[Owasp-antisamy] org.w3c.dom problem using antisamy

Arnout Engelen antisamy at bzzt.net
Tue Apr 15 05:00:22 EDT 2008


Hi,

When using antisamy in a webapp running under resin 2 (don't ask), I ran
into:

Caused by: java.lang.UnsupportedOperationException
	at com.caucho.xml.QAbstractNode.getTextContent(QAbstractNode.java:301)
	at org.owasp.validator.html.Policy.parseTagRules(Unknown Source)
	at org.owasp.validator.html.Policy.<init>(Unknown Source)
	at org.owasp.validator.html.Policy.getInstance(Unknown Source)
(snip)

Looks like Policy.parseTagRules uses a method of org.w3c.dom that's not always
implemented. (also, it'd be valuable for debugging if releases were built with
line number information)

I worked around it (somewhat hackishly) by setting a system property before 
initializing AntiSamy like this:

System.setProperty("javax.xml.parsers.DocumentBuilderFactory", 
	"org.apache.xerces.jaxp.DocumentBuilderFactoryImpl");

Perhaps we should make a wikipage to record these kind of gotcha's and 
solutions for them?


Kind regards,

Arnout


More information about the Owasp-antisamy mailing list