Projects/OWASP Java HTML Sanitizer Project/Releases/Release v209 - Revision history

Jmanico: Blanked the page

2014-03-04T22:14:02Z

Blanked the page

Jmanico at 22:12, 4 March 2014

2014-03-04T22:12:14Z

Jmanico at 21:38, 4 March 2014

2014-03-04T21:38:55Z

Jmanico at 01:37, 16 September 2013

2013-09-16T01:37:08Z

Jmanico: Created page with "= OWASP Java HTML Sanitizer Change Log = 209 Reworked CssSchema to allow users to extend the default property white-list. 198 Replaced CSS sanitizer with one that does token-..."

2013-09-16T01:36:36Z

Created page with "= OWASP Java HTML Sanitizer Change Log = 209 Reworked CssSchema to allow users to extend the default property white-list. 198 Replaced CSS sanitizer with one that does token-..."

New page

= OWASP Java HTML Sanitizer Change Log =

209 Reworked CssSchema to allow users to extend the default property white-list.
198 Replaced CSS sanitizer with one that does token-level filtering, and replaces the old CSS lexer that used regular expressions with one that doesn't back-track, or behave quadratically on crafted inputs.
127 Fixed bug: tag balancer allowed </p> to close a table, so rewrote tag balancer to recognize scoping elements per HTML5.
164 Fixed bug: missing bit in HTML schema led to text in <option> elements being elided even when the elements themselves were white-listed.
161 Fixed bug: requireRelNoFollowOnLinks() was implicitly allowing the a element. Changed this to be consistent with document: no elements are allowed that do not appear in a call to allowElements.
132 Add methods to policy builder to specify which elements are allowed to contain text and change default to disallow text in CDATA elements whose content is often not plain text. If custom element policies that change the element type fail, make sure the policy allows the output element type.
122 Restrict where text-nodes can validly appear in output per HTML5 rules and changed the tag balancer to do better error recovery on misplaced phrasing content.
114 Changed rendering to ensure that the output HTML is valid XML when the policy prohibits HTML raw text & RCDATA elements as is almost always the case.
104 Changed lexer to treat <?…> using the HTML5 bogus comment state grammar which agrees with XML's processing instruction production. Previously, the token ended at the first "?>" or end-of-file instead of the first ">".
99 Fixed problem with URL protocol white-listing that caused legitimate URLs to be rejected.
88 Cleaned up raw-text tag handling. XMP, LISTING, PLAINTEXT now handled by substitution in the renderer and changed NOSCRIPT and friends so they are treated consistently when elided as when present in output. Added workaround for IE8 innerHTML wierdness.
83 Prevent DoS of browsers via extremely deeply nested tags. In sanitized CSS, allow CSS property background-color andfont-sizes specified in px.
74 Added convenient pre-packaged policies in Sanitizers. Fixed bug in how warnings are reported via the badHtml Handler.
50 Better handling of supplementary codepoints to avoid UTF-16/UCS-2 confusion in browsers.
48 Added new HTML5 URL attributes to list used to safeguard URL attributes in HtmlPolicyBuilder.
42 Changed HtmlSanitizer.sanitize to allow null as a valid value for the HTML snippet.

← Older revision		Revision as of 22:14, 4 March 2014
Line 1:		Line 1:
−	~~{{Template: <includeonly>{{{1}}}</includeonly><noinclude>Release About</noinclude>~~
−	~~\| project_name = OWASP Java HTML Sanitizer~~
−	~~\| project_home_page = OWASP Java HTML Sanitizer Project~~
−	~~\| release_name = OWASP Java HTML Sanitizer v209~~
−	~~\| release_date = 03/03/2013~~

