File D:\maven-qcr-plugin-testsunitaires\qcr4java\jenkins-master\target\site\qc\core\src\main\java\hudson\markup\EbayPolicy.java.html

1 // Copyright (c) 2011, Mike Samuel
2 // All rights reserved.
3 //
4 // Redistribution and use in source and binary forms, with or without
5 // modification, are permitted provided that the following conditions
6 // are met:
7 //
8 // Redistributions of source code must retain the above copyright
9 // notice, this list of conditions and the following disclaimer.
10 // Redistributions in binary form must reproduce the above copyright
11 // notice, this list of conditions and the following disclaimer in the
12 // documentation and/or other materials provided with the distribution.
13 // Neither the name of the OWASP nor the names of its contributors may
14 // be used to endorse or promote products derived from this software
15 // without specific prior written permission.
16 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
17 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
18 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
19 // FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
20 // COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
21 // INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
22 // BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23 // LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
24 // CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 // LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
26 // ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 // POSSIBILITY OF SUCH DAMAGE.
28 package hudson.markup;
29
30 import com.google.common.base.Charsets;
31 import com.google.common.base.Function;
32 import com.google.common.base.Predicate;
33 import com.google.common.base.Throwables;
34 import com.google.common.io.CharStreams;
35 import org.owasp.html.Handler;
36 import org.owasp.html.HtmlPolicyBuilder;
37 import org.owasp.html.HtmlSanitizer;
38 import org.owasp.html.HtmlSanitizer.Policy;
39 import org.owasp.html.HtmlStreamEventReceiver;
40 import org.owasp.html.HtmlStreamRenderer;
41 import org.owasp.html.PolicyFactory;
42
43 import java.io.IOException;
44 import java.io.InputStreamReader;
45 import java.util.regex.Pattern;
46
47 /**
48 * Based on the
49 * <a href="http://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project#Stage_2_-_Choosing_a_base_policy_file">AntiSamy EBay example</a>.
50 * <blockquote>
51 * eBay (http://www.ebay.com/) is the most popular online auction site in the
52 * universe, as far as I can tell. It is a public site so anyone is allowed to
53 * post listings with rich HTML content. It's not surprising that given the
54 * attractiveness of eBay as a target that it has been subject to a few complex
55 * XSS attacks. Listings are allowed to contain much more rich content than,
56 * say, Slashdot- so it's attack surface is considerably larger. The following
57 * tags appear to be accepted by eBay (they don't publish rules):
58 * {@code <a>},...
59 * </blockquote>
60 */
61 public class EbayPolicy {
62
63 // Some common regular expression definitions.
64
65 // The 16 colors defined by the HTML Spec (also used by the CSS Spec)
66 private static final Pattern COLOR_NAME = Pattern.compile(
67 "(?:aqua|black|blue|fuchsia|gray|grey|green|lime|maroon|navy|olive|purple"
68 + "|red|silver|teal|white|yellow)");
69
70 // HTML/CSS Spec allows 3 or 6 digit hex to specify color
71 private static final Pattern COLOR_CODE = Pattern.compile(
72 "(?:#(?:[0-9a-fA-F]{3}(?:[0-9a-fA-F]{3})?))");
73
74 private static final Pattern NUMBER_OR_PERCENT = Pattern.compile(
75 "[0-9]+%?");
76 private static final Pattern PARAGRAPH = Pattern.compile(
77 "(?:[\\p{L}\\p{N},'\\.\\s\\-_\\(\\)]|&[0-9]{2};)*");
78 private static final Pattern HTML_ID = Pattern.compile(
79 "[a-zA-Z0-9\\:\\-_\\.]+");
80 // force non-empty with a '+' at the end instead of '*'
81 private static final Pattern HTML_TITLE = Pattern.compile(
