From 83c8cde1b842df7911177612c70a204fcd7548ad Mon Sep 17 00:00:00 2001
From: rcyarrapothu <91085674+rcyarrapothu@users.noreply.github.com>
Date: Fri, 25 Feb 2022 09:36:06 -0600
Subject: [PATCH] ZBUG-1932: Upgrading owasp-java-html-sanitizer version
(#1227)
---
store/build.xml | 4 +--
store/ivy.xml | 8 ++---
.../cs/html/owasp/OwaspHtmlSanitizerTest.java | 29 ++++++++++++++++++-
3 files changed, 33 insertions(+), 8 deletions(-)
diff --git a/store/build.xml b/store/build.xml
index de449dacc60..97cc8ddd8db 100644
--- a/store/build.xml
+++ b/store/build.xml
@@ -288,8 +288,8 @@
-
-
+
+
diff --git a/store/ivy.xml b/store/ivy.xml
index e50ed0c8722..58ee6af8054 100644
--- a/store/ivy.xml
+++ b/store/ivy.xml
@@ -44,9 +44,7 @@
-
-
+
@@ -123,7 +121,7 @@
-
-
+
+
diff --git a/store/src/java-test/com/zimbra/cs/html/owasp/OwaspHtmlSanitizerTest.java b/store/src/java-test/com/zimbra/cs/html/owasp/OwaspHtmlSanitizerTest.java
index 13d079abcfc..77af704581b 100644
--- a/store/src/java-test/com/zimbra/cs/html/owasp/OwaspHtmlSanitizerTest.java
+++ b/store/src/java-test/com/zimbra/cs/html/owasp/OwaspHtmlSanitizerTest.java
@@ -42,6 +42,7 @@
import com.zimbra.cs.mime.ParsedMessage;
import com.zimbra.cs.servlet.ZThreadLocal;
import com.zimbra.cs.util.ZTestWatchman;
+import org.owasp.html.Encoding;
public class OwaspHtmlSanitizerTest {
@@ -734,5 +735,31 @@ public void testBugZCS10594() throws Exception {
String output = "First Line
Second Line
";
Assert.assertTrue("Verification failed: Failed to include media queries.", output.equals(result.trim()));
}
-
+
+ @Test
+ public void testBug1932ShouldReturnSameUrlAfterSanitizing_1() throws Exception {
+ String url = "https://google.com/?page=red.blue&num_ar=abcd123456&orgAcronyme=abc12";
+ String html = ""+url+"";
+ String result = new OwaspHtmlSanitizer(html, true, null).sanitize();
+ //&num should not be converted to #
+ Assert.assertTrue(Encoding.decodeHtml(result).contains(url));
+ }
+
+ @Test
+ public void testBug1932ShouldReturnSameUrlAfterSanitizing_2() throws Exception {
+ String url = "https://google.com/?page=red.blue&numero_num=10&Integral_int=20";
+ String html = ""+url+"";
+ String result = new OwaspHtmlSanitizer(html, true, null).sanitize();
+ //&numero and &Integral should not be converted to № and ∫
+ Assert.assertTrue(Encoding.decodeHtml(result).contains(url));
+ }
+
+ @Test
+ public void testBug1932ShouldReturnSameUrlAfterSanitizing_3() throws Exception {
+ String url = "https://google.com/?account=2&order_id=125";
+ String html = ""+url+"";
+ String result = new OwaspHtmlSanitizer(html, true, null).sanitize();
+ //&order should not be converted to ℴ
+ Assert.assertTrue(Encoding.decodeHtml(result).contains(url));
+ }
}