Iam using owasp html sanitizer. I have a specific use case where apart from sanitizing the href attribute of element 'a', I want to allow a specific javascript method call in the href, as its a whitelisted javascript method I solved this issue with below code snippet
.allowUrlProtocols("data")
.allowAttributes("src").onElements("img")
.allowAttributes("href").matching(
new AttributePolicy() {
public String apply(String elementName, String attributeName, String value) {
System.out.println("here"+value);
try
{
if(value.startsWith("onItemOpen")||value.matches(http)||value.matches(https)|| value.matches(email)){
return value;
}
System.out.println();
} catch(Exception e){
}
return null;
}
})
.onElements("a").allowUrlProtocols("http",
"https","javascript","mailto").allowCommonBlockElements()
.allowElements(
"a", "img"
).toFactory();
I have specific regex to handle the pattern
sample input : <a href="onItemOpen('document','Test');">hello</a>;
which is working fine,
but I also have a use case where I want to use ':' colon in the href value. its basically the whitelisted javascript method's parameter should have a ':' in it like
<a href="onItemOpen('document','0DODD:2SZJSG-E9BF70222EC54BACB285A69DA2F7E004');">hello</a>;
so in above case the control is not coming to the attribute policy handler and the href attribute is being removed.
can someone direct on a workaround for this.