Sanitizer is stripping the href if the URL is tailed with white space when the url protocol is ftp

74 views
Skip to first unread message

Rasmita Mahapatra

unread,
Feb 7, 2018, 5:29:13 AM2/7/18
to OWASP Java HTML Sanitizer Support
<a href =" ftp://test.com"> FTP link</a> (space befor the URL)
Result:  FTP link 

If Input is 
<a href =  \"ftp://test.com\"> FTP link1</a> (space after href= )
Result:FTP link1

The issue is not see when the link has http

                Input : <a href=" http://link.com" >link1</a>
                Result : <a href="http://link.com">link1</a>

                Input:<a href=  "http://link.com" >link11</a>
                Result:<a href="http://link.com">link11</a>
          


Mike Samuel

unread,
Feb 7, 2018, 9:05:13 AM2/7/18
to OWASP Java HTML Sanitizer Support
On Wed, Feb 7, 2018 at 5:29 AM, Rasmita Mahapatra <rasm...@gmail.com> wrote:
<a href =" ftp://test.com"> FTP link</a> (space befor the URL)
Result:  FTP link 

If Input is 
<a href =  \"ftp://test.com\"> FTP link1</a> (space after href= )
Result:FTP link1

The issue is not see when the link has http

                Input : <a href=" http://link.com" >link1</a>
                Result : <a href="http://link.com">link1</a>

                Input:<a href=  "http://link.com" >link11</a>
                Result:<a href="http://link.com">link11</a>
          


--
You received this message because you are subscribed to the Google Groups "OWASP Java HTML Sanitizer Support" group.
To unsubscribe from this group and stop receiving emails from it, send an email to owasp-java-html-sanitizer-support+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Rasmita Mahapatra

unread,
Feb 16, 2018, 3:03:46 AM2/16/18
to OWASP Java HTML Sanitizer Support


On Wednesday, February 7, 2018 at 7:35:13 PM UTC+5:30, Mike Samuel wrote:


On Wed, Feb 7, 2018 at 5:29 AM, Rasmita Mahapatra <rasm...@gmail.com> wrote:
<a href =" ftp://test.com"> FTP link</a> (space befor the URL)
Result:  FTP link 

If Input is 
<a href =  \"ftp://test.com\"> FTP link1</a> (space after href= )
Result:FTP link1

The issue is not see when the link has http

Does your policy allow ftp: URLs?
No, its not supported. 

Mike Samuel

unread,
Feb 16, 2018, 7:03:34 AM2/16/18
to OWASP Java HTML Sanitizer Support


On Feb 16, 2018 3:03 AM, "Rasmita Mahapatra" <rasm...@gmail.com> wrote:


On Wednesday, February 7, 2018 at 7:35:13 PM UTC+5:30, Mike Samuel wrote:


On Wed, Feb 7, 2018 at 5:29 AM, Rasmita Mahapatra <rasm...@gmail.com> wrote:
<a href =" ftp://test.com"> FTP link</a> (space befor the URL)
Result:  FTP link 

If Input is 
<a href =  \"ftp://test.com\"> FTP link1</a> (space after href= )
Result:FTP link1

The issue is not see when the link has http

Does your policy allow ftp: URLs?
No, its not supported. 

That's probably why ftp URLs are being stripped.

Rasmita Mahapatra

unread,
Feb 19, 2018, 1:32:14 AM2/19/18
to OWASP Java HTML Sanitizer Support


On Friday, February 16, 2018 at 5:33:34 PM UTC+5:30, Mike Samuel wrote:


On Feb 16, 2018 3:03 AM, "Rasmita Mahapatra" <rasm...@gmail.com> wrote:


On Wednesday, February 7, 2018 at 7:35:13 PM UTC+5:30, Mike Samuel wrote:


On Wed, Feb 7, 2018 at 5:29 AM, Rasmita Mahapatra <rasm...@gmail.com> wrote:
<a href =" ftp://test.com"> FTP link</a> (space befor the URL)
Result:  FTP link 

If Input is 
<a href =  \"ftp://test.com\"> FTP link1</a> (space after href= )
Result:FTP link1

The issue is not see when the link has http

Does your policy allow ftp: URLs?
No, its not supported. 

That's probably why ftp URLs are being stripped.
Thanks 
Reply all
Reply to author
Forward
0 new messages