfxiyeZ2vi3q7uNmsZF490J79r/6tnPPXIIC4XGnijwho5NmhZG0XcQeyW5KnT7VmGACFdTHOb9oS5WxZZU29/oZ5Y23rBBoSDX/xZ1LNFiZk6Xfl4ih207jzogv+3nOro93JHQydNeKEwxOtbKqEe7WWJLDw/EzVdJTODrhBYKbjUce10XsavuiTvv+H1Qh4lo2Vx",
+        "O900/Gn82AjyLYqiWZ4ILXBBv/ZaXpTpQL0p9nv7gwF2MWsS2OWEImcVDa+1ElrjUumG6CVEv/rvax53krqJJDg+4Z/XcHxv58w6hNrXiWqFNjxlu5RZHvj1oQQXnS2n8qw8e/c+8ea2TiDIVr4OmgZz1G9uSPBeOZJvySqdgNPMpgfjZwkL2ez9/x31sLuQxi/FW3DFXU6kGSUjaq8g/iGXlaaAcQ0t9Gy+y005Z9wpr2JWWzishL+1JZp9D4SY/r3NHDphN4MNdLHMNBRPSIgfsaSqfLraIt+zWIycsd+nksVxtPv9wcyXy51E1qlHr6Uygz2VZYD9q9zyxEX4wRP2VEewHYUomL9d1F6gGG5fN3z82bQ4hI9uDirWhneWazUOQBRud5otPOm9",
+        "C3c+d5Q9lyTafPLdelG1TKaLFinw1TOjyI6KkrQyHKkttfnO58WFvScl1TiRcB/iHxKahskoE2+VRLUIhctuDU4sUvQh/g9Arw0LAA4QTxuLFt01XYdigurz4FT15ox2oDGGGrRb3VGjDTXK1OWVJoLMW95EVqyMc9F+Fdej85LHE+8WesIfacjUQtTG1tzYVQTfubZq0+qxXws8QrxMLFtVE38tbeXo+Ok1/U5TUa6FjWflEfvKY3XVcl8RKkXua7fVz/Blj8Gh+dWe2cOxa0lpM75ZHyz9adQrB2Pb4571E4u2xI5un0R0MFJZBQuPDc1G5rPhyk+Hb4LRG3dS0m8IASQUOskv93z978L1+Abu9CLP6d6s5p+BzWxhMUqwQXC/CCpTywrkJ0RG",
+      };
+
+  private AntiSamy as = new AntiSamy();
+  private TestPolicy policy = null;
+
+  @Before
+  public void setUp() throws Exception {
 
     /*
-     * Test basic XSS cases.
+     * Load the policy. You may have to change the path to find the Policy
+     * file for your environment.
      */
 
-    @Test
-    public void scriptAttacks() throws ScanException, PolicyException {
-    	
-        assertTrue(!as.scan("test<script>alert(document.cookie)</script>", policy, AntiSamy.DOM).getCleanHTML().contains("script"));
-        assertTrue(!as.scan("test<script>alert(document.cookie)</script>", policy, AntiSamy.SAX).getCleanHTML().contains("script"));
-
-        assertTrue(!as.scan("<<<><<script src=http://fake-evil.ru/test.js>", policy, AntiSamy.DOM).getCleanHTML().contains("<script"));
-        assertTrue(!as.scan("<<<><<script src=http://fake-evil.ru/test.js>", policy, AntiSamy.SAX).getCleanHTML().contains("<script"));
-
-        assertTrue(!as.scan("<script<script src=http://fake-evil.ru/test.js>>", policy, AntiSamy.DOM).getCleanHTML().contains("<script"));
-        assertTrue(!as.scan("<script<script src=http://fake-evil.ru/test.js>>", policy, AntiSamy.SAX).getCleanHTML().contains("<script"));
-
-        assertTrue(!as.scan("<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.DOM).getCleanHTML().contains("<script"));
-        assertTrue(!as.scan("<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.SAX).getCleanHTML().contains("<script"));
-
-        assertTrue(!as.scan("<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>", policy, AntiSamy.DOM).getCleanHTML().contains("onload"));
-        assertTrue(!as.scan("<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>", policy, AntiSamy.SAX).getCleanHTML().contains("onload"));
-
-        assertTrue(!as.scan("<BODY ONLOAD=alert('XSS')>", policy, AntiSamy.DOM).getCleanHTML().contains("alert"));
-        assertTrue(!as.scan("<BODY ONLOAD=alert('XSS')>", policy, AntiSamy.SAX).getCleanHTML().contains("alert"));
-
-        assertTrue(!as.scan("<iframe src=http://ha.ckers.org/scriptlet.html <", policy, AntiSamy.DOM).getCleanHTML().contains("<iframe"));
-        assertTrue(!as.scan("<iframe src=http://ha.ckers.org/scriptlet.html <", policy, AntiSamy.SAX).getCleanHTML().contains("<iframe"));
-
-        assertTrue(!as.scan("<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">", policy, AntiSamy.DOM).getCleanHTML().contains("src"));
-        assertTrue(!as.scan("<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">", policy, AntiSamy.SAX).getCleanHTML().contains("src"));
-
-        as.scan("<a onblur=\"alert(secret)\" href=\"http://www.google.com\">Google</a>", policy, AntiSamy.DOM);
-        as.scan("<a onblur=\"alert(secret)\" href=\"http://www.google.com\">Google</a>", policy, AntiSamy.SAX);
-    }
-
-    @Test
-    public void imgAttacks() throws ScanException, PolicyException {
-
-        assertTrue(as.scan("<img src=\"http://www.myspace.com/img.gif\"/>", policy, AntiSamy.DOM).getCleanHTML().contains("<img"));
-        assertTrue(as.scan("<img src=\"http://www.myspace.com/img.gif\"/>", policy, AntiSamy.SAX).getCleanHTML().contains("<img"));
-
-        assertTrue(!as.scan("<img src=javascript:alert(document.cookie)>", policy, AntiSamy.DOM).getCleanHTML().contains("<img"));
-        assertTrue(!as.scan("<img src=javascript:alert(document.cookie)>", policy, AntiSamy.SAX).getCleanHTML().contains("<img"));
-
-        assertTrue(!as.scan("<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>", policy, AntiSamy.DOM).getCleanHTML().contains("<img"));
-        assertTrue(!as.scan("<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>", policy, AntiSamy.SAX)
-                .getCleanHTML().contains("<img"));
-
-        assertTrue(!as.scan(
-                        "<IMG SRC='&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041'>",
-                        policy, AntiSamy.DOM).getCleanHTML().contains("<img"));
-        assertTrue(!as.scan(
-                        "<IMG SRC='&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041'>",
-                        policy, AntiSamy.SAX).getCleanHTML().contains("<img"));
-
-        assertTrue(!as.scan("<IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">", policy, AntiSamy.DOM).getCleanHTML().contains("alert"));
-        assertTrue(!as.scan("<IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">", policy, AntiSamy.SAX).getCleanHTML().contains("alert"));
-
-        String s = as.scan(
-                        "<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>",
-                        policy, AntiSamy.DOM).getCleanHTML();
-        assertTrue(s.length() == 0 || s.contains("&amp;"));
-        s = as.scan( "<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>",
-                        policy, AntiSamy.SAX).getCleanHTML();
-        assertTrue(s.length() == 0 || s.contains("&amp;"));
-
-        as.scan("<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>", policy, AntiSamy.DOM);
-        as.scan("<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>", policy, AntiSamy.SAX);
-
-        assertTrue(!as.scan("<IMG SRC=\"javascript:alert('XSS')\"", policy, AntiSamy.DOM).getCleanHTML().contains("javascript"));
-        assertTrue(!as.scan("<IMG SRC=\"javascript:alert('XSS')\"", policy, AntiSamy.SAX).getCleanHTML().contains("javascript"));
-
-        assertTrue(!as.scan("<IMG LOWSRC=\"javascript:alert('XSS')\">", policy, AntiSamy.DOM).getCleanHTML().contains("javascript"));
-        assertTrue(!as.scan("<IMG LOWSRC=\"javascript:alert('XSS')\">", policy, AntiSamy.SAX).getCleanHTML().contains("javascript"));
-
-        assertTrue(!as.scan("<BGSOUND SRC=\"javascript:alert('XSS');\">", policy, AntiSamy.DOM).getCleanHTML().contains("javascript"));
-        assertTrue(!as.scan("<BGSOUND SRC=\"javascript:alert('XSS');\">", policy, AntiSamy.SAX).getCleanHTML().contains("javascript"));
-    }
-
-    @Test
-    public void hrefAttacks() throws ScanException, PolicyException {
-
-        assertTrue(!as.scan("<LINK REL=\"stylesheet\" HREF=\"javascript:alert('XSS');\">", policy, AntiSamy.DOM).getCleanHTML().contains("href"));
-        assertTrue(!as.scan("<LINK REL=\"stylesheet\" HREF=\"javascript:alert('XSS');\">", policy, AntiSamy.SAX).getCleanHTML().contains("href"));
-
-        assertTrue(!as.scan("<LINK REL=\"stylesheet\" HREF=\"http://ha.ckers.org/xss.css\">", policy, AntiSamy.DOM).getCleanHTML().contains("href"));
-        assertTrue(!as.scan("<LINK REL=\"stylesheet\" HREF=\"http://ha.ckers.org/xss.css\">", policy, AntiSamy.SAX).getCleanHTML().contains("href"));
-
-        assertTrue(!as.scan("<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>", policy, AntiSamy.DOM).getCleanHTML().contains("ha.ckers.org"));
-        assertTrue(!as.scan("<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>", policy, AntiSamy.SAX).getCleanHTML().contains("ha.ckers.org"));
-
-        assertTrue(!as.scan("<STYLE>BODY{-moz-binding:url(\"http://ha.ckers.org/xssmoz.xml#xss\")}</STYLE>", policy, AntiSamy.DOM).getCleanHTML().contains("ha.ckers.org"));
-        assertTrue(!as.scan("<STYLE>BODY{-moz-binding:url(\"http://ha.ckers.org/xssmoz.xml#xss\")}</STYLE>", policy, AntiSamy.SAX).getCleanHTML().contains("ha.ckers.org"));
-
-        assertTrue(!as.scan("<STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS", policy, AntiSamy.DOM).getCleanHTML().contains("javascript"));
-        assertTrue(!as.scan("<STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS", policy, AntiSamy.SAX).getCleanHTML().contains("javascript"));
-
-        assertTrue(!as.scan("<IMG SRC='vbscript:msgbox(\"XSS\")'>", policy, AntiSamy.DOM).getCleanHTML().contains("vbscript"));
-        assertTrue(!as.scan("<IMG SRC='vbscript:msgbox(\"XSS\")'>", policy, AntiSamy.SAX).getCleanHTML().contains("vbscript"));
-
-        assertTrue(!as.scan("<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">", policy, AntiSamy.DOM).getCleanHTML().contains("<meta"));
-        assertTrue(!as.scan("<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">", policy, AntiSamy.SAX).getCleanHTML().contains("<meta"));
-
-        assertTrue(!as.scan("<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">", policy, AntiSamy.DOM).getCleanHTML().contains("<meta"));
-        assertTrue(!as.scan("<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">", policy, AntiSamy.SAX).getCleanHTML().contains("<meta"));
-
-        assertTrue(!as.scan("<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\">", policy, AntiSamy.DOM).getCleanHTML().contains("<meta"));
-        assertTrue(!as.scan("<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\">", policy, AntiSamy.SAX).getCleanHTML().contains("<meta"));
-
-        assertTrue(!as.scan("<IFRAME SRC=\"javascript:alert('XSS');\"></IFRAME>", policy, AntiSamy.DOM).getCleanHTML().contains("iframe"));
-        assertTrue(!as.scan("<IFRAME SRC=\"javascript:alert('XSS');\"></IFRAME>", policy, AntiSamy.SAX).getCleanHTML().contains("iframe"));
-
-        assertTrue(!as.scan("<FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>", policy, AntiSamy.DOM).getCleanHTML().contains("javascript"));
-        assertTrue(!as.scan("<FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>", policy, AntiSamy.SAX).getCleanHTML().contains("javascript"));
-
-        assertTrue(!as.scan("<TABLE BACKGROUND=\"javascript:alert('XSS')\">", policy, AntiSamy.DOM).getCleanHTML().contains("background"));
-        assertTrue(!as.scan("<TABLE BACKGROUND=\"javascript:alert('XSS')\">", policy, AntiSamy.SAX).getCleanHTML().contains("background"));
-
-        assertTrue(!as.scan("<TABLE><TD BACKGROUND=\"javascript:alert('XSS')\">", policy, AntiSamy.DOM).getCleanHTML().contains("background"));
-        assertTrue(!as.scan("<TABLE><TD BACKGROUND=\"javascript:alert('XSS')\">", policy, AntiSamy.SAX).getCleanHTML().contains("background"));
-
-        assertTrue(!as.scan("<DIV STYLE=\"background-image: url(javascript:alert('XSS'))\">", policy, AntiSamy.DOM).getCleanHTML().contains("javascript"));
-        assertTrue(!as.scan("<DIV STYLE=\"background-image: url(javascript:alert('XSS'))\">", policy, AntiSamy.SAX).getCleanHTML().contains("javascript"));
-
-        assertTrue(!as.scan("<DIV STYLE=\"width: expression(alert('XSS'));\">", policy, AntiSamy.DOM).getCleanHTML().contains("alert"));
-        assertTrue(!as.scan("<DIV STYLE=\"width: expression(alert('XSS'));\">", policy, AntiSamy.SAX).getCleanHTML().contains("alert"));
-
-        assertTrue(!as.scan("<IMG STYLE=\"xss:expr/*XSS*/ession(alert('XSS'))\">", policy, AntiSamy.DOM).getCleanHTML().contains("alert"));
-        assertTrue(!as.scan("<IMG STYLE=\"xss:expr/*XSS*/ession(alert('XSS'))\">", policy, AntiSamy.SAX).getCleanHTML().contains("alert"));
-
-        assertTrue(!as.scan("<STYLE>@im\\port'\\ja\\vasc\\ript:alert(\"XSS\")';</STYLE>", policy, AntiSamy.DOM).getCleanHTML().contains("ript:alert"));
-        assertTrue(!as.scan("<STYLE>@im\\port'\\ja\\vasc\\ript:alert(\"XSS\")';</STYLE>", policy, AntiSamy.SAX).getCleanHTML().contains("ript:alert"));
-
-        assertTrue(!as.scan("<BASE HREF=\"javascript:alert('XSS');//\">", policy, AntiSamy.DOM).getCleanHTML().contains("javascript"));
-        assertTrue(!as.scan("<BASE HREF=\"javascript:alert('XSS');//\">", policy, AntiSamy.SAX).getCleanHTML().contains("javascript"));
-
-        assertTrue(!as.scan("<BaSe hReF=\"http://arbitrary.com/\">", policy, AntiSamy.DOM).getCleanHTML().contains("<base"));
-        assertTrue(!as.scan("<BaSe hReF=\"http://arbitrary.com/\">", policy, AntiSamy.SAX).getCleanHTML().contains("<base"));
-
-        assertTrue(!as.scan("<OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http://ha.ckers.org/scriptlet.html\"></OBJECT>", policy, AntiSamy.DOM).getCleanHTML().contains("<object"));
-        assertTrue(!as.scan("<OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http://ha.ckers.org/scriptlet.html\"></OBJECT>", policy, AntiSamy.SAX).getCleanHTML().contains("<object"));
-
-        assertTrue(!as.scan("<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>", policy, AntiSamy.DOM).getCleanHTML().contains("javascript"));
-
-        CleanResults cr = as.scan("<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>", policy, AntiSamy.SAX);
-        // System.out.println(cr.getErrorMessages().get(0));
-        assertTrue(!cr.getCleanHTML().contains("javascript"));
-
-        assertTrue(!as.scan("<EMBED SRC=\"http://ha.ckers.org/xss.swf\" AllowScriptAccess=\"always\"></EMBED>", policy, AntiSamy.DOM).getCleanHTML().contains("<embed"));
-        assertTrue(!as.scan("<EMBED SRC=\"http://ha.ckers.org/xss.swf\" AllowScriptAccess=\"always\"></EMBED>", policy, AntiSamy.SAX).getCleanHTML().contains("<embed"));
-
-        assertTrue(!as.scan(
-                        "<EMBED SRC=\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"></EMBED>",
-                        policy, AntiSamy.DOM).getCleanHTML().contains("<embed"));
-        assertTrue(!as.scan(
-                        "<EMBED SRC=\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"></EMBED>",
-                        policy, AntiSamy.SAX).getCleanHTML().contains("<embed"));
-
-        assertTrue(!as.scan("<SCRIPT a=\">\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.DOM).getCleanHTML().contains("<script"));
-        assertTrue(!as.scan("<SCRIPT a=\">\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.SAX).getCleanHTML().contains("<script"));
-
-        assertTrue(!as.scan("<SCRIPT a=\">\" '' SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.DOM).getCleanHTML().contains("<script"));
-        assertTrue(!as.scan("<SCRIPT a=\">\" '' SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.SAX).getCleanHTML().contains("<script"));
-
-        assertTrue(!as.scan("<SCRIPT a=`>` SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.DOM).getCleanHTML().contains("<script"));
-        assertTrue(!as.scan("<SCRIPT a=`>` SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.SAX).getCleanHTML().contains("<script"));
-
-        assertTrue(!as.scan("<SCRIPT a=\">'>\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.DOM).getCleanHTML().contains("<script"));
-        assertTrue(!as.scan("<SCRIPT a=\">'>\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.SAX).getCleanHTML().contains("<script"));
-
-        assertTrue(!as.scan("<SCRIPT>document.write(\"<SCRI\");</SCRIPT>PT SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.DOM).getCleanHTML().contains("script"));
-        assertTrue(!as.scan("<SCRIPT>document.write(\"<SCRI\");</SCRIPT>PT SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.SAX).getCleanHTML().contains("script"));
-
-        assertTrue(!as.scan("<SCRIPT SRC=http://ha.ckers.org/xss.js", policy, AntiSamy.DOM).getCleanHTML().contains("<script"));
-        assertTrue(!as.scan("<SCRIPT SRC=http://ha.ckers.org/xss.js", policy, AntiSamy.SAX).getCleanHTML().contains("<script"));
-
-        assertTrue(!as.scan(
-                        "<div/style=&#92&#45&#92&#109&#111&#92&#122&#92&#45&#98&#92&#105&#92&#110&#100&#92&#105&#110&#92&#103:&#92&#117&#114&#108&#40&#47&#47&#98&#117&#115&#105&#110&#101&#115&#115&#92&#105&#92&#110&#102&#111&#46&#99&#111&#46&#117&#107&#92&#47&#108&#97&#98&#115&#92&#47&#120&#98&#108&#92&#47&#120&#98&#108&#92&#46&#120&#109&#108&#92&#35&#120&#115&#115&#41&>",
-                        policy, AntiSamy.DOM).getCleanHTML().contains("style"));
-        assertTrue(!as.scan(
-                        "<div/style=&#92&#45&#92&#109&#111&#92&#122&#92&#45&#98&#92&#105&#92&#110&#100&#92&#105&#110&#92&#103:&#92&#117&#114&#108&#40&#47&#47&#98&#117&#115&#105&#110&#101&#115&#115&#92&#105&#92&#110&#102&#111&#46&#99&#111&#46&#117&#107&#92&#47&#108&#97&#98&#115&#92&#47&#120&#98&#108&#92&#47&#120&#98&#108&#92&#46&#120&#109&#108&#92&#35&#120&#115&#115&#41&>",
-                        policy, AntiSamy.SAX).getCleanHTML().contains("style"));
-
-        assertTrue(!as.scan("<a href='aim: &c:\\windows\\system32\\calc.exe' ini='C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\pwnd.bat'>", policy, AntiSamy.DOM).getCleanHTML().contains("aim.exe"));
-        assertTrue(!as.scan("<a href='aim: &c:\\windows\\system32\\calc.exe' ini='C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\pwnd.bat'>", policy, AntiSamy.SAX)
-                .getCleanHTML().contains("aim.exe"));
-
-        assertTrue(!as.scan("<!--\n<A href=\n- --><a href=javascript:alert:document.domain>test-->", policy, AntiSamy.DOM).getCleanHTML().contains("javascript"));
-        assertTrue(!as.scan("<!--\n<A href=\n- --><a href=javascript:alert:document.domain>test-->", policy, AntiSamy.SAX).getCleanHTML().contains("javascript"));
-
-        assertTrue(!as.scan("<a></a style=\"\"xx:expr/**/ession(document.appendChild(document.createElement('script')).src='http://h4k.in/i.js')\">", policy, AntiSamy.DOM).getCleanHTML().contains("document"));
-        assertTrue(!as.scan("<a></a style=\"\"xx:expr/**/ession(document.appendChild(document.createElement('script')).src='http://h4k.in/i.js')\">", policy, AntiSamy.SAX).getCleanHTML().contains("document"));
-    }
-
+    // get Policy instance from a URL.
+    URL url = getClass().getResource("/antisamy.xml");
+    policy = TestPolicy.getInstance(url);
+  }
+
+  @Test
+  public void SAX() {
+    try {
+      CleanResults cr =
+          as.scan("<b>test</i></b>test thsidfshidf<script>sdfsdf", policy, AntiSamy.SAX);
+      assertTrue(
+          cr != null && cr.getCleanXMLDocumentFragment() == null && cr.getCleanHTML().length() > 0);
+    } catch (ScanException | PolicyException e) {
+      e.printStackTrace();
+    }
+  }
+
+  /*
+   * Test basic XSS cases.
+   */
+
+  @Test
+  public void scriptAttacks() throws ScanException, PolicyException {
+
+    assertTrue(
+        !as.scan("test<script>alert(document.cookie)</script>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("script"));
+    assertTrue(
+        !as.scan("test<script>alert(document.cookie)</script>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("script"));
+
+    assertTrue(
+        !as.scan("<<<><<script src=http://fake-evil.ru/test.js>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<script"));
+    assertTrue(
+        !as.scan("<<<><<script src=http://fake-evil.ru/test.js>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<script"));
+
+    assertTrue(
+        !as.scan("<script<script src=http://fake-evil.ru/test.js>>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<script"));
+    assertTrue(
+        !as.scan("<script<script src=http://fake-evil.ru/test.js>>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<script"));
+
+    assertTrue(
+        !as.scan("<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<script"));
+    assertTrue(
+        !as.scan("<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<script"));
+
+    assertTrue(
+        !as.scan("<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("onload"));
+    assertTrue(
+        !as.scan("<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("onload"));
+
+    assertTrue(
+        !as.scan("<BODY ONLOAD=alert('XSS')>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("alert"));
+    assertTrue(
+        !as.scan("<BODY ONLOAD=alert('XSS')>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("alert"));
+
+    assertTrue(
+        !as.scan("<iframe src=http://ha.ckers.org/scriptlet.html <", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<iframe"));
+    assertTrue(
+        !as.scan("<iframe src=http://ha.ckers.org/scriptlet.html <", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<iframe"));
+
+    assertTrue(
+        !as.scan("<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("src"));
+    assertTrue(
+        !as.scan("<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("src"));
+
+    as.scan(
+        "<a onblur=\"alert(secret)\" href=\"http://www.google.com\">Google</a>",
+        policy,
+        AntiSamy.DOM);
+    as.scan(
+        "<a onblur=\"alert(secret)\" href=\"http://www.google.com\">Google</a>",
+        policy,
+        AntiSamy.SAX);
+  }
+
+  @Test
+  public void imgAttacks() throws ScanException, PolicyException {
+
+    assertTrue(
+        as.scan("<img src=\"http://www.myspace.com/img.gif\"/>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<img"));
+    assertTrue(
+        as.scan("<img src=\"http://www.myspace.com/img.gif\"/>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<img"));
+
+    assertTrue(
+        !as.scan("<img src=javascript:alert(document.cookie)>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<img"));
+    assertTrue(
+        !as.scan("<img src=javascript:alert(document.cookie)>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<img"));
+
+    assertTrue(
+        !as.scan(
+                "<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<img"));
+    assertTrue(
+        !as.scan(
+                "<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<img"));
+
+    assertTrue(
+        !as.scan(
+                "<IMG SRC='&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041'>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<img"));
+    assertTrue(
+        !as.scan(
+                "<IMG SRC='&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041'>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<img"));
+
+    assertTrue(
+        !as.scan("<IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("alert"));
+    assertTrue(
+        !as.scan("<IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("alert"));
+
+    String s =
+        as.scan(
+                "<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML();
+    assertTrue(s.length() == 0 || s.contains("&amp;"));
+    s =
+        as.scan(
+                "<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML();
+    assertTrue(s.length() == 0 || s.contains("&amp;"));
+
+    as.scan(
+        "<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>",
+        policy,
+        AntiSamy.DOM);
+    as.scan(
+        "<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>",
+        policy,
+        AntiSamy.SAX);
+
+    assertTrue(
+        !as.scan("<IMG SRC=\"javascript:alert('XSS')\"", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("javascript"));
+    assertTrue(
+        !as.scan("<IMG SRC=\"javascript:alert('XSS')\"", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("javascript"));
+
+    assertTrue(
+        !as.scan("<IMG LOWSRC=\"javascript:alert('XSS')\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("javascript"));
+    assertTrue(
+        !as.scan("<IMG LOWSRC=\"javascript:alert('XSS')\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("javascript"));
+
+    assertTrue(
+        !as.scan("<BGSOUND SRC=\"javascript:alert('XSS');\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("javascript"));
+    assertTrue(
+        !as.scan("<BGSOUND SRC=\"javascript:alert('XSS');\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("javascript"));
+  }
+
+  @Test
+  public void hrefAttacks() throws ScanException, PolicyException {
+
+    assertTrue(
+        !as.scan(
+                "<LINK REL=\"stylesheet\" HREF=\"javascript:alert('XSS');\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("href"));
+    assertTrue(
+        !as.scan(
+                "<LINK REL=\"stylesheet\" HREF=\"javascript:alert('XSS');\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("href"));
+
+    assertTrue(
+        !as.scan(
+                "<LINK REL=\"stylesheet\" HREF=\"http://ha.ckers.org/xss.css\">",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("href"));
+    assertTrue(
+        !as.scan(
+                "<LINK REL=\"stylesheet\" HREF=\"http://ha.ckers.org/xss.css\">",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("href"));
+
+    assertTrue(
+        !as.scan("<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("ha.ckers.org"));
+    assertTrue(
+        !as.scan("<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("ha.ckers.org"));
+
+    assertTrue(
+        !as.scan(
+                "<STYLE>BODY{-moz-binding:url(\"http://ha.ckers.org/xssmoz.xml#xss\")}</STYLE>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("ha.ckers.org"));
+    assertTrue(
+        !as.scan(
+                "<STYLE>BODY{-moz-binding:url(\"http://ha.ckers.org/xssmoz.xml#xss\")}</STYLE>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("ha.ckers.org"));
+
+    assertTrue(
+        !as.scan(
+                "<STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("javascript"));
+    assertTrue(
+        !as.scan(
+                "<STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("javascript"));
+
+    assertTrue(
+        !as.scan("<IMG SRC='vbscript:msgbox(\"XSS\")'>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("vbscript"));
+    assertTrue(
+        !as.scan("<IMG SRC='vbscript:msgbox(\"XSS\")'>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("vbscript"));
+
+    assertTrue(
+        !as.scan(
+                "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<meta"));
+    assertTrue(
+        !as.scan(
+                "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<meta"));
+
+    assertTrue(
+        !as.scan(
+                "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<meta"));
+    assertTrue(
+        !as.scan(
+                "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<meta"));
+
+    assertTrue(
+        !as.scan(
+                "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\">",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<meta"));
+    assertTrue(
+        !as.scan(
+                "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\">",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<meta"));
+
+    assertTrue(
+        !as.scan("<IFRAME SRC=\"javascript:alert('XSS');\"></IFRAME>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("iframe"));
+    assertTrue(
+        !as.scan("<IFRAME SRC=\"javascript:alert('XSS');\"></IFRAME>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("iframe"));
+
+    assertTrue(
+        !as.scan(
+                "<FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("javascript"));
+    assertTrue(
+        !as.scan(
+                "<FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("javascript"));
+
+    assertTrue(
+        !as.scan("<TABLE BACKGROUND=\"javascript:alert('XSS')\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("background"));
+    assertTrue(
+        !as.scan("<TABLE BACKGROUND=\"javascript:alert('XSS')\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("background"));
+
+    assertTrue(
+        !as.scan("<TABLE><TD BACKGROUND=\"javascript:alert('XSS')\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("background"));
+    assertTrue(
+        !as.scan("<TABLE><TD BACKGROUND=\"javascript:alert('XSS')\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("background"));
+
+    assertTrue(
+        !as.scan(
+                "<DIV STYLE=\"background-image: url(javascript:alert('XSS'))\">",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("javascript"));
+    assertTrue(
+        !as.scan(
+                "<DIV STYLE=\"background-image: url(javascript:alert('XSS'))\">",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("javascript"));
+
+    assertTrue(
+        !as.scan("<DIV STYLE=\"width: expression(alert('XSS'));\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("alert"));
+    assertTrue(
+        !as.scan("<DIV STYLE=\"width: expression(alert('XSS'));\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("alert"));
+
+    assertTrue(
+        !as.scan("<IMG STYLE=\"xss:expr/*XSS*/ession(alert('XSS'))\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("alert"));
+    assertTrue(
+        !as.scan("<IMG STYLE=\"xss:expr/*XSS*/ession(alert('XSS'))\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("alert"));
+
+    assertTrue(
+        !as.scan("<STYLE>@im\\port'\\ja\\vasc\\ript:alert(\"XSS\")';</STYLE>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("ript:alert"));
+    assertTrue(
+        !as.scan("<STYLE>@im\\port'\\ja\\vasc\\ript:alert(\"XSS\")';</STYLE>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("ript:alert"));
+
+    assertTrue(
+        !as.scan("<BASE HREF=\"javascript:alert('XSS');//\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("javascript"));
+    assertTrue(
+        !as.scan("<BASE HREF=\"javascript:alert('XSS');//\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("javascript"));
+
+    assertTrue(
+        !as.scan("<BaSe hReF=\"http://arbitrary.com/\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<base"));
+    assertTrue(
+        !as.scan("<BaSe hReF=\"http://arbitrary.com/\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<base"));
+
+    assertTrue(
+        !as.scan(
+                "<OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http://ha.ckers.org/scriptlet.html\"></OBJECT>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<object"));
+    assertTrue(
+        !as.scan(
+                "<OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http://ha.ckers.org/scriptlet.html\"></OBJECT>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<object"));
+
+    assertTrue(
+        !as.scan(
+                "<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("javascript"));
+
+    CleanResults cr =
+        as.scan(
+            "<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>",
+            policy,
+            AntiSamy.SAX);
+    // System.out.println(cr.getErrorMessages().get(0));
+    assertTrue(!cr.getCleanHTML().contains("javascript"));
+
+    assertTrue(
+        !as.scan(
+                "<EMBED SRC=\"http://ha.ckers.org/xss.swf\" AllowScriptAccess=\"always\"></EMBED>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<embed"));
+    assertTrue(
+        !as.scan(
+                "<EMBED SRC=\"http://ha.ckers.org/xss.swf\" AllowScriptAccess=\"always\"></EMBED>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<embed"));
+
+    assertTrue(
+        !as.scan(
+                "<EMBED SRC=\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"></EMBED>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<embed"));
+    assertTrue(
+        !as.scan(
+                "<EMBED SRC=\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"></EMBED>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<embed"));
+
+    assertTrue(
+        !as.scan(
+                "<SCRIPT a=\">\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<script"));
+    assertTrue(
+        !as.scan(
+                "<SCRIPT a=\">\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<script"));
+
+    assertTrue(
+        !as.scan(
+                "<SCRIPT a=\">\" '' SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<script"));
+    assertTrue(
+        !as.scan(
+                "<SCRIPT a=\">\" '' SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<script"));
+
+    assertTrue(
+        !as.scan("<SCRIPT a=`>` SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<script"));
+    assertTrue(
+        !as.scan("<SCRIPT a=`>` SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<script"));
+
+    assertTrue(
+        !as.scan(
+                "<SCRIPT a=\">'>\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<script"));
+    assertTrue(
+        !as.scan(
+                "<SCRIPT a=\">'>\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<script"));
+
+    assertTrue(
+        !as.scan(
+                "<SCRIPT>document.write(\"<SCRI\");</SCRIPT>PT SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("script"));
+    assertTrue(
+        !as.scan(
+                "<SCRIPT>document.write(\"<SCRI\");</SCRIPT>PT SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("script"));
+
+    assertTrue(
+        !as.scan("<SCRIPT SRC=http://ha.ckers.org/xss.js", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<script"));
+    assertTrue(
+        !as.scan("<SCRIPT SRC=http://ha.ckers.org/xss.js", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<script"));
+
+    assertTrue(
+        !as.scan(
+                "<div/style=&#92&#45&#92&#109&#111&#92&#122&#92&#45&#98&#92&#105&#92&#110&#100&#92&#105&#110&#92&#103:&#92&#117&#114&#108&#40&#47&#47&#98&#117&#115&#105&#110&#101&#115&#115&#92&#105&#92&#110&#102&#111&#46&#99&#111&#46&#117&#107&#92&#47&#108&#97&#98&#115&#92&#47&#120&#98&#108&#92&#47&#120&#98&#108&#92&#46&#120&#109&#108&#92&#35&#120&#115&#115&#41&>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("style"));
+    assertTrue(
+        !as.scan(
+                "<div/style=&#92&#45&#92&#109&#111&#92&#122&#92&#45&#98&#92&#105&#92&#110&#100&#92&#105&#110&#92&#103:&#92&#117&#114&#108&#40&#47&#47&#98&#117&#115&#105&#110&#101&#115&#115&#92&#105&#92&#110&#102&#111&#46&#99&#111&#46&#117&#107&#92&#47&#108&#97&#98&#115&#92&#47&#120&#98&#108&#92&#47&#120&#98&#108&#92&#46&#120&#109&#108&#92&#35&#120&#115&#115&#41&>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("style"));
+
+    assertTrue(
+        !as.scan(
+                "<a href='aim: &c:\\windows\\system32\\calc.exe' ini='C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\pwnd.bat'>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("aim.exe"));
+    assertTrue(
+        !as.scan(
+                "<a href='aim: &c:\\windows\\system32\\calc.exe' ini='C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\pwnd.bat'>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("aim.exe"));
+
+    assertTrue(
+        !as.scan(
+                "<!--\n<A href=\n- --><a href=javascript:alert:document.domain>test-->",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("javascript"));
+    assertTrue(
+        !as.scan(
+                "<!--\n<A href=\n- --><a href=javascript:alert:document.domain>test-->",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("javascript"));
+
+    assertTrue(
+        !as.scan(
+                "<a></a style=\"\"xx:expr/**/ession(document.appendChild(document.createElement('script')).src='http://h4k.in/i.js')\">",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("document"));
+    assertTrue(
+        !as.scan(
+                "<a></a style=\"\"xx:expr/**/ession(document.appendChild(document.createElement('script')).src='http://h4k.in/i.js')\">",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("document"));
+  }
+
+  /*
+   * Test CSS protections.
+   */
+
+  @Test
+  public void cssAttacks() throws ScanException, PolicyException {
+
+    assertTrue(
+        !as.scan("<div style=\"position:absolute\">", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("position"));
+    assertTrue(
+        !as.scan("<div style=\"position:absolute\">", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("position"));
+
+    assertTrue(
+        !as.scan("<style>b { position:absolute }</style>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("position"));
+    assertTrue(
+        !as.scan("<style>b { position:absolute }</style>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("position"));
+
+    assertTrue(
+        !as.scan("<div style=\"z-index:25\">test</div>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("z-index"));
+    assertTrue(
+        !as.scan("<div style=\"z-index:25\">test</div>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("z-index"));
+
+    assertTrue(
+        !as.scan("<style>z-index:25</style>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("z-index"));
+    assertTrue(
+        !as.scan("<style>z-index:25</style>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("z-index"));
+  }
+
+  /*
+   * Test a bunch of strings that have tweaked the XML parsing capabilities of
+   * NekoHTML.
+   */
+  @Test
+  public void IllegalXML() throws PolicyException {
+
+    for (String BASE64_BAD_XML_STRING : BASE64_BAD_XML_STRINGS) {
+
+      try {
+        String testStr = new String(Base64.decodeBase64(BASE64_BAD_XML_STRING.getBytes()));
+        as.scan(testStr, policy, AntiSamy.DOM);
+        as.scan(testStr, policy, AntiSamy.SAX);
+
+      } catch (ScanException ex) {
+        // still success!
+      }
+    }
+
+    // This fails due to a bug in NekoHTML
+    // try {
+    // assertTrue (
+    // as.scan("<a . href=\"http://www.test.com\">",policy,
+    // AntiSamy.DOM).getCleanHTML().indexOf("href")
+    // != -1 );
+    // } catch (Exception e) {
+    // e.printStackTrace();
+    // fail("Couldn't parse malformed HTML: " + e.getMessage());
+    // }
+
+    // This fails due to a bug in NekoHTML
+    // try {
+    // assertTrue (
+    // as.scan("<a - href=\"http://www.test.com\">",policy,
+    // AntiSamy.DOM).getCleanHTML().indexOf("href")
+    // != -1 );
+    // } catch (Exception e) {
+    // e.printStackTrace();
+    // fail("Couldn't parse malformed HTML: " + e.getMessage());
+    // }
+
+    try {
+      assertTrue(as.scan("<style>", policy, AntiSamy.DOM) != null);
+    } catch (Exception e) {
+      e.printStackTrace();
+      fail("Couldn't parse malformed HTML: " + e.getMessage());
+    }
+  }
+
+  @Test
+  public void issue12() throws ScanException, PolicyException {
     /*
-     * Test CSS protections.
+     * issues 12 (and 36, which was similar). empty tags cause display
+     * problems/"formjacking"
      */
 
