[Owasp-antisamy] 'A' tag with no children
arshan.dabirsiaghi at aspectsecurity.com
Fri Jan 8 17:57:24 EST 2010
There is no associated vulnerability, and no way to change it without recompilation. This whole mess was introduced because of the browser bug (feature) associated with this issue:
I added "a" to the allowed-to-be-empty-list in svn so it will be in the next version, which should be rolled out really, really soon.
From: owasp-antisamy-bounces at lists.owasp.org on behalf of August Detlefsen
Sent: Fri 1/8/2010 5:19 PM
To: owasp-antisamy at lists.owasp.org
Subject: [Owasp-antisamy] 'A' tag with no children
I ran into this issue with AntiSamy:
Within the HTML I was validating was an A tag being used as an in-page
And AntiSamy complains:
The a tag was empty, and therefore we could not process it. The rest of
the message is intact, and its removal should not have any side effects.
I found the array containing the list of valid child-less tags (like
IMG, HR, BR, etc) in AntiSamyDOMScanner.java, and it would be easy to
add A there, but my question for you is:
Is there a vulnerability associated with an empty A tag that is keeping
it off that list? Is there some way to configure the allowed empty tags
in the policy file, without recompiling the source code?
CEO/Web Application Architect
Owasp-antisamy mailing list
Owasp-antisamy at lists.owasp.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Owasp-antisamy