java-html-sanitizer icon indicating copy to clipboard operation
java-html-sanitizer copied to clipboard

text-align literals are outdated

Open DeepSnowNeeL opened this issue 1 year ago • 0 comments

On CssSchema (https://github.com/OWASP/java-html-sanitizer/blob/f729a089b20aef49ed9ffd7ed1c7e207eee71dc5/owasp-java-html-sanitizer/src/main/java/org/owasp/html/CssSchema.java#L714)

 Property textAlign = new Property(0, union(azimuthLiterals1, textAlignLiterals0), zeroFns);
        builder.put("text-align", textAlign);

The text-align possible values are (https://developer.mozilla.org/en-US/docs/Web/CSS/text-align ) :

text-align: start;
text-align: end;
text-align: left;
text-align: right;
text-align: center;
text-align: justify;
text-align: justify-all;
text-align: match-parent;

/* Block alignment values (Non-standard syntax) */
text-align: -moz-center;
text-align: -webkit-center;

/* Global values */
text-align: inherit;
text-align: initial;
text-align: revert;
text-align: revert-layer;
text-align: unset;

And only 5 of them are kept when sanitizing right now : left, right, center, inherit, justify

I did a dirty hack for the moment to cover my needs:

try {
        CssSchema cssSchema = CssSchema.DEFAULT;
	Method forKey = cssSchema.getClass().getDeclaredMethod("forKey", String.class);
	forKey.setAccessible(true);
	CssSchema.Property p = (CssSchema.Property) forKey.invoke(union, "text-align");
	Field literalsField = p.getClass().getDeclaredField("literals");
	literalsField.setAccessible(true);
	Set<String> literals = new HashSet<>((Set<String>) literalsField.get(p));
	literals.add("start");
	literals.add("end");
	literalsField.set(p, literals);
} catch (Exception e) {
	...
}

The literals of other css properties might be outdated too, I didn't check but it might be needed to review all of them.

DeepSnowNeeL avatar May 24 '24 11:05 DeepSnowNeeL