-    @Test
-    public void cssAttacks() throws ScanException, PolicyException {
-
-        assertTrue(!as.scan("<div style=\"position:absolute\">", policy, AntiSamy.DOM).getCleanHTML().contains("position"));
-        assertTrue(!as.scan("<div style=\"position:absolute\">", policy, AntiSamy.SAX).getCleanHTML().contains("position"));
-
-        assertTrue(!as.scan("<style>b { position:absolute }</style>", policy, AntiSamy.DOM).getCleanHTML().contains("position"));
-        assertTrue(!as.scan("<style>b { position:absolute }</style>", policy, AntiSamy.SAX).getCleanHTML().contains("position"));
-
-        assertTrue(!as.scan("<div style=\"z-index:25\">test</div>", policy, AntiSamy.DOM).getCleanHTML().contains("z-index"));
-        assertTrue(!as.scan("<div style=\"z-index:25\">test</div>", policy, AntiSamy.SAX).getCleanHTML().contains("z-index"));
-
-        assertTrue(!as.scan("<style>z-index:25</style>", policy, AntiSamy.DOM).getCleanHTML().contains("z-index"));
-        assertTrue(!as.scan("<style>z-index:25</style>", policy, AntiSamy.SAX).getCleanHTML().contains("z-index"));
-    }
+    Pattern p = Pattern.compile(".*<strong(\\s*)/>.*");
+    String s1 =
+        as.scan("<br ><strong></strong><a>hello world</a><b /><i/><hr>", policy, AntiSamy.DOM)
+            .getCleanHTML();
+    String s2 =
+        as.scan("<br ><strong></strong><a>hello world</a><b /><i/><hr>", policy, AntiSamy.SAX)
+            .getCleanHTML();
+
+    assertFalse(p.matcher(s1).matches());
+
+    p = Pattern.compile(".*<b(\\s*)/>.*");
+    assertFalse(p.matcher(s1).matches());
+    assertFalse(p.matcher(s2).matches());
+
+    p = Pattern.compile(".*<i(\\s*)/>.*");
+    assertFalse(p.matcher(s1).matches());
+    assertFalse(p.matcher(s2).matches());
+
+    assertThat(s1, containsString("<hr>"));
+    assertThat(s2, containsString("<hr>"));
+  }
+
+  @Test
+  public void issue20() throws ScanException, PolicyException {
+    String s = as.scan("<b><i>Some Text</b></i>", policy, AntiSamy.DOM).getCleanHTML();
+    assertTrue(!s.contains("<i />"));
+
+    s = as.scan("<b><i>Some Text</b></i>", policy, AntiSamy.SAX).getCleanHTML();
+    assertTrue(!s.contains("<i />"));
+  }
+
+  @Test
+  public void issue25() throws ScanException, PolicyException {
+    String s = "<div style=\"margin: -5em\">Test</div>";
+    String expected = "<div style=\"\">Test</div>";
+
+    String crDom = as.scan(s, policy, AntiSamy.DOM).getCleanHTML();
+    assertEquals(crDom, expected);
+    String crSax = as.scan(s, policy, AntiSamy.SAX).getCleanHTML();
+    assertEquals(crSax, expected);
+  }
+
+  @Test
+  public void issue28() throws ScanException, PolicyException {
+    String s1 =
+        as.scan(
+                "<div style=\"font-family: Geneva, Arial, courier new, sans-serif\">Test</div>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML();
+    String s2 =
+        as.scan(
+                "<div style=\"font-family: Geneva, Arial, courier new, sans-serif\">Test</div>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML();
+    assertTrue(s1.contains("font-family"));
+    assertTrue(s2.contains("font-family"));
+  }
+
+  @Test
+  public void issue29() throws ScanException, PolicyException {
+    /* issue #29 - missing quotes around properties with spaces */
+    String s =
+        "<style type=\"text/css\"><![CDATA[P {\n	font-family: \"Arial Unicode MS\";\n}\n]]></style>";
+    CleanResults cr = as.scan(s, policy, AntiSamy.DOM);
+    assertEquals(s, cr.getCleanHTML());
+  }
+
+  @Test
+  public void issue30() throws ScanException, PolicyException {
+
+    String s = "<style type=\"text/css\"><![CDATA[P { margin-bottom: 0.08in; } ]]></style>";
+
+    as.scan(s, policy, AntiSamy.DOM);
+    CleanResults cr;
+
+    /* followup - does the patch fix multiline CSS? */
+    String s2 =
+        "<style type=\"text/css\"><![CDATA[\r\nP {\r\n margin-bottom: 0.08in;\r\n}\r\n]]></style>";
+    cr = as.scan(s2, policy, AntiSamy.DOM);
+    assertEquals(
+        "<style type=\"text/css\"><![CDATA[P {\n\tmargin-bottom: 0.08in;\n}\n]]></style>",
+        cr.getCleanHTML());
+
+    /* next followup - does non-CDATA parsing still work? */
+
+    String s3 = "<style>P {\n\tmargin-bottom: 0.08in;\n}\n";
+    cr = as.scan(s3, policy, AntiSamy.DOM);
+    assertEquals("<style>P {\n\tmargin-bottom: 0.08in;\n}\n</style>\n", cr.getCleanHTML());
+  }
+
+  @Test
+  public void issue31() throws ScanException, PolicyException {
+
+    String test = "<b><u><g>foo</g></u></b>";
+    Policy revised = policy.cloneWithDirective("onUnknownTag", "encode");
+    CleanResults cr = as.scan(test, revised, AntiSamy.DOM);
+    String s = cr.getCleanHTML();
+    assertFalse(!s.contains("&lt;g&gt;"));
+    assertFalse(!s.contains("&lt;/g&gt;"));
+    s = as.scan(test, revised, AntiSamy.SAX).getCleanHTML();
+    assertFalse(!s.contains("&lt;g&gt;"));
+    assertFalse(!s.contains("&lt;/g&gt;"));
+
+    Tag tag = policy.getTagByLowercaseName("b").mutateAction("encode");
+    Policy policy1 = policy.mutateTag(tag);
+
+    cr = as.scan(test, policy1, AntiSamy.DOM);
+    s = cr.getCleanHTML();
+
+    assertFalse(!s.contains("&lt;b&gt;"));
+    assertFalse(!s.contains("&lt;/b&gt;"));
+
+    cr = as.scan(test, policy1, AntiSamy.SAX);
+    s = cr.getCleanHTML();
+
+    assertFalse(!s.contains("&lt;b&gt;"));
+    assertFalse(!s.contains("&lt;/b&gt;"));
+  }
+
+  @Test
+  public void issue32() throws ScanException, PolicyException {
+    /* issue #32 - nekos problem */
+    String s = "<SCRIPT =\">\" SRC=\"\"></SCRIPT>";
+    as.scan(s, policy, AntiSamy.DOM);
+    as.scan(s, policy, AntiSamy.SAX);
+  }
+
+  @Test
+  public void issue37() throws ScanException, PolicyException {
+
+    String dirty =
+        "<a onblur=\"try {parent.deselectBloggerImageGracefully();}"
+            + "catch(e) {}\""
+            + "href=\"http://www.charityadvantage.com/ChildrensmuseumEaston/images/BookswithBill.jpg\"><img"
+            + "style=\"FLOAT: right; MARGIN: 0px 0px 10px 10px; WIDTH: 150px; CURSOR:"
+            + "hand; HEIGHT: 100px\" alt=\"\""
+            + "src=\"http://www.charityadvantage.com/ChildrensmuseumEaston/images/BookswithBill.jpg\""
+            + "border=\"0\" /></a><br />Poor Bill, couldn't make it to the Museum's <span"
+            + "class=\"blsp-spelling-corrected\" id=\"SPELLING_ERROR_0\">story time</span>"
+            + "today, he was so busy shoveling! Well, we sure missed you Bill! So since"
+            + "ou were busy moving snow we read books about snow. We found a clue in one"
+            + "book which revealed a snowplow at the end of the story - we wish it had"
+            + "driven to your driveway Bill. We also read a story which shared fourteen"
+            + "<em>Names For Snow. </em>We'll catch up with you next week....wonder which"
+            + "hat Bill will wear?<br />Jane";
+
+    Policy mySpacePolicy = Policy.getInstance(getClass().getResource("/antisamy-myspace.xml"));
+    CleanResults cr = as.scan(dirty, mySpacePolicy, AntiSamy.DOM);
+    assertNotNull(cr.getCleanHTML());
+    cr = as.scan(dirty, mySpacePolicy, AntiSamy.SAX);
+    assertNotNull(cr.getCleanHTML());
+
+    Policy ebayPolicy = Policy.getInstance(getClass().getResource("/antisamy-ebay.xml"));
+    cr = as.scan(dirty, ebayPolicy, AntiSamy.DOM);
+    assertNotNull(cr.getCleanHTML());
+    cr = as.scan(dirty, mySpacePolicy, AntiSamy.SAX);
+    assertNotNull(cr.getCleanHTML());
+
+    Policy slashdotPolicy = Policy.getInstance(getClass().getResource("/antisamy-slashdot.xml"));
+    cr = as.scan(dirty, slashdotPolicy, AntiSamy.DOM);
+    assertNotNull(cr.getCleanHTML());
+    cr = as.scan(dirty, slashdotPolicy, AntiSamy.SAX);
+    assertNotNull(cr.getCleanHTML());
+  }
+
+  @Test
+  public void issue38() throws ScanException, PolicyException {
+
+    /* issue #38 - color problem/color combinations */
+    String s = "<font color=\"#fff\">Test</font>";
+    String expected = "<font color=\"#fff\">Test</font>";
+    assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
+    assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
+
+    s = "<div style=\"color: #fff\">Test 3 letter code</div>";
+    expected = "<div style=\"color: rgb(255,255,255);\">Test 3 letter code</div>";
+    assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
+    assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
+
+    s = "<font color=\"red\">Test</font>";
+    expected = "<font color=\"red\">Test</font>";
+    assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
+    assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
+
+    s = "<font color=\"neonpink\">Test</font>";
+    expected = "<font>Test</font>";
+    assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
+    assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
+
+    s = "<font color=\"#0000\">Test</font>";
+    expected = "<font>Test</font>";
+    assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
+    assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
+
+    s = "<div style=\"color: #0000\">Test</div>";
+    expected = "<div style=\"\">Test</div>";
+    assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
+    assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
+
+    s = "<font color=\"#000000\">Test</font>";
+    expected = "<font color=\"#000000\">Test</font>";
+    assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
+    assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
+
+    s = "<div style=\"color: #000000\">Test</div>";
+    expected = "<div style=\"color: rgb(0,0,0);\">Test</div>";
+    assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
+    assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
 
     /*
-     * Test a bunch of strings that have tweaked the XML parsing capabilities of
-     * NekoHTML.
+     * This test case was failing because of the following code from the
+     * batik CSS library, which throws an exception if any character
+     * other than a '!' follows a beginning token of '<'. The
+     * ParseException is now caught in the node a CssScanner.java and
+     * the outside AntiSamyDOMScanner.java.
+     *
+     * 0398 nextChar(); 0399 if (current != '!') { 0400 throw new
+     * ParseException("character", 0401 reader.getLine(), 0402
+     * reader.getColumn());
      */
-    @Test
-    public void IllegalXML() throws PolicyException {
-
-        for (String BASE64_BAD_XML_STRING : BASE64_BAD_XML_STRINGS) {
-
-            try {
-                String testStr = new String(Base64.decodeBase64(BASE64_BAD_XML_STRING.getBytes()));
-                as.scan(testStr, policy, AntiSamy.DOM);
-                as.scan(testStr, policy, AntiSamy.SAX);
-
-            } catch (ScanException ex) {
-                // still success!
-            }
-        }
-
-        // This fails due to a bug in NekoHTML
-        // try {
-        // assertTrue (
-        // as.scan("<a . href=\"http://www.test.com\">",policy, AntiSamy.DOM).getCleanHTML().indexOf("href")
-        // != -1 );
-        // } catch (Exception e) {
-        // e.printStackTrace();
-        // fail("Couldn't parse malformed HTML: " + e.getMessage());
-        // }
-
-        // This fails due to a bug in NekoHTML
-        // try {
-        // assertTrue (
-        // as.scan("<a - href=\"http://www.test.com\">",policy, AntiSamy.DOM).getCleanHTML().indexOf("href")
-        // != -1 );
-        // } catch (Exception e) {
-        // e.printStackTrace();
-        // fail("Couldn't parse malformed HTML: " + e.getMessage());
-        // }
-
-        try {
-            assertTrue(as.scan("<style>", policy, AntiSamy.DOM) != null);
-        } catch (Exception e) {
-            e.printStackTrace();
-            fail("Couldn't parse malformed HTML: " + e.getMessage());
-        }
-    }
-
-    @Test
-    public void issue12() throws ScanException, PolicyException {
-        /*
-         * issues 12 (and 36, which was similar). empty tags cause display
-         * problems/"formjacking"
-         */
-
-        Pattern p = Pattern.compile(".*<strong(\\s*)/>.*");
-        String s1 = as.scan("<br ><strong></strong><a>hello world</a><b /><i/><hr>", policy, AntiSamy.DOM).getCleanHTML();
-        String s2 = as.scan("<br ><strong></strong><a>hello world</a><b /><i/><hr>", policy, AntiSamy.SAX).getCleanHTML();
-
-        assertFalse(p.matcher(s1).matches());
-
-        p = Pattern.compile(".*<b(\\s*)/>.*");
-        assertFalse(p.matcher(s1).matches());
-        assertFalse(p.matcher(s2).matches());
-
-        p = Pattern.compile(".*<i(\\s*)/>.*");
-        assertFalse(p.matcher(s1).matches());
-        assertFalse(p.matcher(s2).matches());
-
-        assertThat(s1 , containsString("<hr>"));
-        assertThat(s2 , containsString("<hr>"));
-    }
-
-    @Test
-    public void issue20() throws ScanException, PolicyException {
-        String s = as.scan("<b><i>Some Text</b></i>", policy, AntiSamy.DOM).getCleanHTML();
-        assertTrue(!s.contains("<i />"));
-
-        s = as.scan("<b><i>Some Text</b></i>", policy, AntiSamy.SAX).getCleanHTML();
-        assertTrue(!s.contains("<i />"));
-    }
-
-    @Test
-    public void issue25() throws ScanException, PolicyException {
-        String s = "<div style=\"margin: -5em\">Test</div>";
-        String expected = "<div style=\"\">Test</div>";
-
-        String crDom = as.scan(s, policy, AntiSamy.DOM).getCleanHTML();
-        assertEquals(crDom, expected);
-        String crSax = as.scan(s, policy, AntiSamy.SAX).getCleanHTML();
-        assertEquals(crSax, expected);
-    }
-
-
-    @Test
-    public void issue28() throws ScanException, PolicyException {
-        String s1 = as.scan("<div style=\"font-family: Geneva, Arial, courier new, sans-serif\">Test</div>", policy, AntiSamy.DOM).getCleanHTML();
-        String s2 = as.scan("<div style=\"font-family: Geneva, Arial, courier new, sans-serif\">Test</div>", policy, AntiSamy.SAX).getCleanHTML();
-        assertTrue(s1.contains("font-family"));
-        assertTrue(s2.contains("font-family"));
-    }
-
-    @Test
-    public void issue29() throws ScanException, PolicyException {
-        /* issue #29 - missing quotes around properties with spaces */
-        String s = "<style type=\"text/css\"><![CDATA[P {\n	font-family: \"Arial Unicode MS\";\n}\n]]></style>";
-        CleanResults cr = as.scan(s, policy, AntiSamy.DOM);
-        assertEquals(s, cr.getCleanHTML());
-    }
-
-    @Test
-    public void issue30() throws ScanException, PolicyException {
-
-        String s = "<style type=\"text/css\"><![CDATA[P { margin-bottom: 0.08in; } ]]></style>";
-
-        as.scan(s, policy, AntiSamy.DOM);
-        CleanResults cr;
-
-        /* followup - does the patch fix multiline CSS? */
-        String s2 = "<style type=\"text/css\"><![CDATA[\r\nP {\r\n margin-bottom: 0.08in;\r\n}\r\n]]></style>";
-        cr = as.scan(s2, policy, AntiSamy.DOM);
-        assertEquals("<style type=\"text/css\"><![CDATA[P {\n\tmargin-bottom: 0.08in;\n}\n]]></style>", cr.getCleanHTML());
-
-        /* next followup - does non-CDATA parsing still work? */
-
-        String s3 = "<style>P {\n\tmargin-bottom: 0.08in;\n}\n";
-        cr = as.scan(s3, policy, AntiSamy.DOM);
-        assertEquals("<style>P {\n\tmargin-bottom: 0.08in;\n}\n</style>\n", cr.getCleanHTML());
-    }
-
-    @Test
-    public void issue31() throws ScanException, PolicyException {
-
-        String test = "<b><u><g>foo</g></u></b>";
-        Policy revised = policy.cloneWithDirective("onUnknownTag", "encode");
-        CleanResults cr = as.scan(test, revised, AntiSamy.DOM);
-        String s = cr.getCleanHTML();
-        assertFalse(!s.contains("&lt;g&gt;"));
-        assertFalse(!s.contains("&lt;/g&gt;"));
-        s = as.scan(test, revised, AntiSamy.SAX).getCleanHTML();
-        assertFalse(!s.contains("&lt;g&gt;"));
-        assertFalse(!s.contains("&lt;/g&gt;"));
-
-        Tag tag = policy.getTagByLowercaseName("b").mutateAction("encode");
-        Policy policy1 = policy.mutateTag(tag);
-
-        cr = as.scan(test, policy1, AntiSamy.DOM);
-        s = cr.getCleanHTML();
-
-        assertFalse(!s.contains("&lt;b&gt;"));
-        assertFalse(!s.contains("&lt;/b&gt;"));
-
-        cr = as.scan(test, policy1, AntiSamy.SAX);
-        s = cr.getCleanHTML();
-
-        assertFalse(!s.contains("&lt;b&gt;"));
-        assertFalse(!s.contains("&lt;/b&gt;"));
-    }
-
-    @Test
-    public void issue32() throws ScanException, PolicyException {
-        /* issue #32 - nekos problem */
-        String s = "<SCRIPT =\">\" SRC=\"\"></SCRIPT>";
-        as.scan(s, policy, AntiSamy.DOM);
-        as.scan(s, policy, AntiSamy.SAX);
-    }
-
-    @Test
-    public void issue37() throws ScanException, PolicyException {
-
-        String dirty = "<a onblur=\"try {parent.deselectBloggerImageGracefully();}" + "catch(e) {}\""
-                + "href=\"http://www.charityadvantage.com/ChildrensmuseumEaston/images/BookswithBill.jpg\"><img" + "style=\"FLOAT: right; MARGIN: 0px 0px 10px 10px; WIDTH: 150px; CURSOR:"
-                + "hand; HEIGHT: 100px\" alt=\"\"" + "src=\"http://www.charityadvantage.com/ChildrensmuseumEaston/images/BookswithBill.jpg\""
-                + "border=\"0\" /></a><br />Poor Bill, couldn't make it to the Museum's <span" + "class=\"blsp-spelling-corrected\" id=\"SPELLING_ERROR_0\">story time</span>"
-                + "today, he was so busy shoveling! Well, we sure missed you Bill! So since" + "ou were busy moving snow we read books about snow. We found a clue in one"
-                + "book which revealed a snowplow at the end of the story - we wish it had" + "driven to your driveway Bill. We also read a story which shared fourteen"
-                + "<em>Names For Snow. </em>We'll catch up with you next week....wonder which" + "hat Bill will wear?<br />Jane";
-
-        Policy mySpacePolicy = Policy.getInstance(getClass().getResource("/antisamy-myspace.xml"));
-        CleanResults cr = as.scan(dirty, mySpacePolicy, AntiSamy.DOM);
-        assertNotNull(cr.getCleanHTML());
-        cr = as.scan(dirty, mySpacePolicy, AntiSamy.SAX);
-        assertNotNull(cr.getCleanHTML());
-
-        Policy ebayPolicy = Policy.getInstance(getClass().getResource("/antisamy-ebay.xml"));
-        cr = as.scan(dirty, ebayPolicy, AntiSamy.DOM);
-        assertNotNull(cr.getCleanHTML());
-        cr = as.scan(dirty, mySpacePolicy, AntiSamy.SAX);
-        assertNotNull(cr.getCleanHTML());
-
-        Policy slashdotPolicy = Policy.getInstance(getClass().getResource("/antisamy-slashdot.xml"));
-        cr = as.scan(dirty, slashdotPolicy, AntiSamy.DOM);
-        assertNotNull(cr.getCleanHTML());
-        cr = as.scan(dirty, slashdotPolicy, AntiSamy.SAX);
-        assertNotNull(cr.getCleanHTML());
-    }
-
-    @Test
-    public void issue38() throws ScanException, PolicyException {
-
-        /* issue #38 - color problem/color combinations */
-        String s = "<font color=\"#fff\">Test</font>";
-        String expected = "<font color=\"#fff\">Test</font>";
-        assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
-        assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
-
-        s = "<div style=\"color: #fff\">Test 3 letter code</div>";
-        expected = "<div style=\"color: rgb(255,255,255);\">Test 3 letter code</div>";
-        assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
-        assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
-
-        s = "<font color=\"red\">Test</font>";
-        expected = "<font color=\"red\">Test</font>";
-        assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
-        assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
-
-        s = "<font color=\"neonpink\">Test</font>";
-        expected = "<font>Test</font>";
-        assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
-        assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
-
-        s = "<font color=\"#0000\">Test</font>";
-        expected = "<font>Test</font>";
-        assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
-        assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
-
-        s = "<div style=\"color: #0000\">Test</div>";
-        expected = "<div style=\"\">Test</div>";
-        assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
-        assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
-
-        s = "<font color=\"#000000\">Test</font>";
-        expected = "<font color=\"#000000\">Test</font>";
-        assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
-        assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
-
-        s = "<div style=\"color: #000000\">Test</div>";
-        expected = "<div style=\"color: rgb(0,0,0);\">Test</div>";
-        assertEquals(as.scan(s, policy, AntiSamy.DOM).getCleanHTML(), expected);
-        assertEquals(as.scan(s, policy, AntiSamy.SAX).getCleanHTML(), expected);
-
-        /*
-        * This test case was failing because of the following code from the
-        * batik CSS library, which throws an exception if any character
-        * other than a '!' follows a beginning token of '<'. The
-        * ParseException is now caught in the node a CssScanner.java and
-        * the outside AntiSamyDOMScanner.java.
-        *
-        * 0398 nextChar(); 0399 if (current != '!') { 0400 throw new
-        * ParseException("character", 0401 reader.getLine(), 0402
-        * reader.getColumn());
-        */
-        s = "<b><u>foo<style><script>alert(1)</script></style>@import 'x';</u>bar";
-        as.scan(s, policy, AntiSamy.DOM);
-        as.scan(s, policy, AntiSamy.SAX);
-    }
-
-    @Test
-    public void issue40() throws ScanException, PolicyException {
-
-        /* issue #40 - handling <style> media attributes right */
-
-        String s = "<style media=\"print, projection, screen\"> P { margin: 1em; }</style>";
-        Policy revised = policy.cloneWithDirective(Policy.PRESERVE_SPACE, "true");
-
-        CleanResults cr = as.scan(s, revised, AntiSamy.DOM);
-        assertTrue(cr.getCleanHTML().contains("print, projection, screen"));
-
-        cr = as.scan(s, revised, AntiSamy.SAX);
-        assertTrue(cr.getCleanHTML().contains("print, projection, screen"));
-    }
-
-    @Test
-    public void issue41() throws ScanException, PolicyException {
-        /* issue #41 - comment handling */
-
-        Policy revised = policy.cloneWithDirective(Policy.PRESERVE_SPACE, "true");
-
-        policy.cloneWithDirective(Policy.PRESERVE_COMMENTS, "false");
-
-        assertEquals("text ", as.scan("text <!-- comment -->", revised, AntiSamy.DOM).getCleanHTML());
-        assertEquals("text ", as.scan("text <!-- comment -->", revised, AntiSamy.SAX).getCleanHTML());
-
-        Policy revised2 = policy.cloneWithDirective(Policy.PRESERVE_COMMENTS, "true").cloneWithDirective(Policy.PRESERVE_SPACE, "true").cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
-
-        /*
-        * These make sure the regular comments are kept alive and that
-        * conditional comments are ripped out.
-        */
-        assertEquals("<div>text <!-- comment --></div>", as.scan("<div>text <!-- comment --></div>", revised2, AntiSamy.DOM).getCleanHTML());
-        assertEquals("<div>text <!-- comment --></div>", as.scan("<div>text <!-- comment --></div>", revised2, AntiSamy.SAX).getCleanHTML());
-
-        assertEquals("<div>text <!-- comment --></div>", as.scan("<div>text <!--[if IE]> comment <[endif]--></div>", revised2, AntiSamy.DOM).getCleanHTML());
-        assertEquals("<div>text <!-- comment --></div>", as.scan("<div>text <!--[if IE]> comment <[endif]--></div>", revised2, AntiSamy.SAX).getCleanHTML());
-
-        /*
-        * Check to see how nested conditional comments are handled. This is
-        * not very clean but the main goal is to avoid any tags. Not sure
-        * on encodings allowed in comments.
-        */
-        String input = "<div>text <!--[if IE]> <!--[if gte 6]> comment <[endif]--><[endif]--></div>";
-        String expected = "<div>text <!-- <!-- comment -->&lt;[endif]--&gt;</div>";
-        String output = as.scan(input, revised2, AntiSamy.DOM).getCleanHTML();
-        assertEquals(expected, output);
-
-        input = "<div>text <!--[if IE]> <!--[if gte 6]> comment <[endif]--><[endif]--></div>";
-        expected = "<div>text <!-- <!-- comment -->&lt;[endif]--&gt;</div>";
-        output = as.scan(input, revised2, AntiSamy.SAX).getCleanHTML();
-
-        assertEquals(expected, output);
-
-        /*
-        * Regular comment nested inside conditional comment. Test makes
-        * sure
-        */
-        assertEquals("<div>text <!-- <!-- IE specific --> comment &lt;[endif]--&gt;</div>", as.scan("<div>text <!--[if IE]> <!-- IE specific --> comment <[endif]--></div>", revised2, AntiSamy.DOM).getCleanHTML());
-
-        /*
-        * These play with whitespace and have invalid comment syntax.
-        */
-        assertEquals("<div>text <!-- \ncomment --></div>", as.scan("<div>text <!-- [ if lte 6 ]>\ncomment <[ endif\n]--></div>", revised2, AntiSamy.DOM).getCleanHTML());
-        assertEquals("<div>text  comment </div>", as.scan("<div>text <![if !IE]> comment <![endif]></div>", revised2, AntiSamy.DOM).getCleanHTML());
-        assertEquals("<div>text  comment </div>", as.scan("<div>text <![ if !IE]> comment <![endif]></div>", revised2, AntiSamy.DOM).getCleanHTML());
-
-        String attack = "[if lte 8]<script>";
-        String spacer = "<![if IE]>";
-
-        StringBuilder sb = new StringBuilder();
-
-        sb.append("<div>text<!");
-
-        for (int i = 0; i < attack.length(); i++) {
-            sb.append(attack.charAt(i));
-            sb.append(spacer);
-        }
-
-        sb.append("<![endif]>");
-
-        String s = sb.toString();
-
-        assertTrue(!as.scan(s, revised2, AntiSamy.DOM).getCleanHTML().contains("<script"));
-        assertTrue(!as.scan(s, revised2, AntiSamy.SAX).getCleanHTML().contains("<script"));
-    }
-
-    @Test
-    public void issue44() throws ScanException, PolicyException {
-        /*
-         * issue #44 - childless nodes of non-allowed elements won't cause an error
-         */
-        String s = "<iframe src='http://foo.com/'></iframe>" + "<script src=''></script>" + "<link href='/foo.css'>";
-        as.scan(s, policy, AntiSamy.DOM);
-        assertEquals(as.scan(s, policy, AntiSamy.DOM).getNumberOfErrors(), 3);
-
-        CleanResults cr = as.scan(s, policy, AntiSamy.SAX);
-
-        assertEquals(cr.getNumberOfErrors(), 3);
-    }
-
-    @Test
-    public void issue51() throws ScanException, PolicyException {
-        /* issue #51 - offsite URLs with () are found to be invalid */
-        String s = "<a href='http://subdomain.domain/(S(ke0lpq54bw0fvp53a10e1a45))/MyPage.aspx'>test</a>";
-        CleanResults cr = as.scan(s, policy, AntiSamy.DOM);
-
-        assertEquals(cr.getNumberOfErrors(), 0);
+    s = "<b><u>foo<style><script>alert(1)</script></style>@import 'x';</u>bar";
+    as.scan(s, policy, AntiSamy.DOM);
+    as.scan(s, policy, AntiSamy.SAX);
+  }
 