−	~~\| release_description =~~
−
−	~~'''This is a bugfix release.'''~~
−
−	~~\| release_license = [http://www.apache.org/licenses/LICENSE-2.0 Apache License 2.0]~~
−	~~\| release_download_link = https://code.google.com/p/owasp-java-html-sanitizer/downloads/detail?name=owasp-java-html-sanitizer-r209.zip&can=2&q=~~
−
−	~~\| leader_name1 = Mike Samuel~~
−	~~\| leader_email1 = msamuel@gmail.com~~
−	~~\| leader_username1 =Mike_Samuel~~
−
−	~~\| leader_name2 =~~
−	~~\| leader_email2 =~~
−	~~\| leader_username2 =~~
−
−	~~\| release_notes = http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/CHANGE_LOG.html~~
−	}}

@@ Line 1: / Line 1: @@
-= OWASP Java HTML Sanitizer Change Log v209 =
+{{Template: <includeonly>{{{1}}}</includeonly><noinclude>Release About</noinclude>
-* 209 Reworked CssSchema to allow users to extend the default property white-list.
+| release_description =
-* 198 Replaced CSS sanitizer with one that does token-level filtering, and replaces the old CSS lexer that used regular expressions with one that doesn't back-track, or behave quadratically on crafted inputs.
-* 127 Fixed bug: tag balancer allowed </p> to close a table, so rewrote tag balancer to recognize scoping elements per HTML5.
+'''This is a bugfix release.'''
-* 164 Fixed bug: missing bit in HTML schema led to text in <option> elements being elided even when the elements themselves were white-listed.
-* 161 Fixed bug: requireRelNoFollowOnLinks() was implicitly allowing the a element. Changed this to be consistent with document: no elements are allowed that do not appear in a call to allowElements.
+| release_license = [http://www.apache.org/licenses/LICENSE-2.0 Apache License 2.0]
-* 132 Add methods to policy builder to specify which elements are allowed to contain text and change default to disallow text in CDATA elements whose content is often not plain text. If custom element policies that change the element type fail, make sure the policy allows the output element type.
+| release_download_link = https://code.google.com/p/owasp-java-html-sanitizer/downloads/detail?name=owasp-java-html-sanitizer-r209.zip&can=2&q=
-* 122 Restrict where text-nodes can validly appear in output per HTML5 rules and changed the tag balancer to do better error recovery on misplaced phrasing content.
-* 114 Changed rendering to ensure that the output HTML is valid XML when the policy prohibits HTML raw text & RCDATA elements as is almost always the case.
+| leader_name1 = Mike Samuel
-* 104 Changed lexer to treat <?…> using the HTML5 bogus comment state grammar which agrees with XML's processing instruction production. Previously, the token ended at the first "?>" or end-of-file instead of the first ">".
+| leader_email1 = msamuel@gmail.com
-* 99 Fixed problem with URL protocol white-listing that caused legitimate URLs to be rejected.
+| leader_username1 =Mike_Samuel
-* 88 Cleaned up raw-text tag handling. XMP, LISTING, PLAINTEXT now handled by substitution in the renderer and changed NOSCRIPT and friends so they are treated consistently when elided as when present in output. Added workaround for IE8 innerHTML wierdness.
-* 83 Prevent DoS of browsers via extremely deeply nested tags. In sanitized CSS, allow CSS property background-color andfont-sizes specified in px.
+| leader_name2 =
-* 74 Added convenient pre-packaged policies in Sanitizers. Fixed bug in how warnings are reported via the badHtml Handler.
+| leader_email2 =
-* 50 Better handling of supplementary codepoints to avoid UTF-16/UCS-2 confusion in browsers.
+| leader_username2 =
-* 48 Added new HTML5 URL attributes to list used to safeguard URL attributes in HtmlPolicyBuilder.
-* 42 Changed HtmlSanitizer.sanitize to allow null as a valid value for the HTML snippet.
+| release_notes = http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/CHANGE_LOG.html

← Older revision		Revision as of 21:38, 4 March 2014
Line 1:		Line 1:
−	= OWASP Java HTML Sanitizer Change Log =	+	= OWASP Java HTML Sanitizer Change Log v209 =

	* 209 Reworked CssSchema to allow users to extend the default property white-list.		* 209 Reworked CssSchema to allow users to extend the default property white-list.