OWASP HTML Sanitizer allow colon in attribute href

Viewed 20

Iam using owasp html sanitizer. I have a specific use case where apart from sanitizing the href attribute of element 'a', I want to allow a specific javascript method call in the href, as its a whitelisted javascript method I solved this issue with below code snippet

               .allowUrlProtocols("data")
               .allowAttributes("src").onElements("img")
               .allowAttributes("href").matching(
                       new AttributePolicy() {
                           public String apply(String elementName, String attributeName, String value)  {
                               
                               System.out.println("here"+value);

                               try
                               {
                                   if(value.startsWith("onItemOpen")||value.matches(http)||value.matches(https)|| value.matches(email)){
                                       return  value;
                                   }
                                   System.out.println();
                               } catch(Exception e){

                               }

                               return null;
                           }
                       })
               .onElements("a").allowUrlProtocols("http",
                       "https","javascript","mailto").allowCommonBlockElements()
               .allowElements(
                       "a", "img"
               ).toFactory();

I have specific regex to handle the pattern sample input : <a href="onItemOpen('document','Test');">hello</a>;

which is working fine,

but I also have a use case where I want to use ':' colon in the href value. its basically the whitelisted javascript method's parameter should have a ':' in it like

<a href="onItemOpen('document','0DODD:2SZJSG-E9BF70222EC54BACB285A69DA2F7E004');">hello</a>;

so in above case the control is not coming to the attribute policy handler and the href attribute is being removed.

can someone direct on a workaround for this.

0 Answers
Related