-        cr = as.scan(s, policy, AntiSamy.SAX);
-        assertEquals(cr.getNumberOfErrors(), 0);
-    }
-
-    @Test
-    public void issue56() throws ScanException, PolicyException {
-        /* issue #56 - unnecessary spaces */
-
-        String s = "<SPAN style='font-weight: bold;'>Hello World!</SPAN>";
-        String expected = "<span style=\"font-weight: bold;\">Hello World!</span>";
-
-        CleanResults cr = as.scan(s, policy, AntiSamy.DOM);
-        String s2 = cr.getCleanHTML();
-
-        assertEquals(expected, s2);
-
-        cr = as.scan(s, policy, AntiSamy.SAX);
-        s2 = cr.getCleanHTML();
-
-        assertEquals(expected, s2);
-    }
-
-    @Test
-    public void issue58() throws ScanException, PolicyException {
-        /* issue #58 - input not in list of allowed-to-be-empty tags */
-        String s = "tgdan <input/> g  h";
-        CleanResults cr = as.scan(s, policy, AntiSamy.DOM);
-        assertTrue(cr.getErrorMessages().size() == 0);
-
-        cr = as.scan(s, policy, AntiSamy.SAX);
-        assertTrue(cr.getErrorMessages().size() == 0);
-    }
-
-    @Test
-    public void issue61() throws ScanException, PolicyException {
-        /* issue #61 - input has newline appended if ends with an accepted tag */
-        String dirtyInput = "blah <b>blah</b>.";
-        Policy revised = policy.cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
-        CleanResults cr = as.scan(dirtyInput, revised, AntiSamy.DOM);
-        assertEquals(dirtyInput, cr.getCleanHTML());
-
-        cr = as.scan(dirtyInput, revised, AntiSamy.SAX);
-        assertEquals(dirtyInput, cr.getCleanHTML());
-    }
-
-    @Test
-    public void issue69() throws ScanException, PolicyException {
-
-        /* issue #69 - char attribute should allow single char or entity ref */
-
-        String s = "<table><tr><td char='.'>test</td></tr></table>";
-        CleanResults crDom = as.scan(s, policy, AntiSamy.DOM);
-        CleanResults crSax = as.scan(s, policy, AntiSamy.SAX);
-        String domValue = crDom.getCleanHTML();
-        String saxValue = crSax.getCleanHTML();
-        assertTrue(domValue.contains("char"));
-        assertTrue(saxValue.contains("char"));
-
-        s = "<table><tr><td char='..'>test</td></tr></table>";
-        assertTrue(!as.scan(s, policy, AntiSamy.DOM).getCleanHTML().contains("char"));
-        assertTrue(!as.scan(s, policy, AntiSamy.SAX).getCleanHTML().contains("char"));
-
-        s = "<table><tr><td char='&quot;'>test</td></tr></table>";
-        assertTrue(as.scan(s, policy, AntiSamy.DOM).getCleanHTML().contains("char"));
-        assertTrue(as.scan(s, policy, AntiSamy.SAX).getCleanHTML().contains("char"));
-
-        s = "<table><tr><td char='&quot;a'>test</td></tr></table>";
-        assertTrue(!as.scan(s, policy, AntiSamy.DOM).getCleanHTML().contains("char"));
-        assertTrue(!as.scan(s, policy, AntiSamy.SAX).getCleanHTML().contains("char"));
+  @Test
+  public void issue40() throws ScanException, PolicyException {
 
-        s = "<table><tr><td char='&quot;&amp;'>test</td></tr></table>";
-        assertTrue(!as.scan(s, policy, AntiSamy.DOM).getCleanHTML().contains("char"));
-        assertTrue(!as.scan(s, policy, AntiSamy.SAX).getCleanHTML().contains("char"));
-    }
-
-    @Test
-    public void CDATAByPass() throws ScanException, PolicyException {
-        String malInput = "<![CDATA[]><script>alert(1)</script>]]>";
-        CleanResults crd = as.scan(malInput, policy, AntiSamy.DOM);
-        CleanResults crs = as.scan(malInput, policy, AntiSamy.SAX);
-        String crDom = crd.getCleanHTML();
-        String crSax = crs.getCleanHTML();
-
-        assertTrue(crd.getErrorMessages().size() > 0);
-        assertTrue(crs.getErrorMessages().size() > 0);
-
-        assertTrue(crSax.contains("&lt;script") && !crDom.contains("<script"));
-        assertTrue(crDom.contains("&lt;script") && !crDom.contains("<script"));
-    }
-
-    @Test
-    public void literalLists() throws ScanException, PolicyException {
-
-        /* this test is for confirming literal-lists work as
-         * advertised. it turned out to be an invalid / non-
-         * reproducible bug report but the test seemed useful
-         * enough to keep.
-         */
-        String malInput = "hello<p align='invalid'>world</p>";
-
-        CleanResults crd = as.scan(malInput, policy, AntiSamy.DOM);
-        String crDom = crd.getCleanHTML();
-        CleanResults crs = as.scan(malInput, policy, AntiSamy.SAX);
-        String crSax = crs.getCleanHTML();
-
-        assertTrue(!crSax.contains("invalid"));
-        assertTrue(!crDom.contains("invalid"));
-
-        assertTrue(crd.getErrorMessages().size() == 1);
-        assertTrue(crs.getErrorMessages().size() == 1);
+    /* issue #40 - handling <style> media attributes right */
 
-        String goodInput = "hello<p align='left'>world</p>";
-        crDom = as.scan(goodInput, policy, AntiSamy.DOM).getCleanHTML();
-        crSax = as.scan(goodInput, policy, AntiSamy.SAX).getCleanHTML();
+    String s = "<style media=\"print, projection, screen\"> P { margin: 1em; }</style>";
+    Policy revised = policy.cloneWithDirective(Policy.PRESERVE_SPACE, "true");
 
-        assertTrue(crSax.contains("left"));
-        assertTrue(crDom.contains("left"));
-    }
-
-    @Test
-    public void stackExhaustion() throws ScanException, PolicyException {
-        /*
-        * Test Julian Cohen's stack exhaustion bug.
-        */
-
-        StringBuilder sb = new StringBuilder();
-        for (int i = 0; i < 249; i++) {
-            sb.append("<div>");
-        }
-        /*
-        * First, make sure this attack is useless against the
-        * SAX parser.
-        */
-        as.scan(sb.toString(), policy, AntiSamy.SAX);
-
-        /*
-        * Scan this really deep tree (depth=249, 1 less than the
-        * max) and make sure it doesn't blow up.
-        */
-
-        CleanResults crd = as.scan(sb.toString(), policy, AntiSamy.DOM);
-
-        String crDom = crd.getCleanHTML();
-        assertTrue(crDom.length() != 0);
-        /*
-        * Now push it over the limit to 251 and make sure we blow
-        * up safely.
-        */
-        sb.append("<div><div>"); // this makes 251
-
-        try {
-            as.scan(sb.toString(), policy, AntiSamy.DOM);
-            fail("DOM depth exceeded max - should've errored");
-        } catch (ScanException e) {
-            // An error is expected. Pass
-        }
-    }
-
-    @Test
-    public void issue107() throws ScanException, PolicyException {
-        StringBuilder sb = new StringBuilder();
-
-        /*
-         * #107 - erroneous newlines appearing? couldn't reproduce this
-         * error but the test seems worthy of keeping.
-         */
-        String nl = "\n";
+    CleanResults cr = as.scan(s, revised, AntiSamy.DOM);
+    assertTrue(cr.getCleanHTML().contains("print, projection, screen"));
 
-        String header = "<h1>Header</h1>";
-        String para = "<p>Paragraph</p>";
-        sb.append(header);
-        sb.append(nl);
-        sb.append(para);
+    cr = as.scan(s, revised, AntiSamy.SAX);
+    assertTrue(cr.getCleanHTML().contains("print, projection, screen"));
+  }
 
-        String html = sb.toString();
-
-        String crDom = as.scan(html, policy, AntiSamy.DOM).getCleanHTML();
-        String crSax = as.scan(html, policy, AntiSamy.SAX).getCleanHTML();
-
-        /* Make sure only 1 newline appears */
-        assertTrue(crDom.lastIndexOf(nl) == crDom.indexOf(nl));
-        assertTrue(crSax.lastIndexOf(nl) == crSax.indexOf(nl));
-
-        int expectedLoc = header.length();
-        int actualLoc = crSax.indexOf(nl);
-        assertTrue(expectedLoc == actualLoc);
-
-        actualLoc = crDom.indexOf(nl);
-        // account for line separator length difference across OSes.
-        assertTrue(expectedLoc == actualLoc || expectedLoc == actualLoc + 1);
-    }
+  @Test
+  public void issue41() throws ScanException, PolicyException {
+    /* issue #41 - comment handling */
 
-    @Test
-    public void issue112() throws ScanException, PolicyException {
-        TestPolicy revised = policy.cloneWithDirective(Policy.PRESERVE_COMMENTS, "true")
-                .cloneWithDirective(Policy.PRESERVE_SPACE, "true")
-                .cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
+    Policy revised = policy.cloneWithDirective(Policy.PRESERVE_SPACE, "true");
 
-        /*
-        * #112 - empty tag becomes self closing
-        */
+    policy.cloneWithDirective(Policy.PRESERVE_COMMENTS, "false");
 
-        String html = "text <strong></strong> text <strong><em></em></strong> text";
+    assertEquals("text ", as.scan("text <!-- comment -->", revised, AntiSamy.DOM).getCleanHTML());
+    assertEquals("text ", as.scan("text <!-- comment -->", revised, AntiSamy.SAX).getCleanHTML());
 
-        String crDom = as.scan(html, revised, AntiSamy.DOM).getCleanHTML();
-        String crSax = as.scan(html, revised, AntiSamy.SAX).getCleanHTML();
+    Policy revised2 =
+        policy
+            .cloneWithDirective(Policy.PRESERVE_COMMENTS, "true")
+            .cloneWithDirective(Policy.PRESERVE_SPACE, "true")
+            .cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
 
-        assertTrue(!crDom.contains("<strong />") && !crDom.contains("<strong/>"));
-        assertTrue(!crSax.contains("<strong />") && !crSax.contains("<strong/>"));
+    /*
+     * These make sure the regular comments are kept alive and that
+     * conditional comments are ripped out.
+     */
+    assertEquals(
+        "<div>text <!-- comment --></div>",
+        as.scan("<div>text <!-- comment --></div>", revised2, AntiSamy.DOM).getCleanHTML());
+    assertEquals(
+        "<div>text <!-- comment --></div>",
+        as.scan("<div>text <!-- comment --></div>", revised2, AntiSamy.SAX).getCleanHTML());
+
+    assertEquals(
+        "<div>text <!-- comment --></div>",
+        as.scan("<div>text <!--[if IE]> comment <[endif]--></div>", revised2, AntiSamy.DOM)
+            .getCleanHTML());
+    assertEquals(
+        "<div>text <!-- comment --></div>",
+        as.scan("<div>text <!--[if IE]> comment <[endif]--></div>", revised2, AntiSamy.SAX)
+            .getCleanHTML());
 
-        StringBuilder sb = new StringBuilder();
-        sb.append("<html><head><title>foobar</title></head><body>");
-        sb.append("<img src=\"http://foobar.com/pic.gif\"></body></html>");
+    /*
+     * Check to see how nested conditional comments are handled. This is
+     * not very clean but the main goal is to avoid any tags. Not sure
+     * on encodings allowed in comments.
+     */
+    String input = "<div>text <!--[if IE]> <!--[if gte 6]> comment <[endif]--><[endif]--></div>";
+    String expected = "<div>text <!-- <!-- comment -->&lt;[endif]--&gt;</div>";
+    String output = as.scan(input, revised2, AntiSamy.DOM).getCleanHTML();
+    assertEquals(expected, output);
 
-        html = sb.toString();
+    input = "<div>text <!--[if IE]> <!--[if gte 6]> comment <[endif]--><[endif]--></div>";
+    expected = "<div>text <!-- <!-- comment -->&lt;[endif]--&gt;</div>";
+    output = as.scan(input, revised2, AntiSamy.SAX).getCleanHTML();
 
-        crDom = as.scan(html, revised, AntiSamy.DOM).getCleanHTML();
-        crSax = as.scan(html, revised, AntiSamy.SAX).getCleanHTML();
+    assertEquals(expected, output);
 
-        assertTrue(html.equals(crDom));
-        assertTrue(html.equals(crSax));
-    }
+    /*
+     * Regular comment nested inside conditional comment. Test makes
+     * sure
+     */
+    assertEquals(
+        "<div>text <!-- <!-- IE specific --> comment &lt;[endif]--&gt;</div>",
+        as.scan(
+                "<div>text <!--[if IE]> <!-- IE specific --> comment <[endif]--></div>",
+                revised2,
+                AntiSamy.DOM)
+            .getCleanHTML());
 
+    /*
+     * These play with whitespace and have invalid comment syntax.
+     */
+    assertEquals(
+        "<div>text <!-- \ncomment --></div>",
+        as.scan(
+                "<div>text <!-- [ if lte 6 ]>\ncomment <[ endif\n]--></div>",
+                revised2,
+                AntiSamy.DOM)
+            .getCleanHTML());
+    assertEquals(
+        "<div>text  comment </div>",
+        as.scan("<div>text <![if !IE]> comment <![endif]></div>", revised2, AntiSamy.DOM)
+            .getCleanHTML());
+    assertEquals(
+        "<div>text  comment </div>",
+        as.scan("<div>text <![ if !IE]> comment <![endif]></div>", revised2, AntiSamy.DOM)
+            .getCleanHTML());
 
-    @Test
-    public void nestedCdataAttacks() throws ScanException, PolicyException {
+    String attack = "[if lte 8]<script>";
+    String spacer = "<![if IE]>";
 
-        /*
-        * Testing for nested CDATA attacks against the SAX parser.
-        */
+    StringBuilder sb = new StringBuilder();
 
-        String html = "<![CDATA[]><script>alert(1)</script><![CDATA[]>]]><script>alert(2)</script>>]]>";
-        String crDom = as.scan(html, policy, AntiSamy.DOM).getCleanHTML();
-        String crSax = as.scan(html, policy, AntiSamy.SAX).getCleanHTML();
-        assertTrue(!crDom.contains("<script>"));
-        assertTrue(!crSax.contains("<script>"));
-    }
+    sb.append("<div>text<!");
 
-    @Test
-    public void issue101InternationalCharacterSupport() throws ScanException, PolicyException {
-        Policy revised = policy.cloneWithDirective(Policy.ENTITY_ENCODE_INTL_CHARS, "false");
-
-        String html = "<b>letter 'a' with umlaut: \u00e4";
-        String crDom = as.scan(html, revised, AntiSamy.DOM).getCleanHTML();
-        String crSax = as.scan(html, revised, AntiSamy.SAX).getCleanHTML();
-        assertTrue(crDom.contains("\u00e4"));
-        assertTrue(crSax.contains("\u00e4"));
-
-        Policy revised2 = policy.cloneWithDirective(Policy.ENTITY_ENCODE_INTL_CHARS, "true");
-        crDom = as.scan(html, revised2, AntiSamy.DOM).getCleanHTML();
-        crSax = as.scan(html, revised2, AntiSamy.SAX).getCleanHTML();
-        assertTrue(!crDom.contains("\u00e4"));
-        assertTrue(crDom.contains("&auml;"));
-        assertTrue(!crSax.contains("\u00e4"));
-        assertTrue(crSax.contains("&auml;"));
+    for (int i = 0; i < attack.length(); i++) {
+      sb.append(attack.charAt(i));
+      sb.append(spacer);
     }
 
-    @Test
-    public void iframeAsReportedByOndrej() throws ScanException, PolicyException {
-        String html = "<iframe></iframe>";
+    sb.append("<![endif]>");
 
-        Tag tag = new Tag("iframe", Collections.<String, Attribute>emptyMap(), Policy.ACTION_VALIDATE);
-        Policy revised = policy.addTagRule(tag);
+    String s = sb.toString();
 
-        String crDom = as.scan(html, revised, AntiSamy.DOM).getCleanHTML();
-        String crSax = as.scan(html, revised, AntiSamy.SAX).getCleanHTML();
-
-        assertTrue(html.equals(crDom));
-        assertTrue(html.equals(crSax));
-    }
+    assertTrue(!as.scan(s, revised2, AntiSamy.DOM).getCleanHTML().contains("<script"));
+    assertTrue(!as.scan(s, revised2, AntiSamy.SAX).getCleanHTML().contains("<script"));
+  }
 
+  @Test
+  public void issue44() throws ScanException, PolicyException {
     /*
-	 * Tests cases dealing with nofollowAnchors directive. Assumes anchor tags
-	 * have an action set to "validate" (may be implicit) in the policy file.
-	 */
-    @Test
-    public void nofollowAnchors() throws ScanException, PolicyException {
-
-        // if we have activated nofollowAnchors
-        Policy revisedPolicy = policy.cloneWithDirective(Policy.ANCHORS_NOFOLLOW, "true");
-
-        // adds when not present
-        assertTrue(as.scan("<a href=\"blah\">link</a>", revisedPolicy, AntiSamy.DOM).getCleanHTML().contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
-        assertTrue(as.scan("<a href=\"blah\">link</a>", revisedPolicy, AntiSamy.SAX).getCleanHTML().contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
-
-        // adds properly even with bad attr
-        assertTrue(as.scan("<a href=\"blah\" bad=\"true\">link</a>", revisedPolicy, AntiSamy.DOM).getCleanHTML().contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
-        assertTrue(as.scan("<a href=\"blah\" bad=\"true\">link</a>", revisedPolicy, AntiSamy.SAX).getCleanHTML().contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
-
-        // rel with bad value gets corrected
-        assertTrue(as.scan("<a href=\"blah\" rel=\"blh\">link</a>", revisedPolicy, AntiSamy.DOM).getCleanHTML().contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
-        assertTrue(as.scan("<a href=\"blah\" rel=\"blh\">link</a>", revisedPolicy, AntiSamy.SAX).getCleanHTML().contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
-
-        // correct attribute doesn't get messed with
-        assertTrue(as.scan("<a href=\"blah\" rel=\"nofollow\">link</a>", policy, AntiSamy.DOM).getCleanHTML().contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
-        assertTrue(as.scan("<a href=\"blah\" rel=\"nofollow\">link</a>", policy, AntiSamy.SAX).getCleanHTML().contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
-
-        // if two correct attributes, only one remaining after scan
-        assertTrue(as.scan("<a href=\"blah\" rel=\"nofollow\" rel=\"nofollow\">link</a>", policy, AntiSamy.DOM).getCleanHTML().contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
-        assertTrue(as.scan("<a href=\"blah\" rel=\"nofollow\" rel=\"nofollow\">link</a>", policy, AntiSamy.SAX).getCleanHTML().contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
-
-        // test if value is off - does it add?
-        assertTrue(!as.scan("a href=\"blah\">link</a>", policy, AntiSamy.DOM).getCleanHTML().contains("nofollow"));
-        assertTrue(!as.scan("a href=\"blah\">link</a>", policy, AntiSamy.SAX).getCleanHTML().contains("nofollow"));
-    }
-
-    @Test
-    public void validateParamAsEmbed() throws ScanException, PolicyException {
-        // activate policy setting for this test
-        Policy revised = policy.cloneWithDirective(Policy.VALIDATE_PARAM_AS_EMBED, "true").cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
-
-        // let's start with a YouTube embed
-        String input = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
-        String expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\"></embed></object>";
-        CleanResults cr = as.scan(input, revised, AntiSamy.DOM);
-        assertThat(cr.getCleanHTML(), containsString(expectedOutput));
-
-        String saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
-        cr = as.scan(input, revised, AntiSamy.SAX);
-        assertThat(cr.getCleanHTML(), equalTo(saxExpectedOutput));
-
-        // now what if someone sticks malicious URL in the value of the
-        // value attribute in the param tag? remove that param tag
-        input = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://supermaliciouscode.com/badstuff.swf\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
-        expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\"></embed></object>";
-        saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
-        cr = as.scan(input, revised, AntiSamy.DOM);
-        assertThat(cr.getCleanHTML(), containsString(expectedOutput));
-
-        cr = as.scan(input, revised, AntiSamy.SAX);
-        assertThat(cr.getCleanHTML(), equalTo(saxExpectedOutput));
-
-        // now what if someone sticks malicious URL in the value of the src
-        // attribute in the embed tag? remove that embed tag
-        input = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://hereswhereikeepbadcode.com/ohnoscary.swf\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
-        expectedOutput = "<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"></object>";
-        saxExpectedOutput = "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"></object>";
-
-        cr = as.scan(input, revised, AntiSamy.DOM);
-        assertThat(cr.getCleanHTML(), containsString(expectedOutput));
-        CleanResults scan = as.scan(input, revised, AntiSamy.SAX);
-        assertThat(scan.getCleanHTML(), equalTo(saxExpectedOutput));
-    }
+     * issue #44 - childless nodes of non-allowed elements won't cause an error
+     */
+    String s =
+        "<iframe src='http://foo.com/'></iframe>"
+            + "<script src=''></script>"
+            + "<link href='/foo.css'>";
+    as.scan(s, policy, AntiSamy.DOM);
+    assertEquals(as.scan(s, policy, AntiSamy.DOM).getNumberOfErrors(), 3);
+
+    CleanResults cr = as.scan(s, policy, AntiSamy.SAX);
+
+    assertEquals(cr.getNumberOfErrors(), 3);
+  }
+
+  @Test
+  public void issue51() throws ScanException, PolicyException {
+    /* issue #51 - offsite URLs with () are found to be invalid */
+    String s =
+        "<a href='http://subdomain.domain/(S(ke0lpq54bw0fvp53a10e1a45))/MyPage.aspx'>test</a>";
+    CleanResults cr = as.scan(s, policy, AntiSamy.DOM);
+
+    assertEquals(cr.getNumberOfErrors(), 0);
+
+    cr = as.scan(s, policy, AntiSamy.SAX);
+    assertEquals(cr.getNumberOfErrors(), 0);
+  }
+
+  @Test
+  public void issue56() throws ScanException, PolicyException {
+    /* issue #56 - unnecessary spaces */
+
+    String s = "<SPAN style='font-weight: bold;'>Hello World!</SPAN>";
+    String expected = "<span style=\"font-weight: bold;\">Hello World!</span>";
+
+    CleanResults cr = as.scan(s, policy, AntiSamy.DOM);
+    String s2 = cr.getCleanHTML();
+
+    assertEquals(expected, s2);
+
+    cr = as.scan(s, policy, AntiSamy.SAX);
+    s2 = cr.getCleanHTML();
+
+    assertEquals(expected, s2);
+  }
+
+  @Test
+  public void issue58() throws ScanException, PolicyException {
+    /* issue #58 - input not in list of allowed-to-be-empty tags */
+    String s = "tgdan <input/> g  h";
+    CleanResults cr = as.scan(s, policy, AntiSamy.DOM);
+    assertTrue(cr.getErrorMessages().size() == 0);
+
+    cr = as.scan(s, policy, AntiSamy.SAX);
+    assertTrue(cr.getErrorMessages().size() == 0);
+  }
+
+  @Test
+  public void issue61() throws ScanException, PolicyException {
+    /* issue #61 - input has newline appended if ends with an accepted tag */
+    String dirtyInput = "blah <b>blah</b>.";
+    Policy revised = policy.cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
+    CleanResults cr = as.scan(dirtyInput, revised, AntiSamy.DOM);
+    assertEquals(dirtyInput, cr.getCleanHTML());
+
+    cr = as.scan(dirtyInput, revised, AntiSamy.SAX);
+    assertEquals(dirtyInput, cr.getCleanHTML());
+  }
+
+  @Test
+  public void issue69() throws ScanException, PolicyException {
+
+    /* issue #69 - char attribute should allow single char or entity ref */
+
+    String s = "<table><tr><td char='.'>test</td></tr></table>";
+    CleanResults crDom = as.scan(s, policy, AntiSamy.DOM);
+    CleanResults crSax = as.scan(s, policy, AntiSamy.SAX);
+    String domValue = crDom.getCleanHTML();
+    String saxValue = crSax.getCleanHTML();
+    assertTrue(domValue.contains("char"));
+    assertTrue(saxValue.contains("char"));
+
+    s = "<table><tr><td char='..'>test</td></tr></table>";
+    assertTrue(!as.scan(s, policy, AntiSamy.DOM).getCleanHTML().contains("char"));
+    assertTrue(!as.scan(s, policy, AntiSamy.SAX).getCleanHTML().contains("char"));
+
+    s = "<table><tr><td char='&quot;'>test</td></tr></table>";
+    assertTrue(as.scan(s, policy, AntiSamy.DOM).getCleanHTML().contains("char"));
+    assertTrue(as.scan(s, policy, AntiSamy.SAX).getCleanHTML().contains("char"));
+
+    s = "<table><tr><td char='&quot;a'>test</td></tr></table>";
+    assertTrue(!as.scan(s, policy, AntiSamy.DOM).getCleanHTML().contains("char"));
+    assertTrue(!as.scan(s, policy, AntiSamy.SAX).getCleanHTML().contains("char"));
+
+    s = "<table><tr><td char='&quot;&amp;'>test</td></tr></table>";
+    assertTrue(!as.scan(s, policy, AntiSamy.DOM).getCleanHTML().contains("char"));
+    assertTrue(!as.scan(s, policy, AntiSamy.SAX).getCleanHTML().contains("char"));
+  }
+
+  @Test
+  public void CDATAByPass() throws ScanException, PolicyException {
+    String malInput = "<![CDATA[]><script>alert(1)</script>]]>";
+    CleanResults crd = as.scan(malInput, policy, AntiSamy.DOM);
+    CleanResults crs = as.scan(malInput, policy, AntiSamy.SAX);
+    String crDom = crd.getCleanHTML();
+    String crSax = crs.getCleanHTML();
+
+    assertTrue(crd.getErrorMessages().size() > 0);
+    assertTrue(crs.getErrorMessages().size() > 0);
+
+    assertTrue(crSax.contains("&lt;script") && !crDom.contains("<script"));
+    assertTrue(crDom.contains("&lt;script") && !crDom.contains("<script"));
+  }
+
+  @Test
+  public void literalLists() throws ScanException, PolicyException {
+
+    /* this test is for confirming literal-lists work as
+     * advertised. it turned out to be an invalid / non-
+     * reproducible bug report but the test seemed useful
+     * enough to keep.
+     */
+    String malInput = "hello<p align='invalid'>world</p>";
 