82 "[\\p{L}\\p{N}\\s\\-_',:\\[\\]!\\./\\\\\\(\\)&]*");
83 private static final Pattern HTML_CLASS = Pattern.compile(
84 "[a-zA-Z0-9\\s,\\-_]+");
85
86 private static final Pattern ONSITE_URL = Pattern.compile(
87 "(?:[\\p{L}\\p{N}\\\\\\.\\#@\\$%\\+&;\\-_~,\\?=/!]+|\\#(\\w)+)");
88 private static final Pattern OFFSITE_URL = Pattern.compile(
89 "\\s*(?:(?:ht|f)tps?://|mailto:)[\\p{L}\\p{N}]"
90 + "[\\p{L}\\p{N}\\p{Zs}\\.\\#@\\$%\\+&;:\\-_~,\\?=/!\\(\\)]*\\s*");
91
92 private static final Pattern NUMBER = Pattern.compile(
93 "[+-]?(?:(?:[0-9]+(?:\\.[0-9]*)?)|\\.[0-9]+)");
94
95 private static final Pattern NAME = Pattern.compile("[a-zA-Z0-9\\-_\\$]+");
96
97 private static final Pattern ALIGN = Pattern.compile(
98 "(?i)center|left|right|justify|char");
99
100 private static final Pattern VALIGN = Pattern.compile(
101 "(?i)baseline|bottom|middle|top");
102
103 private static final Predicate<String> COLOR_NAME_OR_COLOR_CODE
104 = new Predicate<String>() {
105 public boolean apply(String s) {
106 return COLOR_NAME.matcher(s).matches()
107 || COLOR_CODE.matcher(s).matches();
108 }
109 };
110
111 private static final Predicate<String> ONSITE_OR_OFFSITE_URL
112 = new Predicate<String>() {
113 public boolean apply(String s) {
114 return ONSITE_URL.matcher(s).matches()
115 || OFFSITE_URL.matcher(s).matches();
116 }
117 };
118
119 private static final Pattern HISTORY_BACK = Pattern.compile(
120 "(?:javascript:)?\\Qhistory.go(-1)\\E");
121
122 private static final Pattern ONE_CHAR = Pattern.compile(
123 ".?", Pattern.DOTALL);
124
125
126 public static final PolicyFactory POLICY_DEFINITION;
127
128 static {
129 POLICY_DEFINITION = new HtmlPolicyBuilder()
130 .allowAttributes("id").matching(HTML_ID).globally()
131 .allowAttributes("class").matching(HTML_CLASS).globally()
132 .allowAttributes("lang").matching(Pattern.compile("[a-zA-Z]{2,20}"))
133 .globally()
134 .allowAttributes("title").matching(HTML_TITLE).globally()
135 .allowStyling()
136 .allowAttributes("align").matching(ALIGN).onElements("p")
137 .allowAttributes("for").matching(HTML_ID).onElements("label")
138 .allowAttributes("color").matching(COLOR_NAME_OR_COLOR_CODE)
139 .onElements("font")
140 .allowAttributes("face")
141 .matching(Pattern.compile("[\\w;, \\-]+"))
142 .onElements("font")
143 .allowAttributes("size").matching(NUMBER).onElements("font")
144 .allowAttributes("href").matching(ONSITE_OR_OFFSITE_URL)
145 .onElements("a")
146 .allowStandardUrlProtocols()
147 .allowAttributes("nohref").onElements("a")
148 .allowAttributes("name").matching(NAME).onElements("a")
149 .allowAttributes(
150 "onfocus", "onblur", "onclick", "onmousedown", "onmouseup")
151 .matching(HISTORY_BACK).onElements("a")
152 .requireRelNofollowOnLinks()
153 .allowAttributes("src").matching(ONSITE_OR_OFFSITE_URL)
154 .onElements("img")
155 .allowAttributes("name").matching(NAME)
156 .onElements("img")
157 .allowAttributes("alt").matching(PARAGRAPH)
158 .onElements("img")
159 .allowAttributes("border", "hspace", "vspace").matching(NUMBER)
160 .onElements("img")
161 .allowAttributes("border", "cellpadding", "cellspacing")
162 .matching(NUMBER).onElements("table")
163 .allowAttributes("bgcolor").matching(COLOR_NAME_OR_COLOR_CODE)
164 .onElements("table")
165 .allowAttributes("background").matching(ONSITE_URL)
166 .onElements("table")
167 .allowAttributes("align").matching(ALIGN)
168 .onElements("table")
169 .allowAttributes("noresize").matching(Pattern.compile("(?i)noresize"))
170 .onElements("table")
171 .allowAttributes("background").matching(ONSITE_URL)
172 .onElements("td", "th", "tr")
173 .allowAttributes("bgcolor").matching(COLOR_NAME_OR_COLOR_CODE)
174 .onElements("td", "th")
175 .allowAttributes("abbr").matching(PARAGRAPH)
176 .onElements("td", "th")
177 .allowAttributes("axis", "headers").matching(NAME)
178 .onElements("td", "th")
179 .allowAttributes("scope")
180 .matching(Pattern.compile("(?i)(?:row|col)(?:group)?"))
