[SLING-11425] Make URI filtering test more lenient in case of invalid XML input

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: XSS Protection API 2.3.0
• Component/s: XSS Protection API
• Assignee: Robert Munteanu
• Reporter: Robert Munteanu
• Created: 29/Jun/22 08:47
• Updated: 04/Oct/22 12:06
• Resolved: 30/Jun/22 09:43

Description

The AntiSamiPolicyTest validates URI filtering in a scenario where it passes invalid XML, where content is included after the closing slash, i.e.

<div/style=&#92&#45&#92&#...>

in https://github.com/apache/sling-org-apache-sling-xss/blob/bafa22b0c3dfd457bfc8187d17dd8ffd14ab2158/src/test/java/org/apache/sling/xss/impl/AntiSamyPolicyTest.java#L216 .

The test is strict and asserts that no style tag is present, since the XML parser used by AntiSamy does not recognize the tag. This is not in line with how the style tag is treated currently, as invalid values are removed, but the style tag is preserved.

We should make the test more lenient and accept an empty style tag. This would make it also compatible with the Java HTML Cleaner based implementation worked on in SLING-7231.

Issue Links

• relates to: SLING-7231 Move to owasp sanitizer library