-    @Test
-    public void compareSpeedsShortStrings() throws IOException, ScanException, PolicyException {
+    CleanResults crd = as.scan(malInput, policy, AntiSamy.DOM);
+    String crDom = crd.getCleanHTML();
+    CleanResults crs = as.scan(malInput, policy, AntiSamy.SAX);
+    String crSax = crs.getCleanHTML();
 
-        double totalDomTime = 0;
-        double totalSaxTime = 0;
+    assertTrue(!crSax.contains("invalid"));
+    assertTrue(!crDom.contains("invalid"));
 
-        int testReps = 1000;
+    assertTrue(crd.getErrorMessages().size() == 1);
+    assertTrue(crs.getErrorMessages().size() == 1);
 
-        String html = "<body> hey you <img/> out there on your own </body>";
+    String goodInput = "hello<p align='left'>world</p>";
+    crDom = as.scan(goodInput, policy, AntiSamy.DOM).getCleanHTML();
+    crSax = as.scan(goodInput, policy, AntiSamy.SAX).getCleanHTML();
 
-        for (int j = 0; j < testReps; j++) {
-            totalDomTime += as.scan(html, policy, AntiSamy.DOM).getScanTime();
-            totalSaxTime += as.scan(html, policy, AntiSamy.SAX).getScanTime();
-        }
+    assertTrue(crSax.contains("left"));
+    assertTrue(crDom.contains("left"));
+  }
 
-        System.out.println("Total DOM time short string: " + totalDomTime);
-        System.out.println("Total SAX time short string: " + totalSaxTime);
-    }
-
-    @Test
-    public void profileDom() throws IOException, ScanException, PolicyException {
-        runProfiledTest(AntiSamy.DOM);
-    }
+  @Test
+  public void stackExhaustion() throws ScanException, PolicyException {
+    /*
+     * Test Julian Cohen's stack exhaustion bug.
+     */
 
-    @Test
-    public void profileSax() throws IOException, ScanException, PolicyException {
-        runProfiledTest(AntiSamy.SAX);
+    StringBuilder sb = new StringBuilder();
+    for (int i = 0; i < 249; i++) {
+      sb.append("<div>");
     }
+    /*
+     * First, make sure this attack is useless against the
+     * SAX parser.
+     */
+    as.scan(sb.toString(), policy, AntiSamy.SAX);
 
-    private void runProfiledTest(int scanType) throws ScanException, PolicyException {
-        double totalDomTime;
-
-        warmup(scanType);
+    /*
+     * Scan this really deep tree (depth=249, 1 less than the
+     * max) and make sure it doesn't blow up.
+     */
 
-        int testReps = 9999;
+    CleanResults crd = as.scan(sb.toString(), policy, AntiSamy.DOM);
 
-        String html = "<body> hey you <img/> out there on your own </body>";
+    String crDom = crd.getCleanHTML();
+    assertTrue(crDom.length() != 0);
+    /*
+     * Now push it over the limit to 251 and make sure we blow
+     * up safely.
+     */
+    sb.append("<div><div>"); // this makes 251
 
-        Double each = 0D;
-        int repeats = 10;
-        for (int i = 0; i < repeats; i++) {
-            totalDomTime = 0;
-            for (int j = 0; j < testReps; j++) {
-                totalDomTime += as.scan(html, policy, scanType).getScanTime();
-            }
-            each = each + totalDomTime;
-            System.out.println("Total " + (scanType == AntiSamy.DOM ? "DOM" : "SAX") + " time 9999 reps short string: " + totalDomTime);
-        }
-        System.out.println("Average time: " + (each / repeats));
+    try {
+      as.scan(sb.toString(), policy, AntiSamy.DOM);
+      fail("DOM depth exceeded max - should've errored");
+    } catch (ScanException e) {
+      // An error is expected. Pass
     }
+  }
 
-    private void warmup(int scanType) throws ScanException, PolicyException {
-        int warmupReps = 15000;
-
-        String html = "<body> hey you <img/> out there on your own </body>";
+  @Test
+  public void issue107() throws ScanException, PolicyException {
+    StringBuilder sb = new StringBuilder();
 
-        for (int j = 0; j < warmupReps; j++) {
-            as.scan(html, policy, scanType).getScanTime();
-        }
-    }
-
-    @Test
-    public void comparePatternSpeed() throws IOException, ScanException, PolicyException {
+    /*
+     * #107 - erroneous newlines appearing? couldn't reproduce this
+     * error but the test seems worthy of keeping.
+     */
+    String nl = "\n";
 
-        final Pattern invalidXmlCharacters =
-                Pattern.compile("[\\u0000-\\u001F\\uD800-\\uDFFF\\uFFFE-\\uFFFF&&[^\\u0009\\u000A\\u000D]]");
+    String header = "<h1>Header</h1>";
+    String para = "<p>Paragraph</p>";
+    sb.append(header);
+    sb.append(nl);
+    sb.append(para);
 
-        int testReps = 10000;
+    String html = sb.toString();
 
-        String html = "<body> hey you <img/> out there on your own </body>";
+    String crDom = as.scan(html, policy, AntiSamy.DOM).getCleanHTML();
+    String crSax = as.scan(html, policy, AntiSamy.SAX).getCleanHTML();
 
-        String s = null;
-        //long start = System.currentTimeMillis();
-        for (int j = 0; j < testReps; j++) {
-            s = invalidXmlCharacters.matcher(html).replaceAll("");
-        }
-        //long total = System.currentTimeMillis() - start;
+    /* Make sure only 1 newline appears */
+    assertTrue(crDom.lastIndexOf(nl) == crDom.indexOf(nl));
+    assertTrue(crSax.lastIndexOf(nl) == crSax.indexOf(nl));
 
-        //start = System.currentTimeMillis();
-        Matcher matcher;
-        for (int j = 0; j < testReps; j++) {
-            matcher = invalidXmlCharacters.matcher(html);
-            if (matcher.matches()) {
-                s = matcher.replaceAll("");
-            }
-        }
-        //long total2 = System.currentTimeMillis() - start;
+    int expectedLoc = header.length();
+    int actualLoc = crSax.indexOf(nl);
+    assertTrue(expectedLoc == actualLoc);
 
-        assertNotNull(s);
-        //System.out.println("replaceAllDirect " + total);
-        //System.out.println("match then replace: " + total2);
-    }
+    actualLoc = crDom.indexOf(nl);
+    // account for line separator length difference across OSes.
+    assertTrue(expectedLoc == actualLoc || expectedLoc == actualLoc + 1);
+  }
 
-    @Test
-    public void testOnsiteRegex() throws ScanException, PolicyException {
-    	assertIsGoodOnsiteURL("foo");
-    	assertIsGoodOnsiteURL("/foo/bar");
-    	assertIsGoodOnsiteURL("../../di.cgi?foo&amp;3D~");
-    	assertIsGoodOnsiteURL("/foo/bar/1/sdf;jsessiond=1f1f12312_123123");
-    }
-    
-    void assertIsGoodOnsiteURL(String url) throws ScanException, PolicyException {
-    	String html = as.scan("<a href=\"" + url + "\">X</a>", policy, AntiSamy.DOM).getCleanHTML();
-        assertThat(html, containsString("href=\""));
-	}
-    
-	@Test
-    public void issue10() throws ScanException, PolicyException {
-    	assertFalse(as.scan("<a href=\"javascript&colon;alert&lpar;1&rpar;\">X</a>", policy, AntiSamy.DOM).getCleanHTML().contains("javascript"));
-        assertFalse(as.scan("<a href=\"javascript&colon;alert&lpar;1&rpar;\">X</a>", policy, AntiSamy.SAX).getCleanHTML().contains("javascript"));
-    }
-    
-    @Test
-    public void issue147() throws ScanException, PolicyException {
-        URL url = getClass().getResource("/antisamy-tinymce.xml");
+  @Test
+  public void issue112() throws ScanException, PolicyException {
+    TestPolicy revised =
+        policy
+            .cloneWithDirective(Policy.PRESERVE_COMMENTS, "true")
+            .cloneWithDirective(Policy.PRESERVE_SPACE, "true")
+            .cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
 
-        Policy pol = Policy.getInstance(url);
-        as.scan("<table><tr><td></td></tr></table>", pol, AntiSamy.DOM);
-    }
+    /*
+     * #112 - empty tag becomes self closing
+     */
 
-    @Test
-    public void issue75() throws ScanException, PolicyException {
-        URL url = getClass().getResource("/antisamy-tinymce.xml");
-        Policy pol = Policy.getInstance(url);
-        as.scan("<script src=\"<. \">\"></script>", pol, AntiSamy.DOM);
-        as.scan("<script src=\"<. \">\"></script>", pol, AntiSamy.SAX);
-    }
+    String html = "text <strong></strong> text <strong><em></em></strong> text";
 
-    @Test
-    public void issue144() throws ScanException, PolicyException {
-        String pinata = "pi\u00f1ata";
-        CleanResults results = as.scan(pinata, policy, AntiSamy.DOM);
-        String cleanHTML = results.getCleanHTML();
-        assertEquals(pinata, cleanHTML);
-    }
+    String crDom = as.scan(html, revised, AntiSamy.DOM).getCleanHTML();
+    String crSax = as.scan(html, revised, AntiSamy.SAX).getCleanHTML();
 
-    @Test
-    public void testWhitespaceNotBeingMangled() throws ScanException, PolicyException {
-        String test = "<select name=\"name\"><option value=\"Something\">Something</select>";
-        String expected = "<select name=\"name\"><option value=\"Something\">Something</option></select>";
-        Policy preserveSpace = policy.cloneWithDirective( Policy.PRESERVE_SPACE, "true" );
-        CleanResults preserveSpaceResults = as.scan(test, preserveSpace, AntiSamy.SAX);
-        assertEquals(expected, preserveSpaceResults.getCleanHTML());
-    }
+    assertTrue(!crDom.contains("<strong />") && !crDom.contains("<strong/>"));
+    assertTrue(!crSax.contains("<strong />") && !crSax.contains("<strong/>"));
 
-    @Test
-    public void testDataTag159() throws ScanException, PolicyException {
-        /* issue #159 - allow dynamic HTML5 data-* attribute */
-        String good = "<p data-tag=\"abc123\">Hello World!</p>";
-        String bad = "<p dat-tag=\"abc123\">Hello World!</p>";
-        String goodExpected = "<p data-tag=\"abc123\">Hello World!</p>";
-        String badExpected = "<p>Hello World!</p>";
-        // test good attribute "data-"
-        CleanResults cr = as.scan(good, policy, AntiSamy.SAX);
-        String s = cr.getCleanHTML();
-        assertEquals(goodExpected, s);
-        cr = as.scan(good, policy, AntiSamy.DOM);
-        s = cr.getCleanHTML();
-        assertEquals(goodExpected, s);
-
-        // test bad attribute "dat-"
-        cr = as.scan(bad, policy, AntiSamy.SAX);
-        s = cr.getCleanHTML();
-        assertEquals(badExpected, s);
-        cr = as.scan(bad, policy, AntiSamy.DOM);
-        s = cr.getCleanHTML();
-        assertEquals(badExpected, s);
-    }
+    StringBuilder sb = new StringBuilder();
+    sb.append("<html><head><title>foobar</title></head><body>");
+    sb.append("<img src=\"http://foobar.com/pic.gif\"></body></html>");
 
-    @Test
-    public void testXSSInAntiSamy151() throws ScanException, PolicyException {
-        String test = "<bogus>whatever</bogus><img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\" "
-            + "onmouseover=\"alert('xss')\">";
-        CleanResults results_sax = as.scan(test, policy, AntiSamy.SAX);
-        CleanResults results_dom = as.scan(test, policy, AntiSamy.DOM);
+    html = sb.toString();
 
-        assertEquals(results_sax.getCleanHTML(), results_dom.getCleanHTML());
-        assertEquals("whatever<img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\">", results_dom.getCleanHTML());
-    }
+    crDom = as.scan(html, revised, AntiSamy.DOM).getCleanHTML();
+    crSax = as.scan(html, revised, AntiSamy.SAX).getCleanHTML();
 
-    @Test
-    public void testAnotherXSS() throws ScanException, PolicyException {
-        String test = "<a href=\"http://example.com\"&amp;/onclick=alert(9)>foo</a>";
-        CleanResults results_sax = as.scan(test, policy, AntiSamy.SAX);
-        CleanResults results_dom = as.scan(test, policy, AntiSamy.DOM);
+    assertTrue(html.equals(crDom));
+    assertTrue(html.equals(crSax));
+  }
 
-        assertEquals( results_sax.getCleanHTML(), results_dom.getCleanHTML());
-        assertEquals("<a href=\"http://example.com\" rel=\"nofollow\">foo</a>", results_dom.getCleanHTML());
-    }
+  @Test
+  public void nestedCdataAttacks() throws ScanException, PolicyException {
 
-    @Test
-    public void testIssue2() throws ScanException, PolicyException {
-        String test = "<style onload=alert(1)>h1 {color:red;}</style>";
-        assertThat(as.scan(test, policy, AntiSamy.DOM).getCleanHTML(), not(containsString("alert")));
-        assertThat(as.scan(test, policy, AntiSamy.SAX).getCleanHTML(), not(containsString("alert")));
-    }
-    
     /*
-     * Mailing list user sent this in. Didn't work, but good test to leave in.
+     * Testing for nested CDATA attacks against the SAX parser.
      */
-    @Test
-    public void testUnknownTags() throws ScanException, PolicyException {
-        String test = "<%/onmouseover=prompt(1)>";
-        CleanResults saxResults = as.scan(test, policy, AntiSamy.SAX);
-        CleanResults domResults = as.scan(test, policy, AntiSamy.DOM);
-        assertThat(saxResults.getCleanHTML(), not(containsString("<%/")));
-        assertThat(domResults.getCleanHTML(), not(containsString("<%/")));
-    }
-    
-    @Test
-    public void testStreamScan() throws ScanException {
-        String testImgSrcURL = "<img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\"";
-        Reader reader = new StringReader("<bogus>whatever</bogus>" + testImgSrcURL + " onmouseover=\"alert('xss')\">");
-        Writer writer = new StringWriter();
-        as.scan(reader, writer, policy);
-        String cleanHtml = writer.toString().trim();
-        assertEquals("whatever" + testImgSrcURL + ">", cleanHtml);
-    }
-    
-    @Test
-    public void testGithubIssue23() throws ScanException, PolicyException {
-    	
-        // Antisamy Stripping nested lists and tables
-    	String test23 = "<ul><li>one</li><li>two</li><li>three<ul><li>a</li><li>b</li></ul></li></ul>";
-    	// Issue claims you end up with this:
-    	//    <ul><li>one</li><li>two</li><li>three<ul></ul></li><li>a</li><li>b</li></ul>
-    	// Meaning the <li>a</li><li>b</li> elements were moved outside of the nested <ul> list they were in
-    	
-    	// The a.replaceAll("\\s","") is used to strip out all the whitespace in the CleanHTML so we can successfully find
-    	// what we expect to find.
-        assertThat(as.scan(test23, policy, AntiSamy.DOM).getCleanHTML().replaceAll("\\s",""), containsString("<ul><li>a</li>"));
-        assertThat(as.scan(test23, policy, AntiSamy.SAX).getCleanHTML().replaceAll("\\s",""), containsString("<ul><li>a</li>"));
-        
-        // However, the test above can't replicate this misbehavior.
-    }
-    
-    // TODO: This issue is a valid enhancement request we plan to implement in the future.
-    // Commenting out the test case for now so test failures aren't included in a released version of AntiSamy.
-/*    @Test
-    public void testGithubIssue24() throws ScanException, PolicyException {
-    	
-        // if we have onUnknownTag set to encode, it still strips out the @ and everything else after the it
-    	// DOM Parser actually rips out the entire <name@mail.com> value even with onUnknownTag set
-        TestPolicy revisedPolicy = policy.cloneWithDirective("onUnknownTag", "encode");
-
-    	String email = "name@mail.com";
-        String test24 = "firstname,lastname<" + email + ">";
-        assertThat(as.scan(test24, revisedPolicy, AntiSamy.SAX).getCleanHTML(), containsString(email));
-        assertThat(as.scan(test24, revisedPolicy, AntiSamy.DOM).getCleanHTML(), containsString(email));
-    }
-*/
-    @Test
-    public void testGithubIssue26() throws ScanException, PolicyException {
-        // Potential bypass (False positive)
-    	String test26 = "&#x22;&#x3E;&#x3C;&#x69;&#x6D;&#x67;&#x20;&#x73;&#x72;&#x63;&#x3D;&#x61;&#x20;&#x6F;&#x6E;&#x65;&#x72;&#x72;&#x6F;&#x72;&#x3D;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;&#x3E;";
-    	// Issue claims you end up with this:
-    	//   ><img src=a onerror=alert(1)>
-    	
-        assertThat(as.scan(test26, policy, AntiSamy.SAX).getCleanHTML(), not(containsString("<img src=a onerror=alert(1)>")));
-        assertThat(as.scan(test26, policy, AntiSamy.DOM).getCleanHTML(), not(containsString("<img src=a onerror=alert(1)>")));
-        
-        // But you actually end up with this: &quot;&gt;&lt;img src=a onerror=alert(1)&gt; -- Which is as expected
-    }
-    
-    @Test
-    public void testGithubIssue27() throws ScanException, PolicyException {
-    	// This test doesn't cause an ArrayIndexOutOfBoundsException, as reported in this issue even though it
-    	// replicates the test as described.
-        String test27 = "my &test";
-        assertThat(as.scan(test27, policy, AntiSamy.DOM).getCleanHTML(), containsString("test"));
-        assertThat(as.scan(test27, policy, AntiSamy.SAX).getCleanHTML(), containsString("test"));
-    }
-
-static final String test33 = "<html>\n"
-    	  + "<head>\n"
-    	  + "  <title>Test</title>\n"
-    	  + "</head>\n"
-    	  + "<body>\n"
-    	  + "  <h1>Tricky Encoding</h1>\n"
-    	  + "  <h2>NOT Sanitized by AntiSamy</h2>\n"
-    	  + "  <ol>\n"
-    	  + "    <li><a href=\"javascript&#00058x=alert,x%281%29\">X&#00058;x</a></li>\n"
-    	  + "    <li><a href=\"javascript&#00058y=alert,y%281%29\">X&#00058;y</a></li>\n"
-
-    	  + "    <li><a href=\"javascript&#58x=alert,x%281%29\">X&#58;x</a></li>\n"
-    	  + "    <li><a href=\"javascript&#58y=alert,y%281%29\">X&#58;y</a></li>\n"
-
-    	  + "    <li><a href=\"javascript&#x0003Ax=alert,x%281%29\">X&#x0003A;x</a></li>\n"
-    	  + "    <li><a href=\"javascript&#x0003Ay=alert,y%281%29\">X&#x0003A;y</a></li>\n"
-
-    	  + "    <li><a href=\"javascript&#x3Ax=alert,x%281%29\">X&#x3A;x</a></li>\n"
-    	  + "    <li><a href=\"javascript&#x3Ay=alert,y%281%29\">X&#x3A;y</a></li>\n"
-    	  + "  </ol>\n"
-    	  + "  <h1>Tricky Encoding with Ampersand Encoding</h1>\n"
-    	  + "  <p>AntiSamy turns harmless payload into XSS by just decoding the encoded ampersands in the href attribute</a>\n"
-    	  + "  <ol>\n"
-    	  + "    <li><a href=\"javascript&amp;#x3Ax=alert,x%281%29\">X&amp;#x3A;x</a></li>\n"
-    	  + "    <li><a href=\"javascript&AMP;#x3Ax=alert,x%281%29\">X&AMP;#x3A;x</a></li>\n"
-
-    	  + "    <li><a href=\"javascript&#38;#x3Ax=alert,x%281%29\">X&#38;#x3A;x</a></li>\n"
-    	  + "    <li><a href=\"javascript&#00038;#x3Ax=alert,x%281%29\">X&#00038;#x3A;x</a></li>\n"
-
-    	  + "    <li><a href=\"javascript&#x26;#x3Ax=alert,x%281%29\">X&#x26;#x3A;x</a></li>\n"
-    	  + "    <li><a href=\"javascript&#x00026;#x3Ax=alert,x%281%29\">X&#x00026;#x3A;x</a></li>\n"
-    	  + "  </ol>\n"
-    	  + "  <p><a href=\"javascript&#x3Ax=alert,x%281%29\">Original without ampersand encoding</a></p>\n"
-    	  + "</body>\n"
-    	  + "</html>";
-    			
-    @Test
-    public void testGithubIssue33() throws ScanException, PolicyException {
-        	
-        // Potential bypass
-
-        // Issue claims you end up with this:
-        //   javascript:x=alert and other similar problems (javascript&#00058x=alert,x%281%29) but you don't.
-        //   So issue is a false positive and has been closed.
-        //System.out.println(as.scan(test33, policy, AntiSamy.SAX).getCleanHTML());
-
-        assertThat(as.scan(test33, policy, AntiSamy.SAX).getCleanHTML(), not(containsString("javascript&#00058x=alert,x%281%29")));
-        assertThat(as.scan(test33, policy, AntiSamy.DOM).getCleanHTML(), not(containsString("javascript&#00058x=alert,x%281%29")));
-    }
-    
-    // TODO: This issue is a valid enhancement request. We are trying to decide whether to implement in the future.
-    // Commenting out the test case for now so test failures aren't included in a released version of AntiSamy.
-/*
-    @Test
-    public void testGithubIssue34a() throws ScanException, PolicyException {
-
-    	// bypass stripNonValidXMLCharacters
-    	// Issue indicates: "<div>Hello\\uD83D\\uDC95</div>" should be sanitized to: "<div>Hello</div>"
-    	
-        String test34a = "<div>Hello\uD83D\uDC95</div>";
-        assertEquals("<div>Hello</div>", as.scan(test34a, policy, AntiSamy.SAX).getCleanHTML());
-        assertEquals("<div>Hello</div>", as.scan(test34a, policy, AntiSamy.DOM).getCleanHTML());
-    }
 
