java-html-sanitizer
java-html-sanitizer copied to clipboard
text-align literals are outdated
On CssSchema (https://github.com/OWASP/java-html-sanitizer/blob/f729a089b20aef49ed9ffd7ed1c7e207eee71dc5/owasp-java-html-sanitizer/src/main/java/org/owasp/html/CssSchema.java#L714)
Property textAlign = new Property(0, union(azimuthLiterals1, textAlignLiterals0), zeroFns);
builder.put("text-align", textAlign);
The text-align possible values are (https://developer.mozilla.org/en-US/docs/Web/CSS/text-align ) :
text-align: start;
text-align: end;
text-align: left;
text-align: right;
text-align: center;
text-align: justify;
text-align: justify-all;
text-align: match-parent;
/* Block alignment values (Non-standard syntax) */
text-align: -moz-center;
text-align: -webkit-center;
/* Global values */
text-align: inherit;
text-align: initial;
text-align: revert;
text-align: revert-layer;
text-align: unset;
And only 5 of them are kept when sanitizing right now : left, right, center, inherit, justify
I did a dirty hack for the moment to cover my needs:
try {
CssSchema cssSchema = CssSchema.DEFAULT;
Method forKey = cssSchema.getClass().getDeclaredMethod("forKey", String.class);
forKey.setAccessible(true);
CssSchema.Property p = (CssSchema.Property) forKey.invoke(union, "text-align");
Field literalsField = p.getClass().getDeclaredField("literals");
literalsField.setAccessible(true);
Set<String> literals = new HashSet<>((Set<String>) literalsField.get(p));
literals.add("start");
literals.add("end");
literalsField.set(p, literals);
} catch (Exception e) {
...
}
The literals of other css properties might be outdated too, I didn't check but it might be needed to review all of them.