/*
|
* Copyright 2014 gitblit.com.
|
*
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
* you may not use this file except in compliance with the License.
|
* You may obtain a copy of the License at
|
*
|
* http://www.apache.org/licenses/LICENSE-2.0
|
*
|
* Unless required by applicable law or agreed to in writing, software
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
* See the License for the specific language governing permissions and
|
* limitations under the License.
|
*/
|
package com.gitblit.utils;
|
|
import org.jsoup.Jsoup;
|
import org.jsoup.nodes.Document;
|
import org.jsoup.safety.Cleaner;
|
import org.jsoup.safety.Whitelist;
|
|
/**
|
* Implementation of an XSS filter based on JSoup.
|
*
|
* @author James Moger
|
*
|
*/
|
public class JSoupXssFilter implements XssFilter {
|
|
private final Cleaner none;
|
|
private final Cleaner relaxed;
|
|
public JSoupXssFilter() {
|
none = new Cleaner(Whitelist.none());
|
relaxed = new Cleaner(getRelaxedWhiteList());
|
}
|
|
@Override
|
public String none(String input) {
|
return clean(input, none);
|
}
|
|
@Override
|
public String relaxed(String input) {
|
return clean(input, relaxed);
|
}
|
|
protected String clean(String input, Cleaner cleaner) {
|
Document unsafe = Jsoup.parse(input);
|
Document safe = cleaner.clean(unsafe);
|
return safe.body().html();
|
}
|
|
/**
|
* Builds & returns a loose HTML whitelist similar to Github.
|
*
|
* https://github.com/github/markup/tree/master#html-sanitization
|
* @return a loose HTML whitelist
|
*/
|
protected Whitelist getRelaxedWhiteList() {
|
return new Whitelist()
|
.addTags(
|
"a", "b", "blockquote", "br", "caption", "cite", "code", "col",
|
"colgroup", "dd", "del", "div", "dl", "dt", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr",
|
"i", "img", "ins", "kbd", "li", "ol", "p", "pre", "q", "samp", "small", "strike", "strong",
|
"sub", "sup", "table", "tbody", "td", "tfoot", "th", "thead", "tr", "tt", "u",
|
"ul", "var")
|
|
.addAttributes("a", "class", "href", "style", "target", "title")
|
.addAttributes("blockquote", "cite")
|
.addAttributes("col", "span", "width")
|
.addAttributes("colgroup", "span", "width")
|
.addAttributes("div", "class", "style")
|
.addAttributes("img", "align", "alt", "height", "src", "title", "width")
|
.addAttributes("ol", "start", "type")
|
.addAttributes("q", "cite")
|
.addAttributes("span", "class", "style")
|
.addAttributes("table", "class", "style", "summary", "width")
|
.addAttributes("td", "abbr", "axis", "class", "colspan", "rowspan", "style", "width")
|
.addAttributes("th", "abbr", "axis", "class", "colspan", "rowspan", "scope", "style", "width")
|
.addAttributes("ul", "type")
|
|
.addEnforcedAttribute("a", "rel", "nofollow")
|
;
|
}
|
|
}
|
