sanitizer is adding empty comment block given double curly braces...

[Paulo Avelar]

Hi,

The sanitizer is adding empty comment block when it encounters {{}} in a text block:

for example:

given:

<p>{{DATE(2017-02-14T06:08:39Z)}}</p>

 it produces:

<p>{<!-- -->{DATE(2017-02-14T06:08:39Z)}}</p>

or

<p>{{}}</p>

will produce

<p>{<!-- -->{}}

So,  I don't think it should do that.  Is this a bug ?

Thank you,

Paulo

[Mike Samuel]

This is running as intended. Please see
https://github.com/OWASP/java-html-sanitizer/blob/master/docs/client-side-templates.md

[sampo.j...@wellmo.com]

Hi,

How can this functionality be disabled?  We need to sanitize HTML code which can contain Handlebars placeholders within the HTML body text (not inside tags) and the sanitizer is breaking those.

We allow customers to define HTML content containing Handlebars placeholders.  We control the Handlebars context and ensure that it's safe, thus in our case it's not a security issue that the placeholders are allowed in the body text.

- Sampo

[Jim Manico]

Mike will likely answer with more depth but this library is for HTML sanitization, not template sanitization. ☹️

--
You received this message because you are subscribed to the Google Groups "OWASP Java HTML Sanitizer Support" group.
To unsubscribe from this group and stop receiving emails from it, send an email to owasp-java-html-saniti...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Mike Samuel]

This discussion seems to be happening both here and on https://github.com/OWASP/java-html-sanitizer/issues/111

Unless someone feels strongly, let's continue discussion on the bug.

To unsubscribe from this group and stop receiving emails from it, send an email to owasp-java-html-sanitizer-support+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

You received this message because you are subscribed to the Google Groups "OWASP Java HTML Sanitizer Support" group.

To unsubscribe from this group and stop receiving emails from it, send an email to owasp-java-html-sanitizer-support+unsubscribe@googlegroups.com.