Skip to content

Commit

Permalink
fix(gh-546): keep colour percentages in sanitized css instead of conv…
Browse files Browse the repository at this point in the history 
…erting them to int
  • Loading branch information
@jonah1und1
jonah1und1 committed Jan 24, 2025
1 parent 90581de commit 6b73677
Show file tree
Hide file tree
Showing 3 changed files with 41 additions and 9 deletions.
13 changes: 7 additions & 6 deletions src/main/java/org/owasp/validator/css/CssValidator.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
*/
package org.owasp.validator.css;

import java.text.DecimalFormat;
import java.util.Iterator;
import java.util.regex.Pattern;
import org.owasp.validator.html.Policy;
Expand Down Expand Up @@ -344,15 +345,15 @@ public String lexicalValueToString(LexicalUnit lu) {
// this is a rgb encoded color
StringBuffer sb = new StringBuffer("rgb(");
LexicalUnit param = lu.getParameters();
sb.append(getColorIntValue(param)); // R value
sb.append(getColorValue(param)); // R value
sb.append(',');
param = param.getNextLexicalUnit(); // comma
param = param.getNextLexicalUnit(); // G value
sb.append(getColorIntValue(param));
sb.append(getColorValue(param));
sb.append(',');
param = param.getNextLexicalUnit(); // comma
param = param.getNextLexicalUnit(); // B value
sb.append(getColorIntValue(param));
sb.append(getColorValue(param));
sb.append(')');

return sb.toString();
Expand Down Expand Up @@ -413,11 +414,11 @@ public String lexicalValueToString(LexicalUnit lu) {
* @param param LexicalUnit
* @return color value as int
*/
private int getColorIntValue(LexicalUnit param) {
private static String getColorValue(LexicalUnit param) {
if (param.getLexicalUnitType() == LexicalUnit.SAC_PERCENTAGE) {
return Math.min(0xff, Math.max(0, (int) (0xff * (param.getFloatValue() / 100.0))));
return new DecimalFormat("0.#").format(param.getFloatValue()) + "%";
} else {
return param.getIntegerValue();
return "" + param.getIntegerValue();
}
}
}
18 changes: 18 additions & 0 deletions src/main/resources/antisamy.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,10 @@
<regexp name="rgbCode"
value="rgb\(([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]),([1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\)" />

<!-- Relative color values between 0%-100% are also allowed -->
<regexp name="rgbPercentage"
value="rgb\(([0-9][0-9]?|100)\.?\d*%,([0-9][0-9]?|100)\.?\d*%,([0-9][0-9]?|100)\.?\d*%\)" />

<!-- CSS2 Allowed System Color Values -->
<regexp name="systemColor"
value="(activeborder|activecaption|appworkspace|background|buttonface|buttonhighlight|buttonshadow|buttontext|captiontext|graytext|highlight|highlighttext|inactiveborder|inactivecaption|inactivecaptiontext|infobackground|infotext|menu|menutext|scrollbar|threeddarkshadow|threedface|threedhighlight|threedlightshadow|threedshadow|window|windowframe|windowtext)" />
Expand Down Expand Up @@ -1141,6 +1145,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
</property>
Expand Down Expand Up @@ -1207,6 +1212,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
</property>
Expand All @@ -1221,6 +1227,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
</property>
Expand All @@ -1235,6 +1242,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
</property>
Expand All @@ -1249,6 +1257,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
</property>
Expand All @@ -1263,6 +1272,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
</property>
Expand Down Expand Up @@ -1314,6 +1324,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
</property>
Expand Down Expand Up @@ -1693,6 +1704,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
</property>
Expand Down Expand Up @@ -2348,6 +2360,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
<shorthand-list>
Expand All @@ -2366,6 +2379,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
<shorthand-list>
Expand All @@ -2384,6 +2398,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
<shorthand-list>
Expand All @@ -2402,6 +2417,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
<shorthand-list>
Expand All @@ -2420,6 +2436,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
</regexp-list>
<shorthand-list>
Expand Down Expand Up @@ -2587,6 +2604,7 @@
<regexp name="colorName" />
<regexp name="colorCode" />
<regexp name="rgbCode" />
<regexp name="rgbPercentage" />
<regexp name="systemColor" />
<regexp name="length" />
</regexp-list>
Expand Down
19 changes: 16 additions & 3 deletions src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2728,6 +2728,21 @@ public void testGithubIssue484() throws ScanException, PolicyException {

@Test
public void testGithubIssue546() throws ScanException, PolicyException {
//Given
String taintedHtml = "<style>.cl { color: rgb(50%, 20.5%, 100%); }</style>";

//When
CleanResults crDom = as.scan(taintedHtml, policy, AntiSamy.DOM);
CleanResults crSax = as.scan(taintedHtml, policy, AntiSamy.SAX);

//Then
String expectedCleanHtml = "<style>*.cl {\n\tcolor: rgb(50%,20.5%,100%);\n}\n</style>";
assertEquals(expectedCleanHtml, crDom.getCleanHTML());
assertEquals(expectedCleanHtml, crSax.getCleanHTML());
}

@Test
public void testGithubIssue546FaultyPercentagesGetFilteredByRegex() throws ScanException, PolicyException {
//Given
String taintedHtml = "<style>.cl { color: rgb(50%, -20%, 150%); }</style>";

Expand All @@ -2736,9 +2751,7 @@ public void testGithubIssue546() throws ScanException, PolicyException {
CleanResults crSax = as.scan(taintedHtml, policy, AntiSamy.SAX);

//Then
String expectedCleanHtml = "<style>*.cl {\n\tcolor: rgb(127,0,255);\n}\n</style>";
assertEquals(0, crDom.getNumberOfErrors());
assertEquals(0, crSax.getNumberOfErrors());
String expectedCleanHtml = "<style>*.cl {\n}\n</style>";
assertEquals(expectedCleanHtml, crDom.getCleanHTML());
assertEquals(expectedCleanHtml, crSax.getCleanHTML());
}
Expand Down

0 comments on commit 6b73677

Please sign in to comment.