-    @Test
-    public void testGithubIssue34b() throws ScanException, PolicyException {
-
-    	// bypass stripNonValidXMLCharacters
-    	// Issue indicates: "<div>Hello\\uD83D\\uDC95</div>" should be sanitized to: "<div>Hello</div>"
-    	
-        String test34b = "\uD888";
-        assertEquals("", as.scan(test34b, policy, AntiSamy.DOM).getCleanHTML());
-        assertEquals("", as.scan(test34b, policy, AntiSamy.SAX).getCleanHTML());
-    }
-*/
+    String html = "<![CDATA[]><script>alert(1)</script><![CDATA[]>]]><script>alert(2)</script>>]]>";
+    String crDom = as.scan(html, policy, AntiSamy.DOM).getCleanHTML();
+    String crSax = as.scan(html, policy, AntiSamy.SAX).getCleanHTML();
+    assertTrue(!crDom.contains("<script>"));
+    assertTrue(!crSax.contains("<script>"));
+  }
+
+  @Test
+  public void issue101InternationalCharacterSupport() throws ScanException, PolicyException {
+    Policy revised = policy.cloneWithDirective(Policy.ENTITY_ENCODE_INTL_CHARS, "false");
+
+    String html = "<b>letter 'a' with umlaut: \u00e4";
+    String crDom = as.scan(html, revised, AntiSamy.DOM).getCleanHTML();
+    String crSax = as.scan(html, revised, AntiSamy.SAX).getCleanHTML();
+    assertTrue(crDom.contains("\u00e4"));
+    assertTrue(crSax.contains("\u00e4"));
+
+    Policy revised2 = policy.cloneWithDirective(Policy.ENTITY_ENCODE_INTL_CHARS, "true");
+    crDom = as.scan(html, revised2, AntiSamy.DOM).getCleanHTML();
+    crSax = as.scan(html, revised2, AntiSamy.SAX).getCleanHTML();
+    assertTrue(!crDom.contains("\u00e4"));
+    assertTrue(crDom.contains("&auml;"));
+    assertTrue(!crSax.contains("\u00e4"));
+    assertTrue(crSax.contains("&auml;"));
+  }
+
+  @Test
+  public void iframeAsReportedByOndrej() throws ScanException, PolicyException {
+    String html = "<iframe></iframe>";
+
+    Tag tag = new Tag("iframe", Collections.<String, Attribute>emptyMap(), Policy.ACTION_VALIDATE);
+    Policy revised = policy.addTagRule(tag);
+
+    String crDom = as.scan(html, revised, AntiSamy.DOM).getCleanHTML();
+    String crSax = as.scan(html, revised, AntiSamy.SAX).getCleanHTML();
+
+    assertTrue(html.equals(crDom));
+    assertTrue(html.equals(crSax));
+  }
+
+  /*
+   * Tests cases dealing with nofollowAnchors directive. Assumes anchor tags
+   * have an action set to "validate" (may be implicit) in the policy file.
+   */
+  @Test
+  public void nofollowAnchors() throws ScanException, PolicyException {
+
+    // if we have activated nofollowAnchors
+    Policy revisedPolicy = policy.cloneWithDirective(Policy.ANCHORS_NOFOLLOW, "true");
+
+    // adds when not present
+    assertTrue(
+        as.scan("<a href=\"blah\">link</a>", revisedPolicy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
+    assertTrue(
+        as.scan("<a href=\"blah\">link</a>", revisedPolicy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
+
+    // adds properly even with bad attr
+    assertTrue(
+        as.scan("<a href=\"blah\" bad=\"true\">link</a>", revisedPolicy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
+    assertTrue(
+        as.scan("<a href=\"blah\" bad=\"true\">link</a>", revisedPolicy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
+
+    // rel with bad value gets corrected
+    assertTrue(
+        as.scan("<a href=\"blah\" rel=\"blh\">link</a>", revisedPolicy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
+    assertTrue(
+        as.scan("<a href=\"blah\" rel=\"blh\">link</a>", revisedPolicy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
+
+    // correct attribute doesn't get messed with
+    assertTrue(
+        as.scan("<a href=\"blah\" rel=\"nofollow\">link</a>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
+    assertTrue(
+        as.scan("<a href=\"blah\" rel=\"nofollow\">link</a>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
+
+    // if two correct attributes, only one remaining after scan
+    assertTrue(
+        as.scan("<a href=\"blah\" rel=\"nofollow\" rel=\"nofollow\">link</a>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
+    assertTrue(
+        as.scan("<a href=\"blah\" rel=\"nofollow\" rel=\"nofollow\">link</a>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("<a href=\"blah\" rel=\"nofollow\">link</a>"));
+
+    // test if value is off - does it add?
+    assertTrue(
+        !as.scan("a href=\"blah\">link</a>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("nofollow"));
+    assertTrue(
+        !as.scan("a href=\"blah\">link</a>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("nofollow"));
+  }
+
+  @Test
+  public void validateParamAsEmbed() throws ScanException, PolicyException {
+    // activate policy setting for this test
+    Policy revised =
+        policy
+            .cloneWithDirective(Policy.VALIDATE_PARAM_AS_EMBED, "true")
+            .cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
+
+    // let's start with a YouTube embed
+    String input =
+        "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
+    String expectedOutput =
+        "<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\"></embed></object>";
+    CleanResults cr = as.scan(input, revised, AntiSamy.DOM);
+    assertThat(cr.getCleanHTML(), containsString(expectedOutput));
+
+    String saxExpectedOutput =
+        "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
+    cr = as.scan(input, revised, AntiSamy.SAX);
+    assertThat(cr.getCleanHTML(), equalTo(saxExpectedOutput));
+
+    // now what if someone sticks malicious URL in the value of the
+    // value attribute in the param tag? remove that param tag
+    input =
+        "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://supermaliciouscode.com/badstuff.swf\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
+    expectedOutput =
+        "<object height=\"340\" width=\"560\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed allowfullscreen=\"true\" allowscriptaccess=\"always\" height=\"340\" src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" width=\"560\"></embed></object>";
+    saxExpectedOutput =
+        "<object width=\"560\" height=\"340\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"><embed src=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
+    cr = as.scan(input, revised, AntiSamy.DOM);
+    assertThat(cr.getCleanHTML(), containsString(expectedOutput));
+
+    cr = as.scan(input, revised, AntiSamy.SAX);
+    assertThat(cr.getCleanHTML(), equalTo(saxExpectedOutput));
+
+    // now what if someone sticks malicious URL in the value of the src
+    // attribute in the embed tag? remove that embed tag
+    input =
+        "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&hl=en&fs=1&\"></param><param name=\"allowFullScreen\" value=\"true\"></param><param name=\"allowscriptaccess\" value=\"always\"></param><embed src=\"http://hereswhereikeepbadcode.com/ohnoscary.swf\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" allowfullscreen=\"true\" width=\"560\" height=\"340\"></embed></object>";
+    expectedOutput =
+        "<object height=\"340\" width=\"560\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"></object>";
+    saxExpectedOutput =
+        "<object width=\"560\" height=\"340\"><param name=\"movie\" value=\"http://www.youtube.com/v/IyAyd4WnvhU&amp;hl=en&amp;fs=1&amp;\"><param name=\"allowFullScreen\" value=\"true\"><param name=\"allowscriptaccess\" value=\"always\"></object>";
+
+    cr = as.scan(input, revised, AntiSamy.DOM);
+    assertThat(cr.getCleanHTML(), containsString(expectedOutput));
+    CleanResults scan = as.scan(input, revised, AntiSamy.SAX);
+    assertThat(scan.getCleanHTML(), equalTo(saxExpectedOutput));
+  }
+
+  @Test
+  public void compareSpeedsShortStrings() throws IOException, ScanException, PolicyException {
+
+    double totalDomTime = 0;
+    double totalSaxTime = 0;
+
+    int testReps = 1000;
+
+    String html = "<body> hey you <img/> out there on your own </body>";
+
+    for (int j = 0; j < testReps; j++) {
+      totalDomTime += as.scan(html, policy, AntiSamy.DOM).getScanTime();
+      totalSaxTime += as.scan(html, policy, AntiSamy.SAX).getScanTime();
+    }
+
+    System.out.println("Total DOM time short string: " + totalDomTime);
+    System.out.println("Total SAX time short string: " + totalSaxTime);
+  }
+
+  @Test
+  public void profileDom() throws IOException, ScanException, PolicyException {
+    runProfiledTest(AntiSamy.DOM);
+  }
+
+  @Test
+  public void profileSax() throws IOException, ScanException, PolicyException {
+    runProfiledTest(AntiSamy.SAX);
+  }
+
+  private void runProfiledTest(int scanType) throws ScanException, PolicyException {
+    double totalDomTime;
+
+    warmup(scanType);
+
+    int testReps = 9999;
+
+    String html = "<body> hey you <img/> out there on your own </body>";
+
+    Double each = 0D;
+    int repeats = 10;
+    for (int i = 0; i < repeats; i++) {
+      totalDomTime = 0;
+      for (int j = 0; j < testReps; j++) {
+        totalDomTime += as.scan(html, policy, scanType).getScanTime();
+      }
+      each = each + totalDomTime;
+      System.out.println(
+          "Total "
+              + (scanType == AntiSamy.DOM ? "DOM" : "SAX")
+              + " time 9999 reps short string: "
+              + totalDomTime);
+    }
+    System.out.println("Average time: " + (each / repeats));
+  }
+
+  private void warmup(int scanType) throws ScanException, PolicyException {
+    int warmupReps = 15000;
+
+    String html = "<body> hey you <img/> out there on your own </body>";
+
+    for (int j = 0; j < warmupReps; j++) {
+      as.scan(html, policy, scanType).getScanTime();
+    }
+  }
+
+  @Test
+  public void comparePatternSpeed() throws IOException, ScanException, PolicyException {
+
+    final Pattern invalidXmlCharacters =
+        Pattern.compile(
+            "[\\u0000-\\u001F\\uD800-\\uDFFF\\uFFFE-\\uFFFF&&[^\\u0009\\u000A\\u000D]]");
+
+    int testReps = 10000;
+
+    String html = "<body> hey you <img/> out there on your own </body>";
+
+    String s = null;
+    // long start = System.currentTimeMillis();
+    for (int j = 0; j < testReps; j++) {
+      s = invalidXmlCharacters.matcher(html).replaceAll("");
+    }
+    // long total = System.currentTimeMillis() - start;
+
+    // start = System.currentTimeMillis();
+    Matcher matcher;
+    for (int j = 0; j < testReps; j++) {
+      matcher = invalidXmlCharacters.matcher(html);
+      if (matcher.matches()) {
+        s = matcher.replaceAll("");
+      }
+    }
+    // long total2 = System.currentTimeMillis() - start;
+
+    assertNotNull(s);
+    // System.out.println("replaceAllDirect " + total);
+    // System.out.println("match then replace: " + total2);
+  }
+
+  @Test
+  public void testOnsiteRegex() throws ScanException, PolicyException {
+    assertIsGoodOnsiteURL("foo");
+    assertIsGoodOnsiteURL("/foo/bar");
+    assertIsGoodOnsiteURL("../../di.cgi?foo&amp;3D~");
+    assertIsGoodOnsiteURL("/foo/bar/1/sdf;jsessiond=1f1f12312_123123");
+  }
+
+  void assertIsGoodOnsiteURL(String url) throws ScanException, PolicyException {
+    String html = as.scan("<a href=\"" + url + "\">X</a>", policy, AntiSamy.DOM).getCleanHTML();
+    assertThat(html, containsString("href=\""));
+  }
+
+  @Test
+  public void issue10() throws ScanException, PolicyException {
+    assertFalse(
+        as.scan("<a href=\"javascript&colon;alert&lpar;1&rpar;\">X</a>", policy, AntiSamy.DOM)
+            .getCleanHTML()
+            .contains("javascript"));
+    assertFalse(
+        as.scan("<a href=\"javascript&colon;alert&lpar;1&rpar;\">X</a>", policy, AntiSamy.SAX)
+            .getCleanHTML()
+            .contains("javascript"));
+  }
+
+  @Test
+  public void issue147() throws ScanException, PolicyException {
+    URL url = getClass().getResource("/antisamy-tinymce.xml");
+
+    Policy pol = Policy.getInstance(url);
+    as.scan("<table><tr><td></td></tr></table>", pol, AntiSamy.DOM);
+  }
+
+  @Test
+  public void issue75() throws ScanException, PolicyException {
+    URL url = getClass().getResource("/antisamy-tinymce.xml");
+    Policy pol = Policy.getInstance(url);
+    as.scan("<script src=\"<. \">\"></script>", pol, AntiSamy.DOM);
+    as.scan("<script src=\"<. \">\"></script>", pol, AntiSamy.SAX);
+  }
+
+  @Test
+  public void issue144() throws ScanException, PolicyException {
+    String pinata = "pi\u00f1ata";
+    CleanResults results = as.scan(pinata, policy, AntiSamy.DOM);
+    String cleanHTML = results.getCleanHTML();
+    assertEquals(pinata, cleanHTML);
+  }
+
+  @Test
+  public void testWhitespaceNotBeingMangled() throws ScanException, PolicyException {
+    String test = "<select name=\"name\"><option value=\"Something\">Something</select>";
+    String expected =
+        "<select name=\"name\"><option value=\"Something\">Something</option></select>";
+    Policy preserveSpace = policy.cloneWithDirective(Policy.PRESERVE_SPACE, "true");
+    CleanResults preserveSpaceResults = as.scan(test, preserveSpace, AntiSamy.SAX);
+    assertEquals(expected, preserveSpaceResults.getCleanHTML());
+  }
+
+  @Test
+  public void testDataTag159() throws ScanException, PolicyException {
+    /* issue #159 - allow dynamic HTML5 data-* attribute */
+    String good = "<p data-tag=\"abc123\">Hello World!</p>";
+    String bad = "<p dat-tag=\"abc123\">Hello World!</p>";
+    String goodExpected = "<p data-tag=\"abc123\">Hello World!</p>";
+    String badExpected = "<p>Hello World!</p>";
+    // test good attribute "data-"
+    CleanResults cr = as.scan(good, policy, AntiSamy.SAX);
+    String s = cr.getCleanHTML();
+    assertEquals(goodExpected, s);
+    cr = as.scan(good, policy, AntiSamy.DOM);
+    s = cr.getCleanHTML();
+    assertEquals(goodExpected, s);
+
+    // test bad attribute "dat-"
+    cr = as.scan(bad, policy, AntiSamy.SAX);
+    s = cr.getCleanHTML();
+    assertEquals(badExpected, s);
+    cr = as.scan(bad, policy, AntiSamy.DOM);
+    s = cr.getCleanHTML();
+    assertEquals(badExpected, s);
+  }
+
+  @Test
+  public void testXSSInAntiSamy151() throws ScanException, PolicyException {
+    String test =
+        "<bogus>whatever</bogus><img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\" "
+            + "onmouseover=\"alert('xss')\">";
+    CleanResults results_sax = as.scan(test, policy, AntiSamy.SAX);
+    CleanResults results_dom = as.scan(test, policy, AntiSamy.DOM);
+
+    assertEquals(results_sax.getCleanHTML(), results_dom.getCleanHTML());
+    assertEquals(
+        "whatever<img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\">",
+        results_dom.getCleanHTML());
+  }
+
+  @Test
+  public void testAnotherXSS() throws ScanException, PolicyException {
+    String test = "<a href=\"http://example.com\"&amp;/onclick=alert(9)>foo</a>";
+    CleanResults results_sax = as.scan(test, policy, AntiSamy.SAX);
+    CleanResults results_dom = as.scan(test, policy, AntiSamy.DOM);
+
+    assertEquals(results_sax.getCleanHTML(), results_dom.getCleanHTML());
+    assertEquals(
+        "<a href=\"http://example.com\" rel=\"nofollow\">foo</a>", results_dom.getCleanHTML());
+  }
+
+  @Test
+  public void testIssue2() throws ScanException, PolicyException {
+    String test = "<style onload=alert(1)>h1 {color:red;}</style>";
+    assertThat(as.scan(test, policy, AntiSamy.DOM).getCleanHTML(), not(containsString("alert")));
+    assertThat(as.scan(test, policy, AntiSamy.SAX).getCleanHTML(), not(containsString("alert")));
+  }
+
+  /*
+   * Mailing list user sent this in. Didn't work, but good test to leave in.
+   */
+  @Test
+  public void testUnknownTags() throws ScanException, PolicyException {
+    String test = "<%/onmouseover=prompt(1)>";
+    CleanResults saxResults = as.scan(test, policy, AntiSamy.SAX);
+    CleanResults domResults = as.scan(test, policy, AntiSamy.DOM);
+    assertThat(saxResults.getCleanHTML(), not(containsString("<%/")));
+    assertThat(domResults.getCleanHTML(), not(containsString("<%/")));
+  }
+
+  @Test
+  public void testStreamScan() throws ScanException {
+    String testImgSrcURL =
+        "<img src=\"https://ssl.gstatic.com/codesite/ph/images/defaultlogo.png\"";
+    Reader reader =
+        new StringReader(
+            "<bogus>whatever</bogus>" + testImgSrcURL + " onmouseover=\"alert('xss')\">");
+    Writer writer = new StringWriter();
+    as.scan(reader, writer, policy);
+    String cleanHtml = writer.toString().trim();
+    assertEquals("whatever" + testImgSrcURL + ">", cleanHtml);
+  }
+
+  @Test
+  public void testGithubIssue23() throws ScanException, PolicyException {
+
+    // Antisamy Stripping nested lists and tables
+    String test23 = "<ul><li>one</li><li>two</li><li>three<ul><li>a</li><li>b</li></ul></li></ul>";
+    // Issue claims you end up with this:
+    //    <ul><li>one</li><li>two</li><li>three<ul></ul></li><li>a</li><li>b</li></ul>
+    // Meaning the <li>a</li><li>b</li> elements were moved outside of the nested <ul> list they
+    // were in
+
+    // The a.replaceAll("\\s","") is used to strip out all the whitespace in the CleanHTML so we
+    // can successfully find
+    // what we expect to find.
+    assertThat(
+        as.scan(test23, policy, AntiSamy.DOM).getCleanHTML().replaceAll("\\s", ""),
+        containsString("<ul><li>a</li>"));
+    assertThat(
+        as.scan(test23, policy, AntiSamy.SAX).getCleanHTML().replaceAll("\\s", ""),
+        containsString("<ul><li>a</li>"));
+
+    // However, the test above can't replicate this misbehavior.
+  }
+
+  // TODO: This issue is a valid enhancement request we plan to implement in the future.
+  // Commenting out the test case for now so test failures aren't included in a released version
+  // of AntiSamy.
+  /*    @Test
+      public void testGithubIssue24() throws ScanException, PolicyException {
+
+          // if we have onUnknownTag set to encode, it still strips out the @ and everything else after the it
+      	// DOM Parser actually rips out the entire <name@mail.com> value even with onUnknownTag set
+          TestPolicy revisedPolicy = policy.cloneWithDirective("onUnknownTag", "encode");
+
+      	String email = "name@mail.com";
+          String test24 = "firstname,lastname<" + email + ">";
+          assertThat(as.scan(test24, revisedPolicy, AntiSamy.SAX).getCleanHTML(), containsString(email));
+          assertThat(as.scan(test24, revisedPolicy, AntiSamy.DOM).getCleanHTML(), containsString(email));
+      }
+  */
+  @Test
+  public void testGithubIssue26() throws ScanException, PolicyException {
+    // Potential bypass (False positive)
+    String test26 =
+        "&#x22;&#x3E;&#x3C;&#x69;&#x6D;&#x67;&#x20;&#x73;&#x72;&#x63;&#x3D;&#x61;&#x20;&#x6F;&#x6E;&#x65;&#x72;&#x72;&#x6F;&#x72;&#x3D;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;&#x3E;";
+    // Issue claims you end up with this:
+    //   ><img src=a onerror=alert(1)>
+
+    assertThat(
+        as.scan(test26, policy, AntiSamy.SAX).getCleanHTML(),
+        not(containsString("<img src=a onerror=alert(1)>")));
+    assertThat(
+        as.scan(test26, policy, AntiSamy.DOM).getCleanHTML(),
+        not(containsString("<img src=a onerror=alert(1)>")));
+
+    // But you actually end up with this: &quot;&gt;&lt;img src=a onerror=alert(1)&gt; -- Which
+    // is as expected
+  }
+
+  @Test
+  public void testGithubIssue27() throws ScanException, PolicyException {
+    // This test doesn't cause an ArrayIndexOutOfBoundsException, as reported in this issue even
+    // though it
+    // replicates the test as described.
+    String test27 = "my &test";
+    assertThat(as.scan(test27, policy, AntiSamy.DOM).getCleanHTML(), containsString("test"));
+    assertThat(as.scan(test27, policy, AntiSamy.SAX).getCleanHTML(), containsString("test"));
+  }
+
+  static final String test33 =
+      "<html>\n"
+          + "<head>\n"
+          + "  <title>Test</title>\n"
+          + "</head>\n"
+          + "<body>\n"
+          + "  <h1>Tricky Encoding</h1>\n"
+          + "  <h2>NOT Sanitized by AntiSamy</h2>\n"
+          + "  <ol>\n"
+          + "    <li><a href=\"javascript&#00058x=alert,x%281%29\">X&#00058;x</a></li>\n"
+          + "    <li><a href=\"javascript&#00058y=alert,y%281%29\">X&#00058;y</a></li>\n"
+          + "    <li><a href=\"javascript&#58x=alert,x%281%29\">X&#58;x</a></li>\n"
+          + "    <li><a href=\"javascript&#58y=alert,y%281%29\">X&#58;y</a></li>\n"
+          + "    <li><a href=\"javascript&#x0003Ax=alert,x%281%29\">X&#x0003A;x</a></li>\n"
+          + "    <li><a href=\"javascript&#x0003Ay=alert,y%281%29\">X&#x0003A;y</a></li>\n"
+          + "    <li><a href=\"javascript&#x3Ax=alert,x%281%29\">X&#x3A;x</a></li>\n"
+          + "    <li><a href=\"javascript&#x3Ay=alert,y%281%29\">X&#x3A;y</a></li>\n"
+          + "  </ol>\n"
+          + "  <h1>Tricky Encoding with Ampersand Encoding</h1>\n"
+          + "  <p>AntiSamy turns harmless payload into XSS by just decoding the encoded ampersands in the href attribute</a>\n"
+          + "  <ol>\n"
+          + "    <li><a href=\"javascript&amp;#x3Ax=alert,x%281%29\">X&amp;#x3A;x</a></li>\n"
+          + "    <li><a href=\"javascript&AMP;#x3Ax=alert,x%281%29\">X&AMP;#x3A;x</a></li>\n"
+          + "    <li><a href=\"javascript&#38;#x3Ax=alert,x%281%29\">X&#38;#x3A;x</a></li>\n"
+          + "    <li><a href=\"javascript&#00038;#x3Ax=alert,x%281%29\">X&#00038;#x3A;x</a></li>\n"
+          + "    <li><a href=\"javascript&#x26;#x3Ax=alert,x%281%29\">X&#x26;#x3A;x</a></li>\n"
+          + "    <li><a href=\"javascript&#x00026;#x3Ax=alert,x%281%29\">X&#x00026;#x3A;x</a></li>\n"
+          + "  </ol>\n"
+          + "  <p><a href=\"javascript&#x3Ax=alert,x%281%29\">Original without ampersand encoding</a></p>\n"
+          + "</body>\n"
+          + "</html>";
 
-    static final String test40 = "<html>\n"
+  @Test
+  public void testGithubIssue33() throws ScanException, PolicyException {
+
+    // Potential bypass
+
+    // Issue claims you end up with this:
+    //   javascript:x=alert and other similar problems (javascript&#00058x=alert,x%281%29) but
+    // you don't.
+    //   So issue is a false positive and has been closed.
+    // System.out.println(as.scan(test33, policy, AntiSamy.SAX).getCleanHTML());
+
+    assertThat(
+        as.scan(test33, policy, AntiSamy.SAX).getCleanHTML(),
+        not(containsString("javascript&#00058x=alert,x%281%29")));
+    assertThat(
+        as.scan(test33, policy, AntiSamy.DOM).getCleanHTML(),
+        not(containsString("javascript&#00058x=alert,x%281%29")));
+  }
+
+  // TODO: This issue is a valid enhancement request. We are trying to decide whether to implement
+  // in the future.
+  // Commenting out the test case for now so test failures aren't included in a released version
+  // of AntiSamy.
+  /*
+      @Test
+      public void testGithubIssue34a() throws ScanException, PolicyException {
+
+      	// bypass stripNonValidXMLCharacters
+      	// Issue indicates: "<div>Hello\\uD83D\\uDC95</div>" should be sanitized to: "<div>Hello</div>"
+
+          String test34a = "<div>Hello\uD83D\uDC95</div>";
+          assertEquals("<div>Hello</div>", as.scan(test34a, policy, AntiSamy.SAX).getCleanHTML());
+          assertEquals("<div>Hello</div>", as.scan(test34a, policy, AntiSamy.DOM).getCleanHTML());
+      }
+
+      @Test
+      public void testGithubIssue34b() throws ScanException, PolicyException {
+
+      	// bypass stripNonValidXMLCharacters
+      	// Issue indicates: "<div>Hello\\uD83D\\uDC95</div>" should be sanitized to: "<div>Hello</div>"
+
+          String test34b = "\uD888";
+          assertEquals("", as.scan(test34b, policy, AntiSamy.DOM).getCleanHTML());
+          assertEquals("", as.scan(test34b, policy, AntiSamy.SAX).getCleanHTML());
+      }
+  */
+
+  static final String test40 =
+      "<html>\n"
           + "<head>\n"
           + "  <title>Test</title>\n"
           + "</head>\n"
@@ -1417,312 +2019,561 @@ public void testGithubIssue34b() throws ScanException, PolicyException {
           + "</body>\n"
           + "</html>";
 
