[ROL-1727] XSS filtering for comments and blog posts

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.0
• Component/s: Authentication, Roles and Access Controls, Comments, Installation & Configuration, User Interface - General, User Interface - Weblog Editor, User Management
• Assignee: David M. Johnson
• Reporter: Nick Lothian
• Created: 16/Jun/08 01:44
• Updated: 08/Jan/14 05:02
• Resolved: 16/Jan/13 13:45

Description

This set of classes will filter potential XSS attacks from comments and blog posts. Without it, users could potentially use a XSS attack to take over an admin account (for example).

This uses AntiSammy (http://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project) to remove potential attack vectors. The attached antisammy jar has been modified to support config loading from the classpath, instead of from the file system.

To build, copy the classes to the appropriate locations in your source tree and the antisammy jar to the WEB-INF\lib directory.

To use, add
<filter>
<filter-name>JavaScriptStrippingFilter</filter-name>
<filter-class>org.apache.roller.myedna.filters.JavaScriptStrippingFilter</filter-class>
</filter>

and

<filter-mapping>
<filter-name>JavaScriptStrippingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

to your web.xml