[OFBIZ-10187] OWASP sanitizer breaks proper rendering of HTML code

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 16.11.04, Release Branch 18.12, Release Branch 17.12, Trunk
• Fix Version/s: 16.11.06, 18.12.01, 17.12.01
• Component/s: ALL COMPONENTS
• Labels: backport-needed
• Assignee: Michael Brohl
• Reporter: Michael Brohl
• Created: 30/Jan/18 11:10
• Updated: 31/Oct/19 06:34
• Resolved: 09/May/19 06:13

Description

The current implementation of the sanitizer breaks the proper rendering of html code. In our case, class attributes are stripped from the html content.

Example:

            <div class="item">
                 <img src="<@ofbizContentUrl>/webcontent/img/slider/1.jpg</@ofbizContentUrl>" alt="" />
                 <div class="container">
                     <div class="slider-overlay">
                         <h2>Lorem ipsum dolor sit amet</h2>
                         <h3>At vero eos et accusam et justo</h3>
                         <p>
                             Lorem ipsum dolor sit amet, consetetur sadipscing elitr, dolores et ea rebum. Stet clita kasd gubergren, no sea
                             takimata sanctus est Lorem ipsum dolor sit amet.
                         </p>
                         <a class="btn btn-grey" href="<@ofbizUrl>cms/~webpage_id=100</@ofbizUrl>">weitere Informationen</a>
                     </div>
                 </div>
             </div>

will be rendered to

            <div>
                 <img src="<@ofbizContentUrl>/webcontent/img/slider/1.jpg</@ofbizContentUrl>" alt="" />
                 <div>
                     <div>
                         <h2>Lorem ipsum dolor sit amet</h2>
                         <h3>At vero eos et accusam et justo</h3>
                         <p>
                             Lorem ipsum dolor sit amet, consetetur sadipscing elitr, dolores et ea rebum. Stet clita kasd gubergren, no sea
                             takimata sanctus est Lorem ipsum dolor sit amet.
                         </p>
                         <a href="<@ofbizUrl>cms/~webpage_id=100</@ofbizUrl>">weitere Informationen</a>
                     </div>
                 </div>
             </div>

I do not see any reason to not allow class attributes in html code. There might be other problems with these rules but this is a showstopper.

Issue Links

• is related to: OFBIZ-5254 Services allow arbitrary HTML for parameters with allow-html set to "safe"
• is related to: OFBIZ-11265 Getting policy error while editing html text data using cms