-    @Test
-    public void testGithubIssue40() throws ScanException, PolicyException {
-
-        // Concern is that: <svg onload=alert(1)//  does not get cleansed.
-        // Based on these test results, it does get cleaned so this issue is a false positive, so we closed it.
-
-        assertThat(as.scan(test40, policy, AntiSamy.SAX).getCleanHTML(), not(containsString("<svg onload=alert(1)//")));
-        //System.out.println("SAX parser: " + as.scan(test40, policy, AntiSamy.SAX).getCleanHTML());
-        assertThat(as.scan(test40, policy, AntiSamy.DOM).getCleanHTML(), not(containsString("<svg onload=alert(1)//")));
-        //System.out.println("DOM parser: " + as.scan(test40, policy, AntiSamy.DOM).getCleanHTML());
-    }
-
-    @Test
-    public void testGithubIssue48() throws ScanException, PolicyException {
-
-        // Concern is that onsiteURL regex is not safe for URLs that start with //.
-        // For example:  //evilactor.com?param=foo
-
-        final String phishingAttempt = "<a href=\"//evilactor.com/stealinfo?a=xxx&b=xxx\"><span style=\"color:red;font-size:100px\">"
-                + "You must click me</span></a>";
-
-        // Output: <a rel="nofollow"><span style="color: red;font-size: 100.0px;">You must click me</span></a>
-
-        assertThat(as.scan(phishingAttempt, policy, AntiSamy.SAX).getCleanHTML(), not(containsString("//evilactor.com/")));
-        assertThat(as.scan(phishingAttempt, policy, AntiSamy.DOM).getCleanHTML(), not(containsString("//evilactor.com/")));
-
-        // This ones never failed, they're just to prove a dangling markup attack on the following resulting HTML won't work.
-        // Less probable case (steal more tags):
-        final String danglingMarkup = "<div>User input: " +
-                "<input type=\"text\" name=\"input\" value=\"\"><a href='//evilactor.com?"+
-                "\"> all this info wants to be stolen with <i>danlging markup attack</i>" +
-                " until a single quote to close is found'</div>";
-
-        assertThat(as.scan(danglingMarkup, policy, AntiSamy.SAX).getCleanHTML(), not(containsString("//evilactor.com/")));
-        assertThat(as.scan(danglingMarkup, policy, AntiSamy.DOM).getCleanHTML(), not(containsString("//evilactor.com/")));
-
-        // More probable case (steal just an attribute):
-        //      HTML before attack: <input type="text" name="input" value="" data-attribute-to-steal="some value">
-        final String danglingMarkup2 = "<div>User input: " +
-                "<input type=\"text\" name=\"input\" value=\"\" data-attribute-to-steal=\"some value\">";
-        
-        assertThat(as.scan(danglingMarkup2, policy, AntiSamy.SAX).getCleanHTML(), not(containsString("//evilactor.com/")));
-        assertThat(as.scan(danglingMarkup2, policy, AntiSamy.DOM).getCleanHTML(), not(containsString("//evilactor.com/")));
-    }
-
- @Test
-    public void testGithubIssue62() {
-        // Concern is that when a processing instruction is at the root level, node removal gets messy and Null pointer exception arises.
-        // More test cases are added for PI removal.
-
-        try{
-            assertThat(as.scan("|<?ai aaa", policy, AntiSamy.DOM).getCleanHTML(), is("|"));
-            assertThat(as.scan("|<?ai aaa", policy, AntiSamy.SAX).getCleanHTML(), is("|"));
-
-            assertThat(as.scan("<div>|<?ai aaa", policy, AntiSamy.DOM).getCleanHTML(), is("<div>|</div>"));
-            assertThat(as.scan("<div>|<?ai aaa", policy, AntiSamy.SAX).getCleanHTML(), is("<div>|</div>"));
-
-            assertThat(as.scan("<div><?foo note=\"I am XML processing instruction. I wish to be excluded\" ?></div>", policy, AntiSamy.DOM)
-                    .getCleanHTML(), not(containsString("<?foo")));
-            assertThat(as.scan("<div><?foo note=\"I am XML processing instruction. I wish to be excluded\" ?></div>", policy, AntiSamy.SAX)
-                    .getCleanHTML(), not(containsString("<?foo")));
-
-            assertThat(as.scan("<?xml-stylesheet type=\"text/css\" href=\"style.css\"?>", policy, AntiSamy.DOM).getCleanHTML(), is(""));
-            assertThat(as.scan("<?xml-stylesheet type=\"text/css\" href=\"style.css\"?>", policy, AntiSamy.SAX).getCleanHTML(), is(""));
-
-        } catch (Exception exc) {
-            fail(exc.getMessage());
-        }
-    }
-
-    @Test
-    public void testGithubIssue81() throws ScanException, PolicyException {
-        // Concern is that "!important" is missing after processing CSS
-        assertThat(as.scan("<p style=\"color: red !important\">Some Text</p>", policy, AntiSamy.DOM).getCleanHTML(), containsString("!important"));
-        assertThat(as.scan("<p style=\"color: red !important\">Some Text</p>", policy, AntiSamy.SAX).getCleanHTML(), containsString("!important"));
-
-        // Just to check scan keeps working accordingly without "!important"
-        assertThat(as.scan("<p style=\"color: red\">Some Text</p>", policy, AntiSamy.DOM).getCleanHTML(), not(containsString("!important")));
-        assertThat(as.scan("<p style=\"color: red\">Some Text</p>", policy, AntiSamy.SAX).getCleanHTML(), not(containsString("!important")));
-    }
-
-    @Test
-    public void entityReferenceEncodedInHtmlAttribute() throws ScanException, PolicyException {
-        // Concern is that "&" is not being encoded and "#00058" was not being interpreted as ":"
-        // so the validations based on regexp passed and a browser would load "&:" together.
-
-        // UPDATE:  Using a new HTML parser library starts decoding entities like #00058
-        assertThat(as.scan("<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>", policy, AntiSamy.DOM).getCleanHTML(),
-                not(containsString("javascript")));
-        assertThat(as.scan("<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>", policy, AntiSamy.SAX).getCleanHTML(),
-                not(containsString("javascript")));
-    }
-
-    @Test
-    public void testGithubIssue99() throws ScanException, PolicyException {
-        // Test that the IANA subtags is not lost
-        assertThat(as.scan("<p lang=\"en-GB\">This paragraph is defined as British English.</p>", policy, AntiSamy.DOM).getCleanHTML(), containsString("lang=\"en-GB\""));
-        assertThat(as.scan("<p lang=\"en-GB\">This paragraph is defined as British English.</p>", policy, AntiSamy.SAX).getCleanHTML(), containsString("lang=\"en-GB\""));
-    }
-
-    @Test
-    public void testGithubIssue101() throws ScanException, PolicyException {
-        // Test that margin attribute is not removed when value has too much significant figures.
-        // Current behavior is that decimals like 0.0001 are internally translated to 1.0E-4, this
-        // is reflected on regex validation and actual output. The inconsistency is due to Batik CSS.
-        assertThat(as.scan("<p style=\"margin: 0.0001pt;\">Some text.</p>", policy, AntiSamy.DOM).getCleanHTML(), containsString("margin"));
-        assertThat(as.scan("<p style=\"margin: 0.0001pt;\">Some text.</p>", policy, AntiSamy.SAX).getCleanHTML(), containsString("margin"));
-        assertThat(as.scan("<p style=\"margin: 10000000pt;\">Some text.</p>", policy, AntiSamy.DOM).getCleanHTML(), containsString("margin"));
-        assertThat(as.scan("<p style=\"margin: 10000000pt;\">Some text.</p>", policy, AntiSamy.SAX).getCleanHTML(), containsString("margin"));
-        assertThat(as.scan("<p style=\"margin: 1.0E-4pt;\">Some text.</p>", policy, AntiSamy.DOM).getCleanHTML(), containsString("margin"));
-        assertThat(as.scan("<p style=\"margin: 1.0E-4pt;\">Some text.</p>", policy, AntiSamy.SAX).getCleanHTML(), containsString("margin"));
-        // When using exponential directly the "e" or "E" is internally considered as the start of
-        // the dimension/unit type. This creates inconsistencies that make the regex validation fail,
-        // also in cases like 1e4pt where "e" is considered as dimension instead of "pt".
-        assertThat(as.scan("<p style=\"margin: 1.0E+4pt;\">Some text.</p>", policy, AntiSamy.DOM).getCleanHTML(), not(containsString("margin")));
-        assertThat(as.scan("<p style=\"margin: 1.0E+4pt;\">Some text.</p>", policy, AntiSamy.SAX).getCleanHTML(), not(containsString("margin")));
-    }
-
-    @Test
-    public void testCSSUnits() throws ScanException, PolicyException {
-        String input = "<div style=\"width:50vw;height:50vh;padding:1rpc;\">\n" +
-                "\t<p style=\"font-size:1.5ex;padding-left:1rem;padding-top:16px;\">Some text.</p>\n" +
-                "</div>";
-        CleanResults cr = as.scan(input, policy, AntiSamy.DOM);
-        assertThat(cr.getCleanHTML(), containsString("ex"));
-        assertThat(cr.getCleanHTML(), containsString("px"));
-        assertThat(cr.getCleanHTML(), containsString("rem"));
-        assertThat(cr.getCleanHTML(), containsString("vw"));
-        assertThat(cr.getCleanHTML(), containsString("vh"));
-        assertThat(cr.getCleanHTML(), not(containsString("rpc")));
-        cr = as.scan(input, policy, AntiSamy.SAX);
-        assertThat(cr.getCleanHTML(), containsString("ex"));
-        assertThat(cr.getCleanHTML(), containsString("px"));
-        assertThat(cr.getCleanHTML(), containsString("rem"));
-        assertThat(cr.getCleanHTML(), containsString("vw"));
-        assertThat(cr.getCleanHTML(), containsString("vh"));
-        assertThat(cr.getCleanHTML(), not(containsString("rpc")));
-    }
-
-    @Test
-    public void testXSSInsideSelectOptionStyle() throws ScanException, PolicyException {
-        // Tests for CVE-2021-42575, XSS nested into <select>+<option>+<style>
-
-        // Safe case, to test legit style
-        assertThat(as.scan("<select><option><style>h1{color:black;}</style></option></select>", policy, AntiSamy.DOM).getCleanHTML(), containsString("black"));
-        assertThat(as.scan("<select><option><style>h1{color:black;}</style></option></select>", policy, AntiSamy.SAX).getCleanHTML(), containsString("black"));
-        // Unsafe case
-        assertThat(as.scan("<select><option><style><script>alert(1)</script></style></option></select>", policy, AntiSamy.DOM).getCleanHTML(), not(containsString("<script>")));
-        assertThat(as.scan("<select><option><style><script>alert(1)</script></style></option></select>", policy, AntiSamy.SAX).getCleanHTML(), not(containsString("<script>")));
-    }
-
-    @Test
-    public void testImportedStylesParsing() throws ScanException, PolicyException {
-        // Test that imported style sheets can be parsed and order is correct
-        final String input = "<style type='text/css'>\n" +
-                "\t@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/classic.css);\n" +
-                "\t@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/providers.css);\n" +
-                "\t.very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}\n" +
-                "</style>";
-        Policy revised = policy.cloneWithDirective(Policy.EMBED_STYLESHEETS,"true").cloneWithDirective(Policy.FORMAT_OUTPUT,"false");
-        // Styles are imported
-        String cleanHtmlDOM = as.scan(input, revised, AntiSamy.DOM).getCleanHTML();
-        String cleanHtmlSAX = as.scan(input, revised, AntiSamy.SAX).getCleanHTML();
-        assertThat(cleanHtmlDOM, not(containsString("<![CDATA[/* */]]>")));
-        assertThat(cleanHtmlSAX, not(containsString("<![CDATA[/* */]]>")));
-        // Order is correct:
-        //  First import: grid_1 class
-        //  Second import: janrain-provider150-sprit class
-        //  Original styles: very-specific-antisamy class
-        final Pattern p = Pattern.compile(".*?\\.grid_1.*?\\.janrain-provider150-sprit.*?\\.very-specific-antisamy.*?", Pattern.DOTALL);
-        assertThat(cleanHtmlDOM, MatchesPattern.matchesPattern(p));
-        assertThat(cleanHtmlSAX, MatchesPattern.matchesPattern(p));
-
-        Policy revised2 = policy.cloneWithDirective(Policy.EMBED_STYLESHEETS,"false").cloneWithDirective(Policy.FORMAT_OUTPUT,"false");
-        // Styles are not imported
-        cleanHtmlDOM = as.scan(input, revised2, AntiSamy.DOM).getCleanHTML();
-        cleanHtmlSAX = as.scan(input, revised2, AntiSamy.SAX).getCleanHTML();
-        assertThat(cleanHtmlDOM, not(containsString(".grid_1")));
-        assertThat(cleanHtmlSAX, not(containsString(".grid_1")));
-        assertThat(cleanHtmlDOM, not(containsString(".janrain-provider150-sprit")));
-        assertThat(cleanHtmlSAX, not(containsString(".janrain-provider150-sprit")));
-    }
-
-    @Test
-    public void testNoopenerAndNoreferrer() throws ScanException, PolicyException {
-        Map<String, Attribute> map = new HashMap<>();
-        map.put("target", new Attribute("a", Collections.<Pattern>emptyList(), Arrays.asList( "_blank", "_self" ), "",""));
-        map.put("rel", new Attribute("a", Collections.<Pattern>emptyList(), Arrays.asList( "nofollow", "noopener", "noreferrer"), "",""));
-        Tag tag = new Tag("a", map, Policy.ACTION_VALIDATE);
-        Policy basePolicy = policy.mutateTag(tag);
-        Policy revised = basePolicy.cloneWithDirective(Policy.ANCHORS_NOFOLLOW,"true").cloneWithDirective(Policy.ANCHORS_NOOPENER_NOREFERRER,"true");
-        // No target="_blank", so only nofollow can be added.
-        assertThat(as.scan("<a>Link text</a>", revised, AntiSamy.DOM).getCleanHTML(), both(containsString("nofollow")).and(not(containsString("noopener noreferrer"))));
-        assertThat(as.scan("<a>Link text</a>", revised, AntiSamy.SAX).getCleanHTML(), both(containsString("nofollow")).and(not(containsString("noopener noreferrer"))));
-        // target="_blank", can have both.
-        assertThat(as.scan("<a target=\"_blank\">Link text</a>", revised, AntiSamy.DOM).getCleanHTML(), containsString("nofollow noopener noreferrer"));
-        assertThat(as.scan("<a target=\"_blank\">Link text</a>", revised, AntiSamy.SAX).getCleanHTML(), containsString("nofollow noopener noreferrer"));
-
-        Policy revised2 = basePolicy.cloneWithDirective(Policy.ANCHORS_NOFOLLOW,"false").cloneWithDirective(Policy.ANCHORS_NOOPENER_NOREFERRER,"true");
-        // No target="_blank", no rel added.
-        assertThat(as.scan("<a>Link text</a>", revised2, AntiSamy.DOM).getCleanHTML(), not(containsString("rel=")));
-        assertThat(as.scan("<a>Link text</a>", revised2, AntiSamy.SAX).getCleanHTML(), not(containsString("rel=")));
-        // target="_blank", everything present.
-        assertThat(as.scan("<a target='_blank' rel='nofollow'>Link text</a>", revised2, AntiSamy.DOM).getCleanHTML(), containsString("nofollow noopener noreferrer"));
-        assertThat(as.scan("<a target='_blank' rel='nofollow'>Link text</a>", revised2, AntiSamy.SAX).getCleanHTML(), containsString("nofollow noopener noreferrer"));
-        // target="_self", no rel added.
-        assertThat(as.scan("<a target='_self'>Link text</a>", revised2, AntiSamy.DOM).getCleanHTML(), not(containsString("rel=")));
-        assertThat(as.scan("<a target='_self'>Link text</a>", revised2, AntiSamy.SAX).getCleanHTML(), not(containsString("rel=")));
-        // target="_self", only nofollow present.
-        assertThat(as.scan("<a target='_self' rel='nofollow'>Link text</a>", revised2, AntiSamy.DOM).getCleanHTML(), both(containsString("nofollow")).and(not(containsString("noopener noreferrer"))));
-        assertThat(as.scan("<a target='_self' rel='nofollow'>Link text</a>", revised2, AntiSamy.SAX).getCleanHTML(), both(containsString("nofollow")).and(not(containsString("noopener noreferrer"))));
-        // noopener is not repeated
-        assertThat(as.scan("<a target='_blank' rel='noopener'>Link text</a>", revised2, AntiSamy.DOM).getCleanHTML().split("noopener").length, is(2));
-        assertThat(as.scan("<a target='_blank' rel='noopener'>Link text</a>", revised2, AntiSamy.SAX).getCleanHTML().split("noopener").length, is(2));
-
-        Policy revised3 = basePolicy.cloneWithDirective(Policy.ANCHORS_NOFOLLOW,"false").cloneWithDirective(Policy.ANCHORS_NOOPENER_NOREFERRER,"false");
-        // No rel added
-        assertThat(as.scan("<a>Link text</a>", revised3, AntiSamy.DOM).getCleanHTML(), not(containsString("rel=")));
-        assertThat(as.scan("<a>Link text</a>", revised3, AntiSamy.SAX).getCleanHTML(), not(containsString("rel=")));
-        // noopener is not repeated
-        assertThat(as.scan("<a target='_blank' rel='noopener'>Link text</a>", revised3, AntiSamy.DOM).getCleanHTML().split("noopener").length, is(2));
-        assertThat(as.scan("<a target='_blank' rel='noopener'>Link text</a>", revised3, AntiSamy.SAX).getCleanHTML().split("noopener").length, is(2));
-    }
-
-    @Test
-    public void testLeadingDashOnPropertyName() throws ScanException, PolicyException {
-        // Test that property names with leading dash are supported, reported on issue #125.
-        final String input = "<style type='text/css'>\n" +
-                "\t.very-specific-antisamy { -moz-border-radius: inherit ; -webkit-border-radius: 25px 10px 5px 10px;}\n" +
-                "</style>";
-        // Define new properties for the policy
-        Pattern customPattern = Pattern.compile("\\d+(\\.\\d+)?px( \\d+(\\.\\d+)?px){0,3}", Pattern.DOTALL);
-        Property leadingDashProperty1 = new Property("-webkit-border-radius", Arrays.asList(customPattern), Collections.<String>emptyList(),Collections.<String>emptyList(),"","");
-        Property leadingDashProperty2 = new Property("-moz-border-radius", Collections.<Pattern>emptyList(), Arrays.asList("inherit"),Collections.<String>emptyList(),"","");
-        Policy revised = policy.addCssProperty(leadingDashProperty1).addCssProperty(leadingDashProperty2);
-        // Test properties
-        assertThat(as.scan(input, revised, AntiSamy.DOM).getCleanHTML(), both(containsString("-webkit-border-radius")).and(containsString("-moz-border-radius")));
-        assertThat(as.scan(input, revised, AntiSamy.SAX).getCleanHTML(), both(containsString("-webkit-border-radius")).and(containsString("-moz-border-radius")));
-    }
-
-    @Test
-    public void testScansWithDifferentPolicyLoading() throws ScanException, PolicyException, URISyntaxException {
-        final String input = "<span>text</span>";
-        // Preload policy, do not specify scan type.
-        AntiSamy asInstance = new AntiSamy(policy);
-        assertThat(asInstance.scan(input).getCleanHTML(), is(input));
-        // Pass policy, assume DOM scan type.
-        assertThat(asInstance.scan(input, policy).getCleanHTML(), is(input));
-        // Pass policy as File.
-        File policyFile = new File(getClass().getResource("/antisamy.xml").toURI());
-        assertThat(asInstance.scan(input, policyFile).getCleanHTML(), is(input));
-        // Pass policy filename.
-        String path = getClass().getResource("/antisamy.xml").getPath();
-        path = System.getProperty("file.separator").equals("\\") && path.startsWith("/") ? path.substring(1) : path;
-        assertThat(asInstance.scan(input, path).getCleanHTML(), is(input));
-        // No preloaded nor passed policy, expected to fail.
-        try {
-            as.scan(input, null, AntiSamy.DOM);
-            fail("Scan with no policy must have thrown an exception.");
-        } catch (PolicyException e) {
-            // An error is expected. Pass.
-        }
-    }
-    
-    @Test
-    public void testGithubIssue151() throws ScanException, PolicyException {
-        // Concern is error messages when parsing stylesheets are no longer returned in AntiSamy 1.6.5
-        String input = "<img style=\"FLOAT: right; CURSOR: hand\" src=\"http://site.com/pic.jpg\" />";
-
-        CleanResults result = as.scan(input, policy, AntiSamy.DOM);
-        assertThat(result.getErrorMessages().size(), is(1));
-        assertThat(result.getCleanHTML(), both(containsString("img")).and(not(containsString("CURSOR"))));
-
-        result = as.scan(input, policy, AntiSamy.SAX);
-        assertThat(result.getErrorMessages().size(), is(1));
-        assertThat(result.getCleanHTML(), both(containsString("img")).and(not(containsString("CURSOR"))));
-    }
-
-    @Test
-    public void testSmuggledTagsInStyleContent() throws ScanException, PolicyException {
-        // HTML tags may be smuggled into a style tag after parsing input to an internal representation.
-        // If that happens, they should be treated as text content and not as children nodes.
-        assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", policy, AntiSamy.DOM).getCleanHTML(), not(containsString("script")));
-        assertThat(as.scan("<select<style/>W<xmp<script>alert(1)</script>", policy, AntiSamy.SAX).getCleanHTML(), not(containsString("script")));
-        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", policy, AntiSamy.DOM).getCleanHTML(), not(containsString("input")));
-        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", policy, AntiSamy.SAX).getCleanHTML(), not(containsString("input")));
-    }
-
-    @Test(timeout = 4000)
-    public void testMalformedPIScan() {
-        // Certain malformed input including a malformed processing instruction may lead the parser to an internal memory error.
-        // Does not matter if it is DOM or SAX scan, the problem was internally the same on HTML parser.
-        try {
-            as.scan("<!--><?a/", policy, AntiSamy.DOM).getCleanHTML();
-        } catch (ScanException ex) {
-            // It is OK, internal parser should fail.
-        } catch (Exception ex) {
-            fail("Parser should not throw a non-ScanException");
-        }
-
-        try {
-            as.scan("<!--?><?a/", policy, AntiSamy.DOM).getCleanHTML();
-        } catch (ScanException ex) {
-            // It is OK, internal parser should fail.
-        } catch (Exception ex) {
-            fail("Parser should not throw a non-ScanException");
-        }
-    }
+  @Test
+  public void testGithubIssue40() throws ScanException, PolicyException {
+
+    // Concern is that: <svg onload=alert(1)//  does not get cleansed.
+    // Based on these test results, it does get cleaned so this issue is a false positive, so we
+    // closed it.
+
+    assertThat(
+        as.scan(test40, policy, AntiSamy.SAX).getCleanHTML(),
+        not(containsString("<svg onload=alert(1)//")));
+    // System.out.println("SAX parser: " + as.scan(test40, policy,
+    // AntiSamy.SAX).getCleanHTML());
+    assertThat(
+        as.scan(test40, policy, AntiSamy.DOM).getCleanHTML(),
+        not(containsString("<svg onload=alert(1)//")));
+    // System.out.println("DOM parser: " + as.scan(test40, policy,
+    // AntiSamy.DOM).getCleanHTML());
+  }
+
+  @Test
+  public void testGithubIssue48() throws ScanException, PolicyException {
+
+    // Concern is that onsiteURL regex is not safe for URLs that start with //.
+    // For example:  //evilactor.com?param=foo
+
+    final String phishingAttempt =
+        "<a href=\"//evilactor.com/stealinfo?a=xxx&b=xxx\"><span style=\"color:red;font-size:100px\">"
+            + "You must click me</span></a>";
+
+    // Output: <a rel="nofollow"><span style="color: red;font-size: 100.0px;">You must click
+    // me</span></a>
+
+    assertThat(
+        as.scan(phishingAttempt, policy, AntiSamy.SAX).getCleanHTML(),
+        not(containsString("//evilactor.com/")));
+    assertThat(
+        as.scan(phishingAttempt, policy, AntiSamy.DOM).getCleanHTML(),
+        not(containsString("//evilactor.com/")));
+
+    // This ones never failed, they're just to prove a dangling markup attack on the following
+    // resulting HTML won't work.
+    // Less probable case (steal more tags):
+    final String danglingMarkup =
+        "<div>User input: "
+            + "<input type=\"text\" name=\"input\" value=\"\"><a href='//evilactor.com?"
+            + "\"> all this info wants to be stolen with <i>danlging markup attack</i>"
+            + " until a single quote to close is found'</div>";
+
+    assertThat(
+        as.scan(danglingMarkup, policy, AntiSamy.SAX).getCleanHTML(),
+        not(containsString("//evilactor.com/")));
+    assertThat(
+        as.scan(danglingMarkup, policy, AntiSamy.DOM).getCleanHTML(),
+        not(containsString("//evilactor.com/")));
+
+    // More probable case (steal just an attribute):
+    //      HTML before attack: <input type="text" name="input" value=""
+    // data-attribute-to-steal="some value">
+    final String danglingMarkup2 =
+        "<div>User input: "
+            + "<input type=\"text\" name=\"input\" value=\"\" data-attribute-to-steal=\"some value\">";
+
+    assertThat(
+        as.scan(danglingMarkup2, policy, AntiSamy.SAX).getCleanHTML(),
+        not(containsString("//evilactor.com/")));
+    assertThat(
+        as.scan(danglingMarkup2, policy, AntiSamy.DOM).getCleanHTML(),
+        not(containsString("//evilactor.com/")));
+  }
+
+  @Test
+  public void testGithubIssue62() {
+    // Concern is that when a processing instruction is at the root level, node removal gets
+    // messy and Null pointer exception arises.
+    // More test cases are added for PI removal.
+
+    try {
+      assertThat(as.scan("|<?ai aaa", policy, AntiSamy.DOM).getCleanHTML(), is("|"));
+      assertThat(as.scan("|<?ai aaa", policy, AntiSamy.SAX).getCleanHTML(), is("|"));
+
+      assertThat(
+          as.scan("<div>|<?ai aaa", policy, AntiSamy.DOM).getCleanHTML(), is("<div>|</div>"));
+      assertThat(
+          as.scan("<div>|<?ai aaa", policy, AntiSamy.SAX).getCleanHTML(), is("<div>|</div>"));
+
+      assertThat(
+          as.scan(
+                  "<div><?foo note=\"I am XML processing instruction. I wish to be excluded\" ?></div>",
+                  policy,
+                  AntiSamy.DOM)
+              .getCleanHTML(),
+          not(containsString("<?foo")));
+      assertThat(
+          as.scan(
+                  "<div><?foo note=\"I am XML processing instruction. I wish to be excluded\" ?></div>",
+                  policy,
+                  AntiSamy.SAX)
+              .getCleanHTML(),
+          not(containsString("<?foo")));
+
+      assertThat(
+          as.scan("<?xml-stylesheet type=\"text/css\" href=\"style.css\"?>", policy, AntiSamy.DOM)
+              .getCleanHTML(),
+          is(""));
+      assertThat(
+          as.scan("<?xml-stylesheet type=\"text/css\" href=\"style.css\"?>", policy, AntiSamy.SAX)
+              .getCleanHTML(),
+          is(""));
+
+    } catch (Exception exc) {
+      fail(exc.getMessage());
+    }
+  }
+
+  @Test
+  public void testGithubIssue81() throws ScanException, PolicyException {
+    // Concern is that "!important" is missing after processing CSS
+    assertThat(
+        as.scan("<p style=\"color: red !important\">Some Text</p>", policy, AntiSamy.DOM)
+            .getCleanHTML(),
+        containsString("!important"));
+    assertThat(
+        as.scan("<p style=\"color: red !important\">Some Text</p>", policy, AntiSamy.SAX)
+            .getCleanHTML(),
+        containsString("!important"));
+
+    // Just to check scan keeps working accordingly without "!important"
+    assertThat(
+        as.scan("<p style=\"color: red\">Some Text</p>", policy, AntiSamy.DOM).getCleanHTML(),
+        not(containsString("!important")));
+    assertThat(
+        as.scan("<p style=\"color: red\">Some Text</p>", policy, AntiSamy.SAX).getCleanHTML(),
+        not(containsString("!important")));
+  }
+
+  @Test
+  public void entityReferenceEncodedInHtmlAttribute() throws ScanException, PolicyException {
+    // Concern is that "&" is not being encoded and "#00058" was not being interpreted as ":"
+    // so the validations based on regexp passed and a browser would load "&:" together.
+
+    // UPDATE:  Using a new HTML parser library starts decoding entities like #00058
+    assertThat(
+        as.scan(
+                "<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>",
+                policy, AntiSamy.DOM)
+            .getCleanHTML(),
+        not(containsString("javascript")));
+    assertThat(
+        as.scan(
+                "<p><a href=\"javascript&#00058x=1,%61%6c%65%72%74%28%22%62%6f%6f%6d%22%29\">xss</a></p>",
+                policy, AntiSamy.SAX)
+            .getCleanHTML(),
+        not(containsString("javascript")));
+  }
+
+  @Test
+  public void testGithubIssue99() throws ScanException, PolicyException {
+    // Test that the IANA subtags is not lost
+    assertThat(
+        as.scan(
+                "<p lang=\"en-GB\">This paragraph is defined as British English.</p>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML(),
+        containsString("lang=\"en-GB\""));
+    assertThat(
+        as.scan(
+                "<p lang=\"en-GB\">This paragraph is defined as British English.</p>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML(),
+        containsString("lang=\"en-GB\""));
+  }
+
+  @Test
+  public void testGithubIssue101() throws ScanException, PolicyException {
+    // Test that margin attribute is not removed when value has too much significant figures.
+    // Current behavior is that decimals like 0.0001 are internally translated to 1.0E-4, this
+    // is reflected on regex validation and actual output. The inconsistency is due to Batik
+    // CSS.
+    assertThat(
+        as.scan("<p style=\"margin: 0.0001pt;\">Some text.</p>", policy, AntiSamy.DOM)
+            .getCleanHTML(),
+        containsString("margin"));
+    assertThat(
+        as.scan("<p style=\"margin: 0.0001pt;\">Some text.</p>", policy, AntiSamy.SAX)
+            .getCleanHTML(),
+        containsString("margin"));
+    assertThat(
+        as.scan("<p style=\"margin: 10000000pt;\">Some text.</p>", policy, AntiSamy.DOM)
+            .getCleanHTML(),
+        containsString("margin"));
+    assertThat(
+        as.scan("<p style=\"margin: 10000000pt;\">Some text.</p>", policy, AntiSamy.SAX)
+            .getCleanHTML(),
+        containsString("margin"));
+    assertThat(
+        as.scan("<p style=\"margin: 1.0E-4pt;\">Some text.</p>", policy, AntiSamy.DOM)
+            .getCleanHTML(),
+        containsString("margin"));
+    assertThat(
+        as.scan("<p style=\"margin: 1.0E-4pt;\">Some text.</p>", policy, AntiSamy.SAX)
+            .getCleanHTML(),
+        containsString("margin"));
+    // When using exponential directly the "e" or "E" is internally considered as the start of
+    // the dimension/unit type. This creates inconsistencies that make the regex validation
+    // fail,
+    // also in cases like 1e4pt where "e" is considered as dimension instead of "pt".
+    assertThat(
+        as.scan("<p style=\"margin: 1.0E+4pt;\">Some text.</p>", policy, AntiSamy.DOM)
+            .getCleanHTML(),
+        not(containsString("margin")));
+    assertThat(
+        as.scan("<p style=\"margin: 1.0E+4pt;\">Some text.</p>", policy, AntiSamy.SAX)
+            .getCleanHTML(),
+        not(containsString("margin")));
+  }
+
+  @Test
+  public void testCSSUnits() throws ScanException, PolicyException {
+    String input =
+        "<div style=\"width:50vw;height:50vh;padding:1rpc;\">\n"
+            + "\t<p style=\"font-size:1.5ex;padding-left:1rem;padding-top:16px;\">Some text.</p>\n"
+            + "</div>";
+    CleanResults cr = as.scan(input, policy, AntiSamy.DOM);
+    assertThat(cr.getCleanHTML(), containsString("ex"));
+    assertThat(cr.getCleanHTML(), containsString("px"));
+    assertThat(cr.getCleanHTML(), containsString("rem"));
+    assertThat(cr.getCleanHTML(), containsString("vw"));
+    assertThat(cr.getCleanHTML(), containsString("vh"));
+    assertThat(cr.getCleanHTML(), not(containsString("rpc")));
+    cr = as.scan(input, policy, AntiSamy.SAX);
+    assertThat(cr.getCleanHTML(), containsString("ex"));
+    assertThat(cr.getCleanHTML(), containsString("px"));
+    assertThat(cr.getCleanHTML(), containsString("rem"));
+    assertThat(cr.getCleanHTML(), containsString("vw"));
+    assertThat(cr.getCleanHTML(), containsString("vh"));
+    assertThat(cr.getCleanHTML(), not(containsString("rpc")));
+  }
+
+  @Test
+  public void testXSSInsideSelectOptionStyle() throws ScanException, PolicyException {
+    // Tests for CVE-2021-42575, XSS nested into <select>+<option>+<style>
+
+    // Safe case, to test legit style
+    assertThat(
+        as.scan(
+                "<select><option><style>h1{color:black;}</style></option></select>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML(),
+        containsString("black"));
+    assertThat(
+        as.scan(
+                "<select><option><style>h1{color:black;}</style></option></select>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML(),
+        containsString("black"));
+    // Unsafe case
+    assertThat(
+        as.scan(
+                "<select><option><style><script>alert(1)</script></style></option></select>",
+                policy,
+                AntiSamy.DOM)
+            .getCleanHTML(),
+        not(containsString("<script>")));
+    assertThat(
+        as.scan(
+                "<select><option><style><script>alert(1)</script></style></option></select>",
+                policy,
+                AntiSamy.SAX)
+            .getCleanHTML(),
+        not(containsString("<script>")));
+  }
+
+  @Test
+  public void testImportedStylesParsing() throws ScanException, PolicyException {
+    // Test that imported style sheets can be parsed and order is correct
+    final String input =
+        "<style type='text/css'>\n"
+            + "\t@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/classic.css);\n"
+            + "\t@import url(https://raw.githubusercontent.com/nahsra/antisamy/main/src/test/resources/s/slashdot.org_files/providers.css);\n"
+            + "\t.very-specific-antisamy {font: 15pt \"Arial\"; color: blue;}\n"
+            + "</style>";
+    Policy revised =
+        policy
+            .cloneWithDirective(Policy.EMBED_STYLESHEETS, "true")
+            .cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
+    // Styles are imported
+    String cleanHtmlDOM = as.scan(input, revised, AntiSamy.DOM).getCleanHTML();
+    String cleanHtmlSAX = as.scan(input, revised, AntiSamy.SAX).getCleanHTML();
+    assertThat(cleanHtmlDOM, not(containsString("<![CDATA[/* */]]>")));
+    assertThat(cleanHtmlSAX, not(containsString("<![CDATA[/* */]]>")));
+    // Order is correct:
+    //  First import: grid_1 class
+    //  Second import: janrain-provider150-sprit class
+    //  Original styles: very-specific-antisamy class
+    final Pattern p =
+        Pattern.compile(
+            ".*?\\.grid_1.*?\\.janrain-provider150-sprit.*?\\.very-specific-antisamy.*?",
+            Pattern.DOTALL);
+    assertThat(cleanHtmlDOM, MatchesPattern.matchesPattern(p));
+    assertThat(cleanHtmlSAX, MatchesPattern.matchesPattern(p));
+
+    Policy revised2 =
+        policy
+            .cloneWithDirective(Policy.EMBED_STYLESHEETS, "false")
+            .cloneWithDirective(Policy.FORMAT_OUTPUT, "false");
+    // Styles are not imported
+    cleanHtmlDOM = as.scan(input, revised2, AntiSamy.DOM).getCleanHTML();
+    cleanHtmlSAX = as.scan(input, revised2, AntiSamy.SAX).getCleanHTML();
+    assertThat(cleanHtmlDOM, not(containsString(".grid_1")));
+    assertThat(cleanHtmlSAX, not(containsString(".grid_1")));
+    assertThat(cleanHtmlDOM, not(containsString(".janrain-provider150-sprit")));
+    assertThat(cleanHtmlSAX, not(containsString(".janrain-provider150-sprit")));
+  }
+
+  @Test
+  public void testNoopenerAndNoreferrer() throws ScanException, PolicyException {
+    Map<String, Attribute> map = new HashMap<>();
+    map.put(
+        "target",
+        new Attribute(
+            "a", Collections.<Pattern>emptyList(), Arrays.asList("_blank", "_self"), "", ""));
+    map.put(
+        "rel",
+        new Attribute(
+            "a",
+            Collections.<Pattern>emptyList(),
+            Arrays.asList("nofollow", "noopener", "noreferrer"),
+            "",
+            ""));
+    Tag tag = new Tag("a", map, Policy.ACTION_VALIDATE);
+    Policy basePolicy = policy.mutateTag(tag);
+    Policy revised =
+        basePolicy
+            .cloneWithDirective(Policy.ANCHORS_NOFOLLOW, "true")
+            .cloneWithDirective(Policy.ANCHORS_NOOPENER_NOREFERRER, "true");
+    // No target="_blank", so only nofollow can be added.
+    assertThat(
+        as.scan("<a>Link text</a>", revised, AntiSamy.DOM).getCleanHTML(),
+        both(containsString("nofollow")).and(not(containsString("noopener noreferrer"))));
+    assertThat(
+        as.scan("<a>Link text</a>", revised, AntiSamy.SAX).getCleanHTML(),
+        both(containsString("nofollow")).and(not(containsString("noopener noreferrer"))));
+    // target="_blank", can have both.
+    assertThat(
+        as.scan("<a target=\"_blank\">Link text</a>", revised, AntiSamy.DOM).getCleanHTML(),
+        containsString("nofollow noopener noreferrer"));
+    assertThat(
+        as.scan("<a target=\"_blank\">Link text</a>", revised, AntiSamy.SAX).getCleanHTML(),
+        containsString("nofollow noopener noreferrer"));
+
+    Policy revised2 =
+        basePolicy
+            .cloneWithDirective(Policy.ANCHORS_NOFOLLOW, "false")
+            .cloneWithDirective(Policy.ANCHORS_NOOPENER_NOREFERRER, "true");
+    // No target="_blank", no rel added.
+    assertThat(
+        as.scan("<a>Link text</a>", revised2, AntiSamy.DOM).getCleanHTML(),
+        not(containsString("rel=")));
+    assertThat(
+        as.scan("<a>Link text</a>", revised2, AntiSamy.SAX).getCleanHTML(),
+        not(containsString("rel=")));
+    // target="_blank", everything present.
+    assertThat(
+        as.scan("<a target='_blank' rel='nofollow'>Link text</a>", revised2, AntiSamy.DOM)
+            .getCleanHTML(),
+        containsString("nofollow noopener noreferrer"));
+    assertThat(
+        as.scan("<a target='_blank' rel='nofollow'>Link text</a>", revised2, AntiSamy.SAX)
+            .getCleanHTML(),
+        containsString("nofollow noopener noreferrer"));
+    // target="_self", no rel added.
+    assertThat(
+        as.scan("<a target='_self'>Link text</a>", revised2, AntiSamy.DOM).getCleanHTML(),
+        not(containsString("rel=")));
+    assertThat(
+        as.scan("<a target='_self'>Link text</a>", revised2, AntiSamy.SAX).getCleanHTML(),
+        not(containsString("rel=")));
+    // target="_self", only nofollow present.
+    assertThat(
+        as.scan("<a target='_self' rel='nofollow'>Link text</a>", revised2, AntiSamy.DOM)
+            .getCleanHTML(),
+        both(containsString("nofollow")).and(not(containsString("noopener noreferrer"))));
+    assertThat(
+        as.scan("<a target='_self' rel='nofollow'>Link text</a>", revised2, AntiSamy.SAX)
+            .getCleanHTML(),
+        both(containsString("nofollow")).and(not(containsString("noopener noreferrer"))));
+    // noopener is not repeated
+    assertThat(
+        as.scan("<a target='_blank' rel='noopener'>Link text</a>", revised2, AntiSamy.DOM)
+            .getCleanHTML()
+            .split("noopener")
+            .length,
+        is(2));
+    assertThat(
+        as.scan("<a target='_blank' rel='noopener'>Link text</a>", revised2, AntiSamy.SAX)
+            .getCleanHTML()
+            .split("noopener")
+            .length,
+        is(2));
+
+    Policy revised3 =
+        basePolicy
+            .cloneWithDirective(Policy.ANCHORS_NOFOLLOW, "false")
+            .cloneWithDirective(Policy.ANCHORS_NOOPENER_NOREFERRER, "false");
+    // No rel added
+    assertThat(
+        as.scan("<a>Link text</a>", revised3, AntiSamy.DOM).getCleanHTML(),
+        not(containsString("rel=")));
+    assertThat(
+        as.scan("<a>Link text</a>", revised3, AntiSamy.SAX).getCleanHTML(),
+        not(containsString("rel=")));
+    // noopener is not repeated
+    assertThat(
+        as.scan("<a target='_blank' rel='noopener'>Link text</a>", revised3, AntiSamy.DOM)
+            .getCleanHTML()
+            .split("noopener")
+            .length,
+        is(2));
+    assertThat(
+        as.scan("<a target='_blank' rel='noopener'>Link text</a>", revised3, AntiSamy.SAX)
+            .getCleanHTML()
+            .split("noopener")
+            .length,
+        is(2));
+  }
+
+  @Test
+  public void testLeadingDashOnPropertyName() throws ScanException, PolicyException {
+    // Test that property names with leading dash are supported, reported on issue #125.
+    final String input =
+        "<style type='text/css'>\n"
+            + "\t.very-specific-antisamy { -moz-border-radius: inherit ; -webkit-border-radius: 25px 10px 5px 10px;}\n"
+            + "</style>";
+    // Define new properties for the policy
+    Pattern customPattern =
+        Pattern.compile("\\d+(\\.\\d+)?px( \\d+(\\.\\d+)?px){0,3}", Pattern.DOTALL);
+    Property leadingDashProperty1 =
+        new Property(
+            "-webkit-border-radius",
+            Arrays.asList(customPattern),
+            Collections.<String>emptyList(),
+            Collections.<String>emptyList(),
+            "",
+            "");
+    Property leadingDashProperty2 =
+        new Property(
+            "-moz-border-radius",
+            Collections.<Pattern>emptyList(),
+            Arrays.asList("inherit"),
+            Collections.<String>emptyList(),
+            "",
+            "");
+    Policy revised =
+        policy.addCssProperty(leadingDashProperty1).addCssProperty(leadingDashProperty2);
+    // Test properties
+    assertThat(
+        as.scan(input, revised, AntiSamy.DOM).getCleanHTML(),
+        both(containsString("-webkit-border-radius")).and(containsString("-moz-border-radius")));
+    assertThat(
+        as.scan(input, revised, AntiSamy.SAX).getCleanHTML(),
+        both(containsString("-webkit-border-radius")).and(containsString("-moz-border-radius")));
+  }
+
+  @Test
+  public void testScansWithDifferentPolicyLoading()
+      throws ScanException, PolicyException, URISyntaxException {
+    final String input = "<span>text</span>";
+    // Preload policy, do not specify scan type.
+    AntiSamy asInstance = new AntiSamy(policy);
+    assertThat(asInstance.scan(input).getCleanHTML(), is(input));
+    // Pass policy, assume DOM scan type.
+    assertThat(asInstance.scan(input, policy).getCleanHTML(), is(input));
+    // Pass policy as File.
+    File policyFile = new File(getClass().getResource("/antisamy.xml").toURI());
+    assertThat(asInstance.scan(input, policyFile).getCleanHTML(), is(input));
+    // Pass policy filename.
+    String path = getClass().getResource("/antisamy.xml").getPath();
+    path =
+        System.getProperty("file.separator").equals("\\") && path.startsWith("/")
+            ? path.substring(1)
+            : path;
+    assertThat(asInstance.scan(input, path).getCleanHTML(), is(input));
+    // No preloaded nor passed policy, expected to fail.
+    try {
+      as.scan(input, null, AntiSamy.DOM);
+      fail("Scan with no policy must have thrown an exception.");
+    } catch (PolicyException e) {
+      // An error is expected. Pass.
+    }
+  }
+
+  @Test
+  public void testGithubIssue151() throws ScanException, PolicyException {
+    // Concern is error messages when parsing stylesheets are no longer returned in AntiSamy
+    // 1.6.5
+    String input = "<img style=\"FLOAT: right; CURSOR: hand\" src=\"http://site.com/pic.jpg\" />";
+
+    CleanResults result = as.scan(input, policy, AntiSamy.DOM);
+    assertThat(result.getErrorMessages().size(), is(1));
+    assertThat(
+        result.getCleanHTML(), both(containsString("img")).and(not(containsString("CURSOR"))));
+
+    result = as.scan(input, policy, AntiSamy.SAX);
+    assertThat(result.getErrorMessages().size(), is(1));
+    assertThat(
+        result.getCleanHTML(), both(containsString("img")).and(not(containsString("CURSOR"))));
+  }
+
+  @Test
+  public void testSmuggledTagsInStyleContent() throws ScanException, PolicyException {
+    // HTML tags may be smuggled into a style tag after parsing input to an internal
+    // representation.
+    // If that happens, they should be treated as text content and not as children nodes.
+    assertThat(
+        as.scan("<select<style/>W<xmp<script>alert(1)</script>", policy, AntiSamy.DOM)
+            .getCleanHTML(),
+        not(containsString("script")));
+    assertThat(
+        as.scan("<select<style/>W<xmp<script>alert(1)</script>", policy, AntiSamy.SAX)
+            .getCleanHTML(),
+        not(containsString("script")));
+    assertThat(
+        as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", policy, AntiSamy.DOM)
+            .getCleanHTML(),
+        not(containsString("input")));
+    assertThat(
+        as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", policy, AntiSamy.SAX)
+            .getCleanHTML(),
+        not(containsString("input")));
+  }
+
+  @Test(timeout = 4000)
+  public void testMalformedPIScan() {
+    // Certain malformed input including a malformed processing instruction may lead the parser
+    // to an internal memory error.
+    // Does not matter if it is DOM or SAX scan, the problem was internally the same on HTML
+    // parser.
+    try {
+      as.scan("<!--><?a/", policy, AntiSamy.DOM).getCleanHTML();
+    } catch (ScanException ex) {
+      // It is OK, internal parser should fail.
+    } catch (Exception ex) {
+      fail("Parser should not throw a non-ScanException");
+    }
+
+    try {
+      as.scan("<!--?><?a/", policy, AntiSamy.DOM).getCleanHTML();
+    } catch (ScanException ex) {
+      // It is OK, internal parser should fail.
+    } catch (Exception ex) {
+      fail("Parser should not throw a non-ScanException");
+    }
+  }
 }
diff --git a/src/test/java/org/owasp/validator/html/test/ESAPIInvalidPolicyTest.java b/src/test/java/org/owasp/validator/html/test/ESAPIInvalidPolicyTest.java
index a06d66fc..8b39fd70 100644
--- a/src/test/java/org/owasp/validator/html/test/ESAPIInvalidPolicyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/ESAPIInvalidPolicyTest.java
@@ -1,49 +1,50 @@
 package org.owasp.validator.html.test;
 
