Binary encoded images?

[gsilver0]

I'm working on a web application which includes an editor which binary encodes images. I'd like to put the generated HTML through the OWASP HTML sanitizer, and disallow img tags to specify a URL, while retaining the ability to make a href tags to link to other pages.

I have the policy mostly in place, but I can't figure out what options to use (or even if it's supported) for binary encoded images, and also to block images specified by URL.

Any ideas?

[Mike Samuel]

What do you mean by "binary encoded images"?  Like <img src="data:image/png;...">?

--
You received this message because you are subscribed to the Google Groups "OWASP Java HTML Sanitizer Support" group.
To unsubscribe from this group and stop receiving emails from it, send an email to owasp-java-html-saniti...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[gsilver0]

Yeah. That's what I meant. 

Are there any options to support this?

[Mike Samuel]

allowUrlProtocols (
http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20160526.1/org/owasp/html/HtmlPolicyBuilder.html#allowUrlProtocols
) should let you whitelist the "data" protocol.

You can then allow an attribute with an extra check thus

.allowAttributes("src")
.matching(...)
.onElements("img")

There are a number of things you can do in the matching part like allowing

data:image/...

instead of just allowing data:...

Since allowUrlProtocols("data") allows data URLs anywhere data URLs
are allowed, you might want to also add a matcher to any other URL
attributes you whitelist like

.allowAttributes("href")
.matching(...)
.onElements("a")

that reject anything with a colon that does not start with http: or
https: or mailto:.

[Jim Manico]

This is good stuff, would you like these examples put up on the wiki, Mike?

Aloha, Jim

--
Jim Manico
Manicode Security
https://www.manicode.com

[Mike Samuel]

Sure.  I wouldn't use the term "binary encoded" though.  Some quick searching seems to show that "inline" and "embedded" are used roughly equally to refer to data:image/... in CSS and HTML.

[Jim Manico]

Added here

https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project#tab=Inline_2FEmbedded_Images

Happy to move this (and other examples) to the GitHub wiki as well.

- Jim