[Owasp-antisamy] 'A' tag with no children
augustd at codemagi.com
Fri Jan 8 19:00:10 EST 2010
I basically took the same approach and added "a" to the
allowedEmptyTags. I am glad to hear that you added this to the next
I also added "area" to allow for image maps -Is there a vulnerability
associated with these?
In looking at the source code that uses allowedEmptyTags, it seems to me
that (at least in Java) using a HashSet would provide better lookup
performance than iterating the array. It can be rewritten as:
private static final HashSet<String> allowedEmptyTags = new
//be sure to use lower case for tag names
And in recursiveValidateTag:
boolean isEmptyAllowed =
I ran a quick test and using a HashSet is about 35% faster than using an
array, even accounting for equalsIgnoreCase() vs toLowerCase().
On 1/8/10 2:57 PM, Arshan Dabirsiaghi wrote:
> There is no associated vulnerability, and no way to change it without
> recompilation. This whole mess was introduced because of the browser
> bug (feature) associated with this issue:
> I added "a" to the allowed-to-be-empty-list in svn so it will be in
> the next version, which should be rolled out really, really soon.
> *From:* owasp-antisamy-bounces at lists.owasp.org on behalf of August
> *Sent:* Fri 1/8/2010 5:19 PM
> *To:* owasp-antisamy at lists.owasp.org
> *Subject:* [Owasp-antisamy] 'A' tag with no children
> I ran into this issue with AntiSamy:
> Within the HTML I was validating was an A tag being used as an in-page
> <a name="anchor"></a>
> And AntiSamy complains:
> The a tag was empty, and therefore we could not process it. The rest of
> the message is intact, and its removal should not have any side effects.
> I found the array containing the list of valid child-less tags (like
> IMG, HR, BR, etc) in AntiSamyDOMScanner.java, and it would be easy to
> add A there, but my question for you is:
> Is there a vulnerability associated with an empty A tag that is keeping
> it off that list? Is there some way to configure the allowed empty tags
> in the policy file, without recompiling the source code?
> August Detlefsen
> CEO/Web Application Architect
> CodeMagi, Inc.
> http://www.codemagi.com <http://www.codemagi.com/>
> Owasp-antisamy mailing list
> Owasp-antisamy at lists.owasp.org
CEO/Web Application Architect
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Owasp-antisamy