From 9f500e0e35ae0fdd1e2f71db83577f2893613525 Mon Sep 17 00:00:00 2001
From: rcyarrapothu <91085674+rcyarrapothu@users.noreply.github.com>
Date: Fri, 25 Feb 2022 09:36:06 -0600
Subject: [PATCH] ZBUG-1932: Upgrading owasp-java-html-sanitizer version
(#1227)
---
store/build.xml | 4 +--
store/ivy.xml | 4 ++-
.../cs/html/owasp/OwaspHtmlSanitizerTest.java | 28 +++++++++++++++++++
3 files changed, 33 insertions(+), 3 deletions(-)
diff --git a/store/build.xml b/store/build.xml
index cf0044c2bad..f9a10532ab6 100644
--- a/store/build.xml
+++ b/store/build.xml
@@ -289,8 +289,8 @@
-
-
+
+
diff --git a/store/ivy.xml b/store/ivy.xml
index 99edc9d918f..4faa011fe43 100644
--- a/store/ivy.xml
+++ b/store/ivy.xml
@@ -44,7 +44,7 @@
-
+
@@ -138,5 +138,7 @@
+
+
diff --git a/store/src/java-test/com/zimbra/cs/html/owasp/OwaspHtmlSanitizerTest.java b/store/src/java-test/com/zimbra/cs/html/owasp/OwaspHtmlSanitizerTest.java
index 12f0db7e7ef..dc91187fbff 100644
--- a/store/src/java-test/com/zimbra/cs/html/owasp/OwaspHtmlSanitizerTest.java
+++ b/store/src/java-test/com/zimbra/cs/html/owasp/OwaspHtmlSanitizerTest.java
@@ -42,6 +42,7 @@
import com.zimbra.cs.mime.ParsedMessage;
import com.zimbra.cs.servlet.ZThreadLocal;
import com.zimbra.cs.util.ZTestWatchman;
+import org.owasp.html.Encoding;
public class OwaspHtmlSanitizerTest {
@@ -731,4 +732,31 @@ public void testBugZCS10594() throws Exception {
String output = "First Line
Second Line
";
Assert.assertTrue("Verification failed: Failed to include media queries.", output.equals(result.trim()));
}
+
+ @Test
+ public void testBug1932ShouldReturnSameUrlAfterSanitizing_1() throws Exception {
+ String url = "https://google.com/?page=red.blue&num_ar=abcd123456&orgAcronyme=abc12";
+ String html = ""+url+"";
+ String result = new OwaspHtmlSanitizer(html, true, null).sanitize();
+ //&num should not be converted to #
+ Assert.assertTrue(Encoding.decodeHtml(result).contains(url));
+ }
+
+ @Test
+ public void testBug1932ShouldReturnSameUrlAfterSanitizing_2() throws Exception {
+ String url = "https://google.com/?page=red.blue&numero_num=10&Integral_int=20";
+ String html = ""+url+"";
+ String result = new OwaspHtmlSanitizer(html, true, null).sanitize();
+ //&numero and &Integral should not be converted to № and ∫
+ Assert.assertTrue(Encoding.decodeHtml(result).contains(url));
+ }
+
+ @Test
+ public void testBug1932ShouldReturnSameUrlAfterSanitizing_3() throws Exception {
+ String url = "https://google.com/?account=2&order_id=125";
+ String html = ""+url+"";
+ String result = new OwaspHtmlSanitizer(html, true, null).sanitize();
+ //&order should not be converted to ℴ
+ Assert.assertTrue(Encoding.decodeHtml(result).contains(url));
+ }
}