+import static org.junit.Assert.fail;
+
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.InputStream;
-
-import static org.junit.Assert.fail;
 import org.junit.Test;
-
 import org.owasp.validator.html.Policy;
 import org.owasp.validator.html.PolicyException;
 
 public class ESAPIInvalidPolicyTest {
 
-	@Test
-	public void testBaisValidation() throws Exception {
-		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
-		try {
-			Policy.getInstance(toByteArrayStream(stream));
-			fail("Invalid policy with schema should throw exception.");
-		} catch (PolicyException e) {
-			// This is expected, so do nothing. Any other kind of exception is a failed test case.
-		}
-	}
-
-	@Test
-	public void testDirectValidation() throws Exception {
-		InputStream stream = ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
-		try {
-			Policy.getInstance(stream);
-			fail("Invalid policy should throw exception.");
-		} catch (PolicyException e) {
-			// This is expected, so do nothing. Any other kind of exception is a failed test case.
-		}
-	}
-
-	static InputStream toByteArrayStream(InputStream in) throws Exception {
-		ByteArrayOutputStream buffer = new ByteArrayOutputStream();
-		int nRead;
-		byte[] data = new byte[1024];
-		while ((nRead = in.read(data, 0, data.length)) != -1) {
-			buffer.write(data, 0, nRead);
-		}
-
-		buffer.flush();
-		byte[] byteArray = buffer.toByteArray();
-		return new ByteArrayInputStream(byteArray);
-	}
+  @Test
+  public void testBaisValidation() throws Exception {
+    InputStream stream =
+        ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
+    try {
+      Policy.getInstance(toByteArrayStream(stream));
+      fail("Invalid policy with schema should throw exception.");
+    } catch (PolicyException e) {
+      // This is expected, so do nothing. Any other kind of exception is a failed test case.
+    }
+  }
+
+  @Test
+  public void testDirectValidation() throws Exception {
+    InputStream stream =
+        ESAPIInvalidPolicyTest.class.getResourceAsStream("/esapi-antisamy-InvalidPolicy.xml");
+    try {
+      Policy.getInstance(stream);
+      fail("Invalid policy should throw exception.");
+    } catch (PolicyException e) {
+      // This is expected, so do nothing. Any other kind of exception is a failed test case.
+    }
+  }
+
+  static InputStream toByteArrayStream(InputStream in) throws Exception {
+    ByteArrayOutputStream buffer = new ByteArrayOutputStream();
+    int nRead;
+    byte[] data = new byte[1024];
+    while ((nRead = in.read(data, 0, data.length)) != -1) {
+      buffer.write(data, 0, nRead);
+    }
+
+    buffer.flush();
+    byte[] byteArray = buffer.toByteArray();
+    return new ByteArrayInputStream(byteArray);
+  }
 }
diff --git a/src/test/java/org/owasp/validator/html/test/LiteralTest.java b/src/test/java/org/owasp/validator/html/test/LiteralTest.java
index 94d674a6..60aa5f4f 100644
--- a/src/test/java/org/owasp/validator/html/test/LiteralTest.java
+++ b/src/test/java/org/owasp/validator/html/test/LiteralTest.java
@@ -29,13 +29,11 @@
 package org.owasp.validator.html.test;
 
 import java.net.URL;
-
+import junit.framework.TestCase;
 import org.owasp.validator.html.AntiSamy;
 import org.owasp.validator.html.CleanResults;
 import org.owasp.validator.html.Policy;
 
-import junit.framework.TestCase;
-
 /**
  * Test that literal values for HTML attributes are honored correctly.
  *
@@ -43,80 +41,84 @@
  */
 public class LiteralTest extends TestCase {
 
-	private Policy policy = null;
+  private Policy policy = null;
 
-	protected void setUp() throws Exception {
+  protected void setUp() throws Exception {
 
-		/*
-		 * Load the policy. You may have to change the path to find the Policy
-		 * file for your environment.
-		 */
-		//get Policy instance from a URL.
-		URL url = getClass().getResource("/antisamy.xml");
-		//System.out.println("Loading policy from URL: " + url);
-		policy = Policy.getInstance(url);
-	}
-	
-	public void testSAXGoodResult() throws Exception {
-		//System.out.println("Policy: " + policy);
+    /*
+     * Load the policy. You may have to change the path to find the Policy
+     * file for your environment.
+     */
+    // get Policy instance from a URL.
+    URL url = getClass().getResource("/antisamy.xml");
+    // System.out.println("Loading policy from URL: " + url);
+    policy = Policy.getInstance(url);
+  }
 
-		// good
-		String html = "<div align=\"right\">html</div>";
+  public void testSAXGoodResult() throws Exception {
+    // System.out.println("Policy: " + policy);
 
-		CleanResults cleanResults = new AntiSamy(policy).scan(html, AntiSamy.SAX);
-		//System.out.println("SAX cleanResults: " + cleanResults.getCleanHTML());
-		//System.out.println("SAX cleanResults error messages: " + cleanResults.getErrorMessages().size());
+    // good
+    String html = "<div align=\"right\">html</div>";
 
-        for (String msg : cleanResults.getErrorMessages()) {
-            System.out.println("error msg: " + msg);
-        }
+    CleanResults cleanResults = new AntiSamy(policy).scan(html, AntiSamy.SAX);
+    // System.out.println("SAX cleanResults: " + cleanResults.getCleanHTML());
+    // System.out.println("SAX cleanResults error messages: " +
+    // cleanResults.getErrorMessages().size());
 
-		assertTrue(cleanResults.getErrorMessages().isEmpty());
-	}
+    for (String msg : cleanResults.getErrorMessages()) {
+      System.out.println("error msg: " + msg);
+    }
 
-    public void testSAXBadResult() throws Exception {
-        //System.out.println("Policy: " + policy);
+    assertTrue(cleanResults.getErrorMessages().isEmpty());
+  }
 
-        // AntiSamy should complain about the attribute value "foo" ... but it is not
-        String badHtml = "<div align=\"foo\">badhtml</div>";
+  public void testSAXBadResult() throws Exception {
+    // System.out.println("Policy: " + policy);
 
-        CleanResults cleanResults2 = new AntiSamy(policy).scan(badHtml, AntiSamy.SAX);
+    // AntiSamy should complain about the attribute value "foo" ... but it is not
+    String badHtml = "<div align=\"foo\">badhtml</div>";
 
-        //System.out.println("SAX cleanResults2: " + cleanResults2.getCleanHTML());
-        //System.out.println("SAX cleanResults2 error messages: " + cleanResults2.getErrorMessages().size());
-        /* for (String msg : cleanResults2.getErrorMessages()) {
-            System.out.println("error msg: " + msg);
-        } */
-        assertTrue(cleanResults2.getErrorMessages().size() > 0);
-    }
+    CleanResults cleanResults2 = new AntiSamy(policy).scan(badHtml, AntiSamy.SAX);
+
+    // System.out.println("SAX cleanResults2: " + cleanResults2.getCleanHTML());
+    // System.out.println("SAX cleanResults2 error messages: " +
+    // cleanResults2.getErrorMessages().size());
+    /* for (String msg : cleanResults2.getErrorMessages()) {
+        System.out.println("error msg: " + msg);
+    } */
+    assertTrue(cleanResults2.getErrorMessages().size() > 0);
+  }
 
-    public void testDOMGoodResult() throws Exception {
-		//System.out.println("Policy: " + policy);
+  public void testDOMGoodResult() throws Exception {
+    // System.out.println("Policy: " + policy);
 
-		// good
-		String html = "<div align=\"right\">html</div>";
+    // good
+    String html = "<div align=\"right\">html</div>";
 
-		CleanResults cleanResults = new AntiSamy(policy).scan(html, AntiSamy.DOM);
-		//System.out.println("DOM cleanResults error messages: " + cleanResults.getErrorMessages().size());
-        for (String msg : cleanResults.getErrorMessages()) {
-            System.out.println("error msg: " + msg);
-        }
+    CleanResults cleanResults = new AntiSamy(policy).scan(html, AntiSamy.DOM);
+    // System.out.println("DOM cleanResults error messages: " +
+    // cleanResults.getErrorMessages().size());
+    for (String msg : cleanResults.getErrorMessages()) {
+      System.out.println("error msg: " + msg);
+    }
 
-		assertTrue(cleanResults.getErrorMessages().isEmpty());
-	}
+    assertTrue(cleanResults.getErrorMessages().isEmpty());
+  }
 
-    public void testDOMBadResult() throws Exception {
-        //System.out.println("Policy: " + policy);
+  public void testDOMBadResult() throws Exception {
+    // System.out.println("Policy: " + policy);
 
-        // AntiSamy should complain about the attribute value "foo" ... but it is not
-        String badHtml = "<div align=\"foo\">badhtml</div>";
+    // AntiSamy should complain about the attribute value "foo" ... but it is not
+    String badHtml = "<div align=\"foo\">badhtml</div>";
 
-        CleanResults cleanResults2 = new AntiSamy(policy).scan(badHtml, AntiSamy.DOM);
+    CleanResults cleanResults2 = new AntiSamy(policy).scan(badHtml, AntiSamy.DOM);
 
-        //System.out.println("DOM cleanResults2 error messages: " + cleanResults2.getErrorMessages().size());
-        /* for (String msg : cleanResults2.getErrorMessages()) {
-            System.out.println("error msg: " + msg);
-        } */
-        assertTrue(cleanResults2.getErrorMessages().size() > 0);
-    }
+    // System.out.println("DOM cleanResults2 error messages: " +
+    // cleanResults2.getErrorMessages().size());
+    /* for (String msg : cleanResults2.getErrorMessages()) {
+        System.out.println("error msg: " + msg);
+    } */
+    assertTrue(cleanResults2.getErrorMessages().size() > 0);
+  }
 }
diff --git a/src/test/java/org/owasp/validator/html/test/PolicyTest.java b/src/test/java/org/owasp/validator/html/test/PolicyTest.java
index 83a1cebf..a43f828f 100644
--- a/src/test/java/org/owasp/validator/html/test/PolicyTest.java
+++ b/src/test/java/org/owasp/validator/html/test/PolicyTest.java
@@ -31,299 +31,339 @@
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.CoreMatchers.notNullValue;
 import static org.hamcrest.MatcherAssert.assertThat;
-
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
+import java.io.ByteArrayInputStream;
+import java.lang.reflect.Method;
+import java.net.URL;
 import org.junit.Test;
-
 import org.owasp.validator.html.AntiSamy;
 import org.owasp.validator.html.Policy;
 import org.owasp.validator.html.PolicyException;
 import org.owasp.validator.html.TagMatcher;
 import org.owasp.validator.html.scan.Constants;
 
-import java.io.ByteArrayInputStream;
-import java.lang.reflect.Method;
-import java.net.URL;
-
 /**
  * This class tests the Policy functionality to show that we can successfully parse the policy file.
  */
 public class PolicyTest {
 
-    private Policy policy;
-
-    private static final String HEADER = "<?xml version=\"1.0\" encoding=\"ISO-8859-1\" ?>\n" +
-                                         "<anti-samy-rules xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" " +
-                                         "xsi:noNamespaceSchemaLocation=\"antisamy.xsd\">\n";
-    private static final String DIRECTIVES = "<directives>\n</directives>\n";
-    private static final String COMMON_ATTRIBUTES = "<common-attributes>\n</common-attributes>\n";
-    private static final String GLOBAL_TAG_ATTRIBUTES = "<global-tag-attributes>\n</global-tag-attributes>\n";
-    private static final String DYNAMIC_TAG_ATTRIBUTES = "<dynamic-tag-attributes>\n</dynamic-tag-attributes>\n";
-    private static final String TAG_RULES = "<tag-rules>\n</tag-rules>";
-    private static final String CSS_RULES = "<css-rules>\n</css-rules>\n";
-    private static final String COMMON_REGEXPS = "<common-regexps>\n</common-regexps>";
-    private static final String FOOTER = "</anti-samy-rules>";
-
-    // Returns a valid policy file with the specified allowedEmptyTags
-    private String assembleFile(String finalTagsSection) {
-        return HEADER + DIRECTIVES + COMMON_REGEXPS + COMMON_ATTRIBUTES + GLOBAL_TAG_ATTRIBUTES + DYNAMIC_TAG_ATTRIBUTES + TAG_RULES + CSS_RULES +
-                finalTagsSection + FOOTER;
-    }
-
-    @Test
-    public void testGetAllowedEmptyTags() throws PolicyException {
-        String allowedEmptyTagsSection = "<allowed-empty-tags>\n" +
-                                         "    <literal-list>\n" +
-                                         "                <literal value=\"td\"/>\n" +
-                                         "                <literal value=\"span\"/>\n" +
-                                         "    </literal-list>\n" +
-                                         "</allowed-empty-tags>\n";
-        String policyFile = assembleFile(allowedEmptyTagsSection);
-
-        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-
-        TagMatcher actualTags = policy.getAllowedEmptyTags();
-
-        assertTrue(actualTags.matches("td"));
-        assertTrue(actualTags.matches("span"));
-    }
-
-    @Test
-    public void testGetAllowedEmptyTags_emptyList() throws PolicyException {
-        String allowedEmptyTagsSection = "<allowed-empty-tags>\n" +
-                                         "    <literal-list>\n" +
-                                         "    </literal-list>\n" +
-                                         "</allowed-empty-tags>\n";
-        String policyFile = assembleFile(allowedEmptyTagsSection);
-
-        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-
-        assertEquals(0, policy.getAllowedEmptyTags().size());
-    }
-    
-    @Test
-    public void testGetAllowedEmptyTags_emptySection() throws PolicyException {
-        String allowedEmptyTagsSection = "<allowed-empty-tags>\n" + "</allowed-empty-tags>\n";
-        String policyFile = assembleFile(allowedEmptyTagsSection);
-
-        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-
-        assertEquals(0, policy.getAllowedEmptyTags().size());
-    }
-
-    @Test
-    public void testGetAllowedEmptyTags_NoSection() throws PolicyException {
-        String allowedEmptyTagsSection = "";
-        String policyFile = assembleFile(allowedEmptyTagsSection);
-
-        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-
-        assertTrue(policy.getAllowedEmptyTags().size() == Constants.defaultAllowedEmptyTags.size());
+  private Policy policy;
+
+  private static final String HEADER =
+      "<?xml version=\"1.0\" encoding=\"ISO-8859-1\" ?>\n"
+          + "<anti-samy-rules xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" "
+          + "xsi:noNamespaceSchemaLocation=\"antisamy.xsd\">\n";
+  private static final String DIRECTIVES = "<directives>\n</directives>\n";
+  private static final String COMMON_ATTRIBUTES = "<common-attributes>\n</common-attributes>\n";
+  private static final String GLOBAL_TAG_ATTRIBUTES =
+      "<global-tag-attributes>\n</global-tag-attributes>\n";
+  private static final String DYNAMIC_TAG_ATTRIBUTES =
+      "<dynamic-tag-attributes>\n</dynamic-tag-attributes>\n";
+  private static final String TAG_RULES = "<tag-rules>\n</tag-rules>";
+  private static final String CSS_RULES = "<css-rules>\n</css-rules>\n";
+  private static final String COMMON_REGEXPS = "<common-regexps>\n</common-regexps>";
+  private static final String FOOTER = "</anti-samy-rules>";
+
+  // Returns a valid policy file with the specified allowedEmptyTags
+  private String assembleFile(String finalTagsSection) {
+    return HEADER
+        + DIRECTIVES
+        + COMMON_REGEXPS
+        + COMMON_ATTRIBUTES
+        + GLOBAL_TAG_ATTRIBUTES
+        + DYNAMIC_TAG_ATTRIBUTES
+        + TAG_RULES
+        + CSS_RULES
+        + finalTagsSection
+        + FOOTER;
+  }
+
+  @Test
+  public void testGetAllowedEmptyTags() throws PolicyException {
+    String allowedEmptyTagsSection =
+        "<allowed-empty-tags>\n"
+            + "    <literal-list>\n"
+            + "                <literal value=\"td\"/>\n"
+            + "                <literal value=\"span\"/>\n"
+            + "    </literal-list>\n"
+            + "</allowed-empty-tags>\n";
+    String policyFile = assembleFile(allowedEmptyTagsSection);
+
+    policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+    TagMatcher actualTags = policy.getAllowedEmptyTags();
+
+    assertTrue(actualTags.matches("td"));
+    assertTrue(actualTags.matches("span"));
+  }
+
+  @Test
+  public void testGetAllowedEmptyTags_emptyList() throws PolicyException {
+    String allowedEmptyTagsSection =
+        "<allowed-empty-tags>\n"
+            + "    <literal-list>\n"
+            + "    </literal-list>\n"
+            + "</allowed-empty-tags>\n";
+    String policyFile = assembleFile(allowedEmptyTagsSection);
+
+    policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+    assertEquals(0, policy.getAllowedEmptyTags().size());
+  }
+
+  @Test
+  public void testGetAllowedEmptyTags_emptySection() throws PolicyException {
+    String allowedEmptyTagsSection = "<allowed-empty-tags>\n" + "</allowed-empty-tags>\n";
+    String policyFile = assembleFile(allowedEmptyTagsSection);
+
+    policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+    assertEquals(0, policy.getAllowedEmptyTags().size());
+  }
+
+  @Test
+  public void testGetAllowedEmptyTags_NoSection() throws PolicyException {
+    String allowedEmptyTagsSection = "";
+    String policyFile = assembleFile(allowedEmptyTagsSection);
+
+    policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+    assertTrue(policy.getAllowedEmptyTags().size() == Constants.defaultAllowedEmptyTags.size());
+  }
+
+  @Test
+  public void testGetRequireClosingTags() throws PolicyException {
+    String requireClosingTagsSection =
+        "<require-closing-tags>\n"
+            + "    <literal-list>\n"
+            + "                <literal value=\"td\"/>\n"
+            + "                <literal value=\"span\"/>\n"
+            + "    </literal-list>\n"
+            + "</require-closing-tags>\n";
+    String policyFile = assembleFile(requireClosingTagsSection);
+
+    policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+    TagMatcher actualTags = policy.getRequiresClosingTags();
+
+    assertTrue(actualTags.matches("td"));
+    assertTrue(actualTags.matches("span"));
+  }
+
+  @Test
+  public void testGetRequireClosingTags_emptyList() throws PolicyException {
+    String requireClosingTagsSection =
+        "<require-closing-tags>\n"
+            + "    <literal-list>\n"
+            + "    </literal-list>\n"
+            + "</require-closing-tags>\n";
+    String policyFile = assembleFile(requireClosingTagsSection);
+
+    policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+    assertEquals(0, policy.getRequiresClosingTags().size());
+  }
+
+  @Test
+  public void testGetRequireClosingTags_emptySection() throws PolicyException {
+    String requireClosingTagsSection = "<require-closing-tags>\n" + "</require-closing-tags>\n";
+    String policyFile = assembleFile(requireClosingTagsSection);
+
+    policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+    assertEquals(0, policy.getRequiresClosingTags().size());
+  }
+
+  @Test
+  public void testGetRequireClosingTags_NoSection() throws PolicyException {
+    String requireClosingTagsSection = "";
+    String policyFile = assembleFile(requireClosingTagsSection);
+
+    policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+
+    assertTrue(
+        policy.getRequiresClosingTags().size() == Constants.defaultRequireClosingTags.size());
+  }
+
+  @Test
+  public void testInvalidPolicies() {
+    // Starting with v1.7.0, schema validation is always enforced on policy files.
+    // These tests verify various schema violations are detected and flagged.
+    String notSupportedTagsSection = "<notSupportedTag>\n" + "</notSupportedTag>\n";
+    String policyFile = assembleFile(notSupportedTagsSection);
+    try {
+      policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+      fail("No PolicyException thrown for <notSupportedTag>.");
+    } catch (PolicyException e) {
+      assertNotNull(e);
     }
 
-    @Test
-    public void testGetRequireClosingTags() throws PolicyException {
-        String requireClosingTagsSection = "<require-closing-tags>\n" +
-                "    <literal-list>\n" +
-                "                <literal value=\"td\"/>\n" +
-                "                <literal value=\"span\"/>\n" +
-                "    </literal-list>\n" +
-                "</require-closing-tags>\n";
-        String policyFile = assembleFile(requireClosingTagsSection);
-
-        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-
-        TagMatcher actualTags = policy.getRequiresClosingTags();
-
-        assertTrue(actualTags.matches("td"));
-        assertTrue(actualTags.matches("span"));
+    String duplicatedTagsSection = "<tag-rules>\n" + "</tag-rules>\n";
+    policyFile = assembleFile(duplicatedTagsSection);
+    try {
+      policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+      fail("No PolicyException thrown when <tag-rules> duplicated.");
+    } catch (PolicyException e) {
+      assertNotNull(e);
     }
 
-    @Test
-    public void testGetRequireClosingTags_emptyList() throws PolicyException {
-        String requireClosingTagsSection = "<require-closing-tags>\n" +
-                "    <literal-list>\n" +
-                "    </literal-list>\n" +
-                "</require-closing-tags>\n";
-        String policyFile = assembleFile(requireClosingTagsSection);
-
-        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-
-        assertEquals(0, policy.getRequiresClosingTags().size());
+    policyFile = assembleFile("").replace("<tag-rules>", "").replace("</tag-rules>", "");
+    try {
+      policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+      fail("No PolicyException thrown when <tag-rules> missing.");
+    } catch (PolicyException e) {
+      assertNotNull(e);
     }
-
-    @Test
-    public void testGetRequireClosingTags_emptySection() throws PolicyException {
-        String requireClosingTagsSection = "<require-closing-tags>\n" + "</require-closing-tags>\n";
-        String policyFile = assembleFile(requireClosingTagsSection);
-
-        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-
-        assertEquals(0, policy.getRequiresClosingTags().size());
+  }
+
+  @Test
+  public void testSchemaValidationToggleWithSource() {
+    String notSupportedTagsSection = "<notSupportedTag>\n" + "</notSupportedTag>\n";
+    String policyFile = assembleFile(notSupportedTagsSection);
+
+    try {
+      policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+      fail("Not supported tag on policy, but no PolicyException occurred.");
+    } catch (PolicyException e) {
+      assertNotNull(e);
     }
+  }
 
-    @Test
-    public void testGetRequireClosingTags_NoSection() throws PolicyException {
-        String requireClosingTagsSection = "";
-        String policyFile = assembleFile(requireClosingTagsSection);
-
-        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+  @Test
+  public void testSchemaValidationWithUrl() {
+    URL urlOfInvalidPolicy = getClass().getResource("/invalidPolicy.xml");
 
