Category:OWASP AntiSamy Project - Revision history

Wichers at 22:06, 13 May 2019

2019-05-13T22:06:29Z

Jmanico at 11:57, 26 September 2017

2017-09-26T11:57:31Z

Jmanico at 11:56, 26 September 2017

2017-09-26T11:56:52Z

Jmanico: removing inactive status

2017-09-26T11:50:38Z

removing inactive status

Jmanico: providing update warning

2017-09-26T11:49:27Z

providing update warning

Jmanico at 11:46, 26 September 2017

2017-09-26T11:46:32Z

Jmanico at 11:45, 26 September 2017

2017-09-26T11:45:00Z

Jmanico: trying to update wiki

2017-09-26T11:40:14Z

trying to update wiki

Jmanico at 11:39, 26 September 2017

2017-09-26T11:39:17Z

Arshan: no quickdownload available

2017-09-25T14:50:54Z

no quickdownload available

@@ Line 123: / Line 123: @@
 Accordingly, we've built a policy file that allows fairly similar functionality. All text-formatting tags that operate directly on the font, color or emphasis have been allowed.
 ) antisamy-ebay.xml
 eBay (http://www.ebay.com/) is the most popular online auction site in the universe, as far as I can tell. It is a public site so anyone is allowed to post listings with rich HTML content. It's not surprising that given the attractiveness of eBay as a target that it has been subject to a few complex XSS attacks. Listings are allowed to contain much more rich content than, say, Slashdot- so it's attack surface is considerably larger. The following tags appear to be accepted by eBay (they don't publish rules): <a>,...
 ) antisamy-myspace.xml
 MySpace (http://www.myspace.com/) was, at the time this project was born, arguably the most popular social networking site today. Users were allowed to submit pretty much all HTML and CSS they want - as long as it doesn't contain JavaScript. MySpace was using a word blacklist to validate users' HTML, which is why they were subject to the infamous Samy worm (http://namb.la/). The Samy worm, which used fragmentation attacks combined with a word that should have been blacklisted (eval) - was the inspiration for the project.
 ) antisamy-anythinggoes.xml
 I don't know of a possible use case for this policy file. If you wanted to allow every single valid HTML and CSS element (but without JavaScript or blatant CSS-related phishing attacks), you can use this policy file. Not even MySpace was _this_ crazy. However, it does serve as a good reference because it contains base rules for every element, so you can use it as a knowledge base when using tailoring the other policy files.
 === Stage 3 - Tailoring the policy file ===
@@ Line 151: / Line 144: @@
 === Stage 4 - Calling the AntiSamy API ===
-Using AntiSamy is abnormally easy. Here is an example of invoking AntiSamy with a policy file:
+Using AntiSamy is easy. Here is an example of invoking AntiSamy with a policy file:
-MyUserDAO.storeUserProfile(cr.getCleanHTML()); // some custom function
+ import org.owasp.validator.html.*;
-</pre></code>
 There are a few ways to create a Policy object. The <code>getInstance()</code> method can take any of the following:
@@ Line 168: / Line 160: @@
 * an InputStream
-Policy files can also be referenced by filename by passing a second argument to the <code>AntiSamy:scan()</code> method as the following examples show.:
+Policy files can also be referenced by filename by passing a second argument to the <code>AntiSamy:scan()</code> method as the following examples show:
-<code><pre>AntiSamy as = new AntiSamy();
+ AntiSamy as = new AntiSamy();
-CleanResults cr = as.scan(dirtyInput, policyFilePath);</pre></code>
+ CleanResults cr = as.scan(dirtyInput, policyFilePath);</pre></code>
 Finally, policy files can also be referenced by File objects directly in the second parameter:
-<code><pre>AntiSamy as = new AntiSamy();
+ AntiSamy as = new AntiSamy();
-CleanResults cr = as.scan(dirtyInput, new File(policyFilePath));</pre></code>
+ CleanResults cr = as.scan(dirtyInput, new File(policyFilePath));
 === Stage 5 - Analyzing CleanResults ===
@@ Line 199: / Line 191: @@
 === Emailing the project lead ===
-For content which is not appropriate for the public mailing list, you can alternatively contact the project lead, Arshan Dabirsiaghi, at [arshan.dabirsiaghi] at [aspectsecurity.com].
+For content which is not appropriate for the public mailing list, you can alternatively contact the project lead, Arshan Dabirsiaghi, at [arshan.dabirsiaghi] at [contrastsecurity.com] or Dave Wichers at [dave.wichers] at [owasp.org].
 === Issue tracking ===
@@ Line 206: / Line 198: @@
 ==Sponsors==
-The AntiSamy project is sponsored by [http://www.contrastsecurity.com/ Contrast Security].
+The AntiSamy project is sponsored by [https://www.contrastsecurity.com/ Contrast Security].
 The initial Java project was sponsored by the [[OWASP Spring Of Code 2007|OWASP Spring Of Code 2007]]. The .NET project was sponsored by the [[OWASP Summer of Code 2008]].
@@ Line 217: / Line 209: @@
 === .NET ===
-A .NET port of AntiSamy is available now at the [[:Category:OWASP AntiSamy Project .NET|OWASP AntiSamy .NET]] page. The project was funded by a Summer of Code 2008 grant and was developed by Jerry Hoff.
+A .NET port of AntiSamy is available now at the [[:Category:OWASP AntiSamy Project .NET|OWASP AntiSamy .NET]] page. The project was funded by a Summer of Code 2008 grant and was developed by Jerry Hoff. However, this version of AntiSamy has not been updated in a while.
-This port is no longer under active development, and is looking for a few good developers to help make it feature-synchronized with the .NET version. If it doesn't suit your needs, consider Microsoft's [http://blogs.msdn.com/b/securitytools/archive/2009/09/01/html-sanitization-in-anti-xss-library.aspx AntiXSS] library.
+This port is no longer under active development, and is looking for a few good developers to help make it feature-synchronized with the Java version. If it doesn't suit your needs, consider Microsoft's [http://blogs.msdn.com/b/securitytools/archive/2009/09/01/html-sanitization-in-anti-xss-library.aspx AntiXSS] library.
 === Python ===
-A beta Python version is currently being prototyped by a few different groups. As more information becomes available, we will post it here. If you are interested in helping, please contact the mailing list.
+A port of AntiSamy to Python was attempted, but has been abandoned since 2010. Michael Coates suggests you check out project Bleach instead: https://pypi.org/project/bleach/
 === PHP ===
 Although a PHP version was initially planned, we now suggest [http://htmlpurifier.org HTMLPurifier] for safe rich input validation for PHP applications.
 =Project About=

