[OFBIZ-12258] Adding tel protocol in CustomPermissivePolicy is not working

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Trunk, 18.12.01
• Fix Version/s: 18.12.01
• Assignee: Michael Brohl
• Reporter: Wiebke Paetzold
• Created: 14/Jun/21 09:43
• Updated: 11/Jan/22 09:37
• Resolved: 22/Jun/21 10:06

Description

At the moment it is not possible to allow the tel protocol via the CustomPermissivePolicy. The problem is that already in Sanitizers.LINKS the href attribute is allowed for HTTP, HTTPS and MAILTO.

When checking the policies in org.owasp.html.JoinedAttributePolicy

  public @Nullable String apply(
      String elementName, String attributeName, @Nullable String value) {
    for (AttributePolicy p : policies) {
      if (value == null) { break; }
      value = p.apply(elementName, attributeName, value);
    }
    return value;
  }

It is obvious that each policy must be satisfied to allow an attribute with corresponding values. In the case of the tell protocol, there are now several policies, the Cusomized policy which allows the protocol (I added it there) and the Standard policy which does not. For this reason it is currently not possible to allow the tel protocol via the CustomPermissivePolicy.

 

Issue Links

• links to: GitHub Pull Request #303