-        assertTrue(policy.getRequiresClosingTags().size() == Constants.defaultRequireClosingTags.size());
+    try {
+      policy = TestPolicy.getInstance(urlOfInvalidPolicy);
+      fail("PolicyException not thrown for policy w/invalid schema.");
+    } catch (PolicyException e) {
+      assertNotNull(e);
     }
-
-    @Test
-    public void testInvalidPolicies() {
-        // Starting with v1.7.0, schema validation is always enforced on policy files.
-        // These tests verify various schema violations are detected and flagged.
-        String notSupportedTagsSection = "<notSupportedTag>\n" + "</notSupportedTag>\n";
-        String policyFile = assembleFile(notSupportedTagsSection);
-        try {
-            policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-            fail("No PolicyException thrown for <notSupportedTag>.");
-        } catch (PolicyException e) {
-            assertNotNull(e);
-        }
-
-        String duplicatedTagsSection = "<tag-rules>\n" + "</tag-rules>\n";
-        policyFile = assembleFile(duplicatedTagsSection);
-        try {
-            policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-            fail("No PolicyException thrown when <tag-rules> duplicated.");
-        } catch (PolicyException e) {
-            assertNotNull(e);
-        }
-
-        policyFile = assembleFile("").replace("<tag-rules>", "").replace("</tag-rules>", "");
-        try {
-            policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-            fail("No PolicyException thrown when <tag-rules> missing.");
-        } catch (PolicyException e) {
-            assertNotNull(e);
-        }
+  }
+
+  @Test
+  public void testSchemaValidationWithInclude() {
+    // This policy will also include invalidPolicy.xml
+    URL url = getClass().getResource("/emptyPolicyWithInclude.xml");
+
+    try {
+      policy = TestPolicy.getInstance(url);
+      fail("PolicyException not thrown for policy w/invalid schema.");
+    } catch (PolicyException e) {
+      assertNotNull(e);
     }
-
-    @Test
-    public void testSchemaValidationToggleWithSource() {
-        String notSupportedTagsSection = "<notSupportedTag>\n" + "</notSupportedTag>\n";
-        String policyFile = assembleFile(notSupportedTagsSection);
-
-        try {
-            policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-            fail("Not supported tag on policy, but no PolicyException occurred.");
-        } catch (PolicyException e) {
-            assertNotNull(e);
-        }
-    }
-
-    @Test
-    public void testSchemaValidationWithUrl() {
-        URL urlOfInvalidPolicy = getClass().getResource("/invalidPolicy.xml");
-
-        try {
-            policy = TestPolicy.getInstance(urlOfInvalidPolicy);
-            fail("PolicyException not thrown for policy w/invalid schema.");
-        } catch (PolicyException e) {
-            assertNotNull(e);
-        }
-    }
-
-    @Test
-    public void testSchemaValidationWithInclude() {
-        // This policy will also include invalidPolicy.xml
-        URL url = getClass().getResource("/emptyPolicyWithInclude.xml");
-
-        try {
-            policy = TestPolicy.getInstance(url);
-            fail("PolicyException not thrown for policy w/invalid schema.");
-        } catch (PolicyException e) {
-            assertNotNull(e);
-        }
+  }
+
+  @Test
+  public void testSchemaValidationWithOptionallyDefinedTags() throws PolicyException {
+    String allowedEmptyTagsSection =
+        "<allowed-empty-tags>\n"
+            + "    <literal-list>\n"
+            + "                <literal value=\"span\"/>\n"
+            + "    </literal-list>\n"
+            + "</allowed-empty-tags>\n";
+    String requireClosingTagsSection =
+        "<require-closing-tags>\n"
+            + "    <literal-list>\n"
+            + "                <literal value=\"span\"/>\n"
+            + "    </literal-list>\n"
+            + "</require-closing-tags>\n";
+    String policyFile = assembleFile(allowedEmptyTagsSection + requireClosingTagsSection);
+
+    policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
+    // If it reaches this point, it passed schema validation, which is what we want.
+  }
+
+  @Test
+  public void testGithubIssue66() {
+    // Concern is that LSEP characters are not being considered on .* pattern
+    // Note: Change was done in Policy loading, so test is located here
+    String tagRules =
+        "<tag-rules>"
+            + "<tag name=\"tag1\" action=\"validate\">"
+            + "   <attribute name=\"attribute1\">"
+            + "       <regexp-list>"
+            + "           <regexp value=\".*\"/>"
+            + "       </regexp-list>"
+            + "   </attribute>"
+            + "</tag>"
+            + "</tag-rules>";
+    String rawPolicy =
+        HEADER
+            + DIRECTIVES
+            + COMMON_REGEXPS
+            + COMMON_ATTRIBUTES
+            + GLOBAL_TAG_ATTRIBUTES
+            + tagRules
+            + CSS_RULES
+            + FOOTER;
+
+    try {
+      policy = Policy.getInstance(new ByteArrayInputStream(rawPolicy.getBytes()));
+      assertThat(
+          new AntiSamy()
+              .scan("<tag1 attribute1='Line 1\u2028Line 2'>Content</tag1>", policy, AntiSamy.DOM)
+              .getCleanHTML(),
+          containsString("Line 1"));
+      assertThat(
+          new AntiSamy()
+              .scan("<tag1 attribute1='Line 1\u2028Line 2'>Content</tag1>", policy, AntiSamy.SAX)
+              .getCleanHTML(),
+          containsString("Line 1"));
+    } catch (Exception e) {
+      fail("Policy nor scan should fail:" + e.getMessage());
     }
-
-    @Test
-    public void testSchemaValidationWithOptionallyDefinedTags() throws PolicyException {
-        String allowedEmptyTagsSection = "<allowed-empty-tags>\n" +
-                "    <literal-list>\n" +
-                "                <literal value=\"span\"/>\n" +
-                "    </literal-list>\n" +
-                "</allowed-empty-tags>\n";
-        String requireClosingTagsSection = "<require-closing-tags>\n" +
-                "    <literal-list>\n" +
-                "                <literal value=\"span\"/>\n" +
-                "    </literal-list>\n" +
-                "</require-closing-tags>\n";
-        String policyFile = assembleFile(allowedEmptyTagsSection + requireClosingTagsSection);
-
-        policy = Policy.getInstance(new ByteArrayInputStream(policyFile.getBytes()));
-        // If it reaches this point, it passed schema validation, which is what we want.
-    }
-
-    @Test
-    public void testGithubIssue66() {
-        // Concern is that LSEP characters are not being considered on .* pattern
-        // Note: Change was done in Policy loading, so test is located here
-        String tagRules = "<tag-rules>" +
-                            "<tag name=\"tag1\" action=\"validate\">" +
-                            "   <attribute name=\"attribute1\">" +
-                            "       <regexp-list>" +
-                            "           <regexp value=\".*\"/>" +
-                            "       </regexp-list>" +
-                            "   </attribute>" +
-                            "</tag>" +
-                            "</tag-rules>";
-        String rawPolicy = HEADER + DIRECTIVES + COMMON_REGEXPS + COMMON_ATTRIBUTES + GLOBAL_TAG_ATTRIBUTES + tagRules + CSS_RULES + FOOTER;
-
-        try {
-            policy = Policy.getInstance(new ByteArrayInputStream(rawPolicy.getBytes()));
-            assertThat(new AntiSamy().scan("<tag1 attribute1='Line 1\u2028Line 2'>Content</tag1>", policy, AntiSamy.DOM).getCleanHTML(), containsString("Line 1"));
-            assertThat(new AntiSamy().scan("<tag1 attribute1='Line 1\u2028Line 2'>Content</tag1>", policy, AntiSamy.SAX).getCleanHTML(), containsString("Line 1"));
-        } catch (Exception e) {
-            fail("Policy nor scan should fail:" + e.getMessage());
-        }
-    }
-
-    static void reloadSchemaValidation() throws Exception {
-        // Emulates the static code block used in Policy to set schema validation on/off if
-        // the Policy.VALIDATIONPROPERTY system property is set. If not set, it sets it to the default.
-        Method method = Policy.class.getDeclaredMethod("loadValidateSchemaProperty");
-        method.setAccessible(true);
-        method.invoke(null);
+  }
+
+  static void reloadSchemaValidation() throws Exception {
+    // Emulates the static code block used in Policy to set schema validation on/off if
+    // the Policy.VALIDATIONPROPERTY system property is set. If not set, it sets it to the
+    // default.
+    Method method = Policy.class.getDeclaredMethod("loadValidateSchemaProperty");
+    method.setAccessible(true);
+    method.invoke(null);
+  }
+
+  @Test
+  public void testGithubIssue79() {
+    URL policyUrl;
+
+    // Case 1: Loading policy from a URL beginning with "jar:file:"
+    try {
+      java.net.URLClassLoader child =
+          new java.net.URLClassLoader(
+              new URL[] {
+                Thread.currentThread()
+                    .getContextClassLoader()
+                    .getResource("policy-in-external-library.jar")
+              },
+              this.getClass().getClassLoader());
+
+      policyUrl =
+          Class.forName("org.owasp.antisamy.test.Dummy", true, child)
+              .getClassLoader()
+              .getResource("policyInsideJar.xml");
+      assertThat(policyUrl, notNullValue());
+
+      policy = Policy.getInstance(policyUrl);
+      assertThat(policy, notNullValue());
+    } catch (Exception e) {
+      fail("Policy nor scan should fail:" + e.getMessage());
     }
 
-    @Test
-    public void testGithubIssue79() {
-        URL policyUrl;
-
-        // Case 1: Loading policy from a URL beginning with "jar:file:"
-        try {
-            java.net.URLClassLoader child = new java.net.URLClassLoader(
-                    new URL[] {Thread.currentThread().getContextClassLoader().getResource("policy-in-external-library.jar")},
-                    this.getClass().getClassLoader()
-            );
-
-            policyUrl = Class.forName("org.owasp.antisamy.test.Dummy", true, child).getClassLoader().getResource("policyInsideJar.xml");
-            assertThat(policyUrl, notNullValue());
-
-            policy = Policy.getInstance(policyUrl);
-            assertThat(policy, notNullValue());
-        } catch (Exception e) {
-            fail("Policy nor scan should fail:" + e.getMessage());
-        }
-
-        // Case 2: Loading policy from a URL beginning with "jar:https:"
-        policyUrl = null;
-        try {
-            policyUrl = new URL("jar:https://somebadsite.com/foo.xml");
-            policy = Policy.getInstance(policyUrl);
-            fail("URL creation or policy loading should have failed");
-        } catch (Exception e) {
-        }
-        assertNull(policyUrl);
+    // Case 2: Loading policy from a URL beginning with "jar:https:"
+    policyUrl = null;
+    try {
+      policyUrl = new URL("jar:https://somebadsite.com/foo.xml");
+      policy = Policy.getInstance(policyUrl);
+      fail("URL creation or policy loading should have failed");
+    } catch (Exception e) {
     }
+    assertNull(policyUrl);
+  }
 }
diff --git a/src/test/java/org/owasp/validator/html/test/TestPolicy.java b/src/test/java/org/owasp/validator/html/test/TestPolicy.java
index 435175bc..62880300 100644
--- a/src/test/java/org/owasp/validator/html/test/TestPolicy.java
+++ b/src/test/java/org/owasp/validator/html/test/TestPolicy.java
@@ -31,69 +31,70 @@
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
-
 import org.owasp.validator.html.InternalPolicy;
 import org.owasp.validator.html.Policy;
 import org.owasp.validator.html.PolicyException;
 import org.owasp.validator.html.model.Property;
 import org.owasp.validator.html.model.Tag;
 
-/**
- * @author Kristian Rosenvold
- */
+/** @author Kristian Rosenvold */
 public class TestPolicy extends InternalPolicy {
 
-    protected TestPolicy(Policy.ParseContext parseContext) {
-        super(parseContext);
-    }
+  protected TestPolicy(Policy.ParseContext parseContext) {
+    super(parseContext);
+  }
 
-    protected TestPolicy(Policy old, Map<String, String> directives, Map<String, Tag> tagRules, Map<String, Property> cssRules) {
-        super(old, directives, tagRules, cssRules);
-    }
+  protected TestPolicy(
+      Policy old,
+      Map<String, String> directives,
+      Map<String, Tag> tagRules,
+      Map<String, Property> cssRules) {
+    super(old, directives, tagRules, cssRules);
+  }
 
-    public static TestPolicy getInstance() throws PolicyException {
-        return getInstance(Policy.class.getClassLoader().getResource(DEFAULT_POLICY_URI));
-    }
+  public static TestPolicy getInstance() throws PolicyException {
+    return getInstance(Policy.class.getClassLoader().getResource(DEFAULT_POLICY_URI));
+  }
 
-    public static TestPolicy getInstance(String filename) throws PolicyException {
-        File file = new File(filename);
-        return getInstance(file);
-    }
+  public static TestPolicy getInstance(String filename) throws PolicyException {
+    File file = new File(filename);
+    return getInstance(file);
+  }
 
-    public static TestPolicy getInstance(File file) throws PolicyException {
-        try {
-            URI uri = file.toURI();
-            return getInstance(uri.toURL());
-        } catch (IOException e) {
-            throw new PolicyException(e);
-        }
+  public static TestPolicy getInstance(File file) throws PolicyException {
+    try {
+      URI uri = file.toURI();
+      return getInstance(uri.toURL());
+    } catch (IOException e) {
+      throw new PolicyException(e);
     }
+  }
 
-    public static TestPolicy getInstance(URL url) throws PolicyException {
-        return new TestPolicy(getParseContext(getTopLevelElement(url), url));
-    }
+  public static TestPolicy getInstance(URL url) throws PolicyException {
+    return new TestPolicy(getParseContext(getTopLevelElement(url), url));
+  }
 
-    public TestPolicy cloneWithDirective(String name, String value) {
-        Map<String, String> directives = new HashMap<String, String>(this.directives);
-        directives.put(name, value);
-        return new TestPolicy(this, Collections.unmodifiableMap(directives), tagRules, cssRules);
-    }
+  public TestPolicy cloneWithDirective(String name, String value) {
+    Map<String, String> directives = new HashMap<String, String>(this.directives);
+    directives.put(name, value);
+    return new TestPolicy(this, Collections.unmodifiableMap(directives), tagRules, cssRules);
+  }
 
-    public TestPolicy addTagRule(Tag tag) {
-        Map<String, Tag> newTagRules = new HashMap<String, Tag>(tagRules);
-        newTagRules.put(tag.getName().toLowerCase(), tag);
-        return new TestPolicy(this, this.directives, newTagRules, cssRules);
-    }
+  public TestPolicy addTagRule(Tag tag) {
+    Map<String, Tag> newTagRules = new HashMap<String, Tag>(tagRules);
+    newTagRules.put(tag.getName().toLowerCase(), tag);
+    return new TestPolicy(this, this.directives, newTagRules, cssRules);
+  }
 
-    public TestPolicy mutateTag(Tag tag) {
-        Map<String, Tag> newRules = new HashMap<String, Tag>(this.tagRules);
-        newRules.put( tag.getName().toLowerCase(), tag);
-        return new TestPolicy(this, this.directives, newRules, cssRules);
-    }
+  public TestPolicy mutateTag(Tag tag) {
+    Map<String, Tag> newRules = new HashMap<String, Tag>(this.tagRules);
+    newRules.put(tag.getName().toLowerCase(), tag);
+    return new TestPolicy(this, this.directives, newRules, cssRules);
+  }
 
-    public TestPolicy addCssProperty(Property property) {
-        Map<String, Property> newCssRules = new HashMap<String, Property>(cssRules);
-        newCssRules.put(property.getName().toLowerCase(), property);
-        return new TestPolicy(this, this.directives, tagRules, newCssRules);
-    }
+  public TestPolicy addCssProperty(Property property) {
+    Map<String, Property> newCssRules = new HashMap<String, Property>(cssRules);
+    newCssRules.put(property.getName().toLowerCase(), property);
+    return new TestPolicy(this, this.directives, tagRules, newCssRules);
+  }
 }

From f7550f987a769e7deee3f70c7e7d65e9dbb8281f Mon Sep 17 00:00:00 2001
From: Dave Wichers <dwichers@gmail.com>
Date: Sat, 9 Jul 2022 18:34:25 -0400
Subject: [PATCH 34/36] Update the README to clearly describe the deprecated
 things that were removed and how to change their code to use the new APIs.

---
 README.md                                     | 41 +++++++++----------
 .../validator/html/scan/ASHTMLSerializer.java | 27 ++++++------
 2 files changed, 31 insertions(+), 37 deletions(-)

diff --git a/README.md b/README.md
index 1bc2769d..77f37da2 100644
--- a/README.md
+++ b/README.md
@@ -1,9 +1,24 @@
 # AntiSamy
 
-A library for performing fast, configurable cleansing of HTML coming from untrusted sources. Supports Java 7+.
+A library for performing fast, configurable cleansing of HTML coming from untrusted sources. Supports Java 8+.
 
 Another way of saying that could be: It's an API that helps you make sure that clients don't supply malicious cargo code in the HTML they supply for their profile, comments, etc., that get persisted on the server. The term "malicious code" in regards to web applications usually mean "JavaScript." Mostly, Cascading Stylesheets are only considered malicious when they invoke JavaScript. However, there are many situations where "normal" HTML and CSS can be used in a malicious manner.
 
+## IMPORTANT! - API breaking changes in 1.7.0
+
+Throughout the development of the 1.6.x series, we have identified and deprecated a number of features and APIs. All of these deprecated items have been removed in the 1.7.0 release. These changes were all tracked in ticket: https://github.com/nahsra/antisamy/issues/195. Each of the changes are described below:
+
+CssHandler had 2 constructors which dropped the LinkedList<URI> embeddedStyleSheets parameter. Both contructors now create an empty internal LinkedList<URI> and the method getImportedStylesheetsURIList() can be used to get a reference to it, if needed. This is rarely used so is unlikely to affect most users of AntiSamy. Normally, an empty list was passed in as this parameter value and that list was never used again.
+
+ * The CssHandler(Policy, LinkedList<URI>, List<String>, ResourceBundle) was dropped
+   * It was replaced with: CssHandler(Policy, List<String>, ResourceBundle)
+ * The CssHandler(Policy, LinkedList<URI>, List<String>, String, ResourceBundle) was dropped
+   * It was replaced with: CssHandler(Policy, List<String>, ResourceBundle, String). NOTE: The order of the last 2 parameters to this method was reversed.
+
+ * Support for XHTML was dropped. AntiSamy now only supports HTML. As we believe this was a rarely used feature, we don't expect this to affect many AntiSamy users.
+ * XML Schema validation is now required on AntiSamy policy files and cannot be disabled. You must make your policy file schema compliant in order to use it with AntiSamy.
+ * The policy directive 'noopenerAndNoreferrerAnchors' is now ON by default. If it is disabled, AntiSamy issues a nag, encouraging you to enable it.
+
 ## How to Use
 
 ### 1. Import the dependency
@@ -38,25 +53,7 @@ MySpace was, at the time this project was born, the most popular social networki
 
 I don’t know of a possible use case for this policy file. If you wanted to allow every single valid HTML and CSS element (but without JavaScript or blatant CSS-related phishing attacks), you can use this policy file. Not even MySpace was this crazy. However, it does serve as a good reference because it contains base rules for every element, so you can use it as a knowledge base when using tailoring the other policy files.
 
-### NOTE: Schema validation behavior change starting with AntiSamy 1.6.0
-
-While working on some improvements to AntiSamy's XML Schema Definition (XSD) for AntiSamy policy files, we noticed that AntiSamy was NOT actually enforcing the XSD. So, we've CHANGED the default behavior starting with AntiSamy 1.6.0 to enforce the schema, and not continue if the AntiSamy policy is invalid. However ...
-
-we recognize that it might not be possible for developers to fix their AntiSamy policies right away if they are non-compliant, and yet still want to upgrade AntiSamy to pick up any security improvements, feature enhancements, and bug fixes. As such, we've provided two ways to (temporarily!) disable schema validation:
-
-1) Set the Java System property: owasp.validator.validateschema to false. This can be done at the command line (e.g., -Dowasp.validator.validateschema=false) or via the Java System properties file. Neither requires a code change.
-
-2) Change the code using AntiSamy to invoke: Policy.setSchemaValidation(false) before loading the AntiSamy policy. This is a static call so once disabled, it is disabled for all new Policy instances.
-
-To encourage AntiSamy users to only use XSD compliant policies, AntiSamy will always log some type of warning when schema validation is disabled. It will either WARN that the policy is non-compliant so it can be fixed, or it will WARN that the policy is compliant, but schema validation is OFF, so validation should be turned back on (i.e., stop disabling it). We also added INFO level logging when AntiSamy schema's are loaded and validated.
-
-### Disabling schema validation is deprecated immediately, and will go away in AntiSamy 1.7+
-
-The ability to disable the new schema validation feature is intended to be temporary, to smooth the transition to properly valid AntiSamy policy files. We plan to drop this feature in the next major release. We estimate that this will be some time mid-late 2022, so not any time soon. The idea is to give dev teams using AntiSamy directly, or through other libraries like ESAPI, plenty of time to get their policy files schema compliant before schema validation becomes required. 
-
-### Logging: The logging introduced in 1.6.0 accidentally used log4j, while declaring slf4 as the logging API.
-
-This was quickly fixed in 1.6.1 to use slf4j APIs only. AntiSamy now includes the slf4j-simple library for its logging, but AntiSamy users can import and use an alternate slf4j compatible logging library if they prefer. They can also then exclude slf4j-simple if they want to.
+### Logging: AntiSamy now includes the slf4j-simple library for its logging, but AntiSamy users can import and use an alternate slf4j compatible logging library if they prefer. They can also then exclude slf4j-simple if they want to.
 
 WARNING: AntiSamy's use of slf4j-simple, without any configuration file, logs messages in a buffered manner to standard output. As such, some or all of these log messages may get lost if an Exception, such as a PolicyException is thrown. This can likely be rectified by configuring slf4j-simple to log to standard error instead, or use an alternate slf4j logger that does so.
 
@@ -103,10 +100,10 @@ The `CleanResults` object provides a lot of useful stuff.
  * `getCleanHTML()` - the clean, safe HTML output
  * `getCleanXMLDocumentFragment()` - the clean, safe `XMLDocumentFragment` which is reflected in `getCleanHTML()`
  * `getScanTime()` - returns the scan time in seconds
- 
+
 __Important Note__: There has been much confusion about the `getErrorMessages()` method. The `getErrorMessages()` method does not subtly answer the question "is this safe input?" in the affirmative if it returns an empty list. You must always use the sanitized input and there is no way to be sure the input passed in had no attacks.
 
-The serialization and deserialization process that is critical to the effectiveness of the sanitizer is purposefully lossy and will filter out attacks via a number of attack vectors. Unfortunately, one of the tradeoffs of this strategy is that we don't always know in retrospect that an attack was seen. Thus, the `getErrorMessages()` API is there to help users understand their well-intentioned input meet the requirements of the system, not help a developer detect if an attack was present. 
+The serialization and deserialization process that is critical to the effectiveness of the sanitizer is purposefully lossy and will filter out attacks via a number of attack vectors. Unfortunately, one of the tradeoffs of this strategy is that we don't always know in retrospect that an attack was seen. Thus, the `getErrorMessages()` API is there to help users understand their well-intentioned input meet the requirements of the system, not help a developer detect if an attack was present.
 
 ## Other Documentation
 
diff --git a/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java b/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java
index a7ba50ee..d1263d5a 100644
--- a/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java
+++ b/src/main/java/org/owasp/validator/html/scan/ASHTMLSerializer.java
@@ -31,18 +31,15 @@ public void endElementIO(String namespaceURI, String localName, String rawName)
 
     ElementState state;
 
-    // Works much like content() with additions for closing
-    // an element. Note the different checks for the closed
-    // element's state and the parent element's state.
+    // Works much like content() with additions for closing an element. Note the different checks
+    // for the closed element's state and the parent element's state.
     _printer.unindent();
     state = getElementState();
 
     if (state.empty) _printer.printText('>');
-    // This element is not empty and that last content was
-    // another element, so print a line break before that
-    // last element and this element's closing tag.
-    // [keith] Provided this is not an anchor.
-    // HTML: some elements do not print closing tag (e.g. LI)
+    // This element is not empty and that last content was another element, so print a line break
+    // before that last element and this element's closing tag. [keith] Provided this is not an
+    // anchor. HTML: some elements do not print closing tag (e.g. LI)
     if (rawName == null || !HTMLdtd.isOnlyOpening(rawName) || HTMLdtd.isOptionalClosing(rawName)) {
       if (_indenting && !state.preserveSpace && state.afterElement) _printer.breakLine();
       // Must leave CData section first (Illegal in HTML, but still)
@@ -52,8 +49,8 @@ public void endElementIO(String namespaceURI, String localName, String rawName)
       _printer.printText('>');
     }
 
-    // Leave the element state and update that of the parent
-    // (if we're not root) to not empty and after element.
+    // Leave the element state and update that of the parent (if we're not root) to not empty and
+    // after element.
     state = leaveElementState();
     // Temporary hack to prevent line breaks inside A/TD
     if (rawName == null || (!rawName.equalsIgnoreCase("A") && !rawName.equalsIgnoreCase("TD")))
@@ -63,11 +60,11 @@ public void endElementIO(String namespaceURI, String localName, String rawName)
   }
 
   /*
-  The override is to use printEscaped() which already escapes entity references
-   and writes them in the final serialized string. As escapeURI() is called like
-   "printer.printText(escapeURI(value))", if the URI is returned here it would
-   be double-printed and that is why the return value is an empty string.
-  */
+   * The override is to use printEscaped() which already escapes entity references
+   * and writes them in the final serialized string. As escapeURI() is called like
+   * "printer.printText(escapeURI(value))", if the URI is returned here it would
+   * be double-printed and that is why the return value is an empty string.
+   */
   @Override
   protected String escapeURI(String uri) {
     try {

From 842e2655ab1863440e16c18ff634265e85bc9829 Mon Sep 17 00:00:00 2001
From: Dave Wichers <dwichers@gmail.com>
Date: Sat, 9 Jul 2022 18:39:27 -0400
Subject: [PATCH 35/36] Fix README formatting a bit.

---
 README.md | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 77f37da2..15e91f7e 100644
--- a/README.md
+++ b/README.md
@@ -10,10 +10,10 @@ Throughout the development of the 1.6.x series, we have identified and deprecate
 
 CssHandler had 2 constructors which dropped the LinkedList<URI> embeddedStyleSheets parameter. Both contructors now create an empty internal LinkedList<URI> and the method getImportedStylesheetsURIList() can be used to get a reference to it, if needed. This is rarely used so is unlikely to affect most users of AntiSamy. Normally, an empty list was passed in as this parameter value and that list was never used again.
 
- * The CssHandler(Policy, LinkedList<URI>, List<String>, ResourceBundle) was dropped
-   * It was replaced with: CssHandler(Policy, List<String>, ResourceBundle)
- * The CssHandler(Policy, LinkedList<URI>, List<String>, String, ResourceBundle) was dropped
-   * It was replaced with: CssHandler(Policy, List<String>, ResourceBundle, String). NOTE: The order of the last 2 parameters to this method was reversed.
+ * The CssHandler(Policy, LinkedList\<URI\>, List\<String\>, ResourceBundle) was dropped
+   * It was replaced with: CssHandler(Policy, List\<String\>, ResourceBundle)
+ * The CssHandler(Policy, LinkedList\<URI\>, List\<String\>, String, ResourceBundle) was dropped
+   * It was replaced with: CssHandler(Policy, List\<String\>, ResourceBundle, String). NOTE: The order of the last 2 parameters to this method was reversed.
 
  * Support for XHTML was dropped. AntiSamy now only supports HTML. As we believe this was a rarely used feature, we don't expect this to affect many AntiSamy users.
  * XML Schema validation is now required on AntiSamy policy files and cannot be disabled. You must make your policy file schema compliant in order to use it with AntiSamy.
@@ -53,7 +53,8 @@ MySpace was, at the time this project was born, the most popular social networki
 
 I don’t know of a possible use case for this policy file. If you wanted to allow every single valid HTML and CSS element (but without JavaScript or blatant CSS-related phishing attacks), you can use this policy file. Not even MySpace was this crazy. However, it does serve as a good reference because it contains base rules for every element, so you can use it as a knowledge base when using tailoring the other policy files.
 
-### Logging: AntiSamy now includes the slf4j-simple library for its logging, but AntiSamy users can import and use an alternate slf4j compatible logging library if they prefer. They can also then exclude slf4j-simple if they want to.
+### Logging
+AntiSamy now includes the slf4j-simple library for its logging, but AntiSamy users can import and use an alternate slf4j compatible logging library if they prefer. They can also then exclude slf4j-simple if they want to.
 
 WARNING: AntiSamy's use of slf4j-simple, without any configuration file, logs messages in a buffered manner to standard output. As such, some or all of these log messages may get lost if an Exception, such as a PolicyException is thrown. This can likely be rectified by configuring slf4j-simple to log to standard error instead, or use an alternate slf4j logger that does so.
 
@@ -85,14 +86,11 @@ There are a few ways to create a `Policy` object. The `getInstance()` method can
 AntiSamy as = new AntiSamy();
 CleanResults cr = as.scan(dirtyInput, policyFilePath);
 ```
-
 Finally, policy files can also be referenced by `File` objects directly in the second parameter:
-
 ```
 AntiSamy as = new AntiSamy();
 CleanResults cr = as.scan(dirtyInput, new File(policyFilePath));
 ```
-
 ### 5. Analyzing CleanResults
 The `CleanResults` object provides a lot of useful stuff.
 
@@ -127,6 +125,5 @@ $ git clone https://github.com/nahsra/antisamy
 $ cd antisamy
 $ mvn package
 ```
-
 ## License
 Released under the [BSD-3-Clause](https://opensource.org/licenses/BSD-3-Clause) license as specified here: [LICENSE](https://github.com/nahsra/antisamy/blob/main/LICENSE).

From 8ec86945713cc692a272127dacbacbfd928ed9c8 Mon Sep 17 00:00:00 2001
From: Dave Wichers <dwichers@gmail.com>
Date: Tue, 12 Jul 2022 14:21:01 -0400
Subject: [PATCH 36/36] Minor tweaks to README and upgrades to pom to match
 changes to main branch.

---
 README.md | 6 +++---
 pom.xml   | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 15e91f7e..f4f3d375 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ Another way of saying that could be: It's an API that helps you make sure that c
 
 Throughout the development of the 1.6.x series, we have identified and deprecated a number of features and APIs. All of these deprecated items have been removed in the 1.7.0 release. These changes were all tracked in ticket: https://github.com/nahsra/antisamy/issues/195. Each of the changes are described below:
 
-CssHandler had 2 constructors which dropped the LinkedList<URI> embeddedStyleSheets parameter. Both contructors now create an empty internal LinkedList<URI> and the method getImportedStylesheetsURIList() can be used to get a reference to it, if needed. This is rarely used so is unlikely to affect most users of AntiSamy. Normally, an empty list was passed in as this parameter value and that list was never used again.
+CssHandler had 2 constructors which dropped the LinkedList<URI> embeddedStyleSheets parameter. Both contructors now create an empty internal LinkedList<URI> and the method getImportedStylesheetsURIList() can be used to get a reference to it, if needed. This feature is rarely used, and in fact direct invocation of these constructors is also rare, so this change is unlikely to affect most users of AntiSamy. When used, normally an empty list is passed in as this parameter value and that list is never used again.
 
  * The CssHandler(Policy, LinkedList\<URI\>, List\<String\>, ResourceBundle) was dropped
    * It was replaced with: CssHandler(Policy, List\<String\>, ResourceBundle)
@@ -43,7 +43,7 @@ Accordingly, we’ve built a policy file that allows fairly similar functionalit
 
 2) antisamy-ebay.xml
 
-eBay is the most popular online auction site in the universe, as far as I can tell. It is a public site so anyone is allowed to post listings with rich HTML content. It’s not surprising that given the attractiveness of eBay as a target that it has been subject to a few complex XSS attacks. Listings are allowed to contain much more rich content than, say, Slashdot -- so it’s attack surface is considerably larger.
+eBay is the most popular online auction site in the universe, as far as we can tell. It is a public site so anyone is allowed to post listings with rich HTML content. It’s not surprising that given the attractiveness of eBay as a target that it has been subject to a few complex XSS attacks. Listings are allowed to contain much more rich content than, say, Slashdot -- so it’s attack surface is considerably larger.
 
 3) antisamy-myspace.xml
 
@@ -51,7 +51,7 @@ MySpace was, at the time this project was born, the most popular social networki
 
 4) antisamy-anythinggoes.xml
 
-I don’t know of a possible use case for this policy file. If you wanted to allow every single valid HTML and CSS element (but without JavaScript or blatant CSS-related phishing attacks), you can use this policy file. Not even MySpace was this crazy. However, it does serve as a good reference because it contains base rules for every element, so you can use it as a knowledge base when using tailoring the other policy files.
+We don’t know of a possible use case for this policy file. If you wanted to allow every single valid HTML and CSS element (but without JavaScript or blatant CSS-related phishing attacks), you can use this policy file. Not even MySpace was this crazy. However, it does serve as a good reference because it contains base rules for every element, so you can use it as a knowledge base when using tailoring the other policy files.
 
 ### Logging
 AntiSamy now includes the slf4j-simple library for its logging, but AntiSamy users can import and use an alternate slf4j compatible logging library if they prefer. They can also then exclude slf4j-simple if they want to.
diff --git a/pom.xml b/pom.xml
index 2e2734b6..72996edf 100644
--- a/pom.xml
+++ b/pom.xml
@@ -66,7 +66,7 @@
         <dependency>
             <groupId>net.sourceforge.htmlunit</groupId>
             <artifactId>neko-htmlunit</artifactId>
-            <version>2.62.0</version>
+            <version>2.63.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.httpcomponents.client5</groupId>
@@ -83,7 +83,7 @@
         <dependency>
             <groupId>org.apache.httpcomponents.core5</groupId>
             <artifactId>httpcore5</artifactId>
-            <version>5.1.3</version>
+            <version>5.1.4</version>
         </dependency>
         <dependency>
             <groupId>org.apache.xmlgraphics</groupId>
@@ -252,7 +252,7 @@
                     <dependency>
                         <groupId>org.codehaus.mojo</groupId>
                         <artifactId>extra-enforcer-rules</artifactId>
-                        <version>1.5.1</version>
+                        <version>1.6.0</version>
                     </dependency>
                     <dependency>
                         <groupId>org.codehaus.mojo</groupId>