181 .onElements("td", "th")
182 .allowAttributes("nowrap")
183 .onElements("td", "th")
184 .allowAttributes("height", "width").matching(NUMBER_OR_PERCENT)
185 .onElements("table", "td", "th", "tr", "img")
186 .allowAttributes("align").matching(ALIGN)
187 .onElements("thead", "tbody", "tfoot", "img",
188 "td", "th", "tr", "colgroup", "col")
189 .allowAttributes("valign").matching(VALIGN)
190 .onElements("thead", "tbody", "tfoot",
191 "td", "th", "tr", "colgroup", "col")
192 .allowAttributes("charoff").matching(NUMBER_OR_PERCENT)
193 .onElements("td", "th", "tr", "colgroup", "col",
194 "thead", "tbody", "tfoot")
195 .allowAttributes("char").matching(ONE_CHAR)
196 .onElements("td", "th", "tr", "colgroup", "col",
197 "thead", "tbody", "tfoot")
198 .allowAttributes("colspan", "rowspan").matching(NUMBER)
199 .onElements("td", "th")
200 .allowAttributes("span", "width").matching(NUMBER_OR_PERCENT)
201 .onElements("colgroup", "col")
202 .allowElements(
203 "label", "noscript", "h1", "h2", "h3", "h4", "h5", "h6",
204 "p", "i", "b", "u", "strong", "em", "small", "big", "pre", "code",
205 "cite", "samp", "sub", "sup", "strike", "center", "blockquote",
206 "hr", "br", "col", "font", "map", "span", "div", "img",
207 "ul", "ol", "li", "dd", "dt", "dl", "tbody", "thead", "tfoot",
208 "table", "td", "th", "tr", "colgroup", "fieldset", "legend")
209 .toFactory();
210 }
211
212 public static void main(String[] args) throws IOException {
213 if (args.length != 0) {
214 System.err.println("Reads from STDIN and writes to STDOUT");
215 System.exit(-1);
216 }
217 System.err.println("[Reading from STDIN]");
218 // Fetch the HTML to sanitize.
219 String html = CharStreams.toString(
220 new InputStreamReader(System.in, Charsets.UTF_8));
221 // Set up an output channel to receive the sanitized HTML.
222 HtmlStreamRenderer renderer = HtmlStreamRenderer.create(
223 System.out,
224 // Receives notifications on a failure to write to the output.
225 new Handler<IOException>() {
226 public void handle(IOException ex) {
227 Throwables.propagate(ex); // System.out suppresses IOExceptions
228 }
229 },
230 // Our HTML parser is very lenient, but this receives notifications on
231 // truly bizarre inputs.
232 new Handler<String>() {
233 public void handle(String x) {
234 throw new AssertionError(x);
235 }
236 }
237 );
238 // Use the policy defined above to sanitize the HTML.
239 HtmlSanitizer.sanitize(html, POLICY_DEFINITION.apply(renderer));
240 }
241 }