How to allow url protocol for a specific tag alone.

[Praveen kumar]

I have a case where I need to allow "cid" protocol only to img tags and not the other.

[Mike Samuel]

Does the url classifier attribute predicate in PR 126 do what you need?

/**
	* Filters out values which are not valid URLs that match the given
	* classifier.
	*
	* <p>When this is provided, the
	* {@linkplain HtmlPolicyBuilder#allowUrlProtocols allowed URL protocols}
	* and {@linkplain HtmlPolicyBuilder#disallowUrlProtocols
	* disallowed URL protocols}
	* are <b>not</b> applied in preference of the
	* {@linkplain org.owasp.url.UrlClassifierBuilder#scheme scheme whitelist}
	* implicit in the classifier.
	*/
	public AttributeBuilder matching(UrlClassifier classifier) {
	return matching(new UrlClassifierAttributePolicy(classifier));
	}

 

On Tue, Mar 6, 2018 at 4:11 AM, Praveen kumar <prave...@gmail.com> wrote:

I have a case where I need to allow "cid" protocol only to img tags and not the other.

--
You received this message because you are subscribed to the Google Groups "OWASP Java HTML Sanitizer Support" group.
To unsubscribe from this group and stop receiving emails from it, send an email to owasp-java-html-sanitizer-support+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.