@@ Line 95: / Line 95: @@
 There's 4 steps in the process of integrating AntiSamy. Each step is detailed in the next section, but the high level overview follows:
-# Download AntiSamy from [http://code.google.com/p/owaspantisamy/downloads/list its home on Google Code]
+# Download AntiSamy from Maven
 # Choose one of the standard policy files that matches as close to the functionality you need:
 #* antisamy-tinymce-X.X.X.xml

@@ Line 107: / Line 107: @@
 === Stage 1 - Downloading AntiSamy ===
-The following instructions are for AntiSamy Java, the main version. For instructions on the .NET version, see [[the .NET page]].
+First, add the dependency from Maven:
-Which package you download depends on what you want to do with AntiSamy. If you'd like to extend it or review the code, download the source package '''antisamy-X.X.X-src.jar'''. If you're looking to integrate AntiSamy, you can either download the library or use Maven to include it in your build. If you want to use Maven, here's [[an example POM for including AntiSamy]]. If you want a jar file, then download the '''antisamy-X.X.X.jar''' (which, before version 1.2 was confusingly called "antisamy-standalone-X.X.X.jar"), which only contains AntiSamy library. This will be the preferred choice for mature enterprise environments who don't want to be caught in classpath issues which may be introduced by the current version.
+ <dependency>
+   <groupId>org.owasp.antisamy</groupId>
-The second option, ''only available for versions before 1.2,'' is to download '''antisamy-standalone-X.X.X.jar''', which contains not only the AntiSamy code, but all necessary supporting libraries. This should only be used by applications that don't use the libraries AntiSamy ships with as they might introduce classpath and versioning issues. ''This option is no longer available after version 1.2.''
+   <projectId>antisamy</projectId>
+ </dependency>
 === Stage 2 - Choosing a base policy file ===

@@ Line 4: / Line 4: @@
 ! width="500" align="center" | <br>
 |-
 | align="right" |
+| align="right" |
 |}
 =Main=

@@ Line 69: / Line 69: @@
 == News and Events ==
 * [20 Nov 2013] News 2
 * [30 Sep 2013] News 1
 == In Print ==

@@ Line 1: / Line 1: @@
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
@@ Line 4: / Line 15: @@
 | valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
-=OWASP AntiSamy Project=
+==OWASP AntiSamy Project==
 OWASP AntiSamy is a library for HTML and CSS encoding.
-=Introduction=
+==Introduction==
 AntiSamy was originally authored by Arshan Dabirsiaghi (arshan.dabirsiaghi [at the] gmail.com) of Contrast Security with help from Jason Li (jason.li [at the] owasp.org) of Aspect Security (http://www.aspectsecurity.com/).
-=Description=
+==Description==
 The OWASP AntiSamy project is a few things. Technically, it is an API for ensuring user-supplied HTML/CSS is in compliance within an application's rules. Another way of saying that could be: It's an API that helps you make sure that clients don't supply malicious cargo code in the HTML they supply for their profile, comments, etc., that get persisted on the server. The term "malicious code" in regards to web applications usually mean "JavaScript." Cascading Stylesheets are only considered malicious when they invoke the JavaScript engine. However, there are many situations where "normal" HTML and CSS can be used in a malicious manner. So we take care of that too.
@@ Line 25: / Line 36: @@
 | valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
-= What is AntiSamy=
+== What is AntiSamy ==
 OWASP AntiSamy  provides:
@@ Line 32: / Line 43: @@
-= Presentations =
+== Presentations ==
 From OWASP & WASC AppSec U.S. 2007 Conference (San Jose, CA): [http://www.owasp.org/images/e/e9/OWASP-WASCAppSec2007SanJose_AntiSamy.ppt AntiSamy - Picking a Fight with XSS (ppt)] - by Arshan Dabirsiaghi - AntiSamy project lead
@@ Line 43: / Line 54: @@
-= Project Leader =
+== Project Leader ==
 [mailto:arshan.dabirsiaghi@gmail.com Arshan Dabirsiaghi]
 | valign="top"  style="padding-left:25px;width:200px;" |

← Older revision		Revision as of 14:50, 25 September 2017
Line 67:		Line 67:

	\| valign="top" style="padding-left:25px;width:200px;" \|		\| valign="top" style="padding-left:25px;width:200px;" \|
−
−	~~== Quick Download ==~~
−
−	~~https://code.google.com/p/owaspantisamy/downloads/list~~
−
−

	== News and Events ==		== News and Events ==