How to report if input is sanitized with OWASP Java HTML Sanitizer

Question

I see in the API that it's possible but I can't figure out how to use that sanitize() method. There's even a forum post where someone says to use it but they don't explain how. In essence I have no idea what CTX means in that method signature. If someone can provide sample code of how to get a list of items that were sanitized that would be appreciated.

You said "I have no idea what CTX means in that method signature.", now you say "I understand that". Which is it? — Kayaman
– Kayaman, Commented Nov 17, 2017 at 6:49
The question is how do you use the method? There's no sample code to look at... — Stephane Grenier
– Stephane Grenier, Commented Nov 17, 2017 at 6:50
What about that sample code right in the beginning of your first link? The one titled Usage? — Kayaman
– Kayaman, Commented Nov 17, 2017 at 6:56

Kayaman · Accepted Answer · 2017-11-17 07:13:27Z

3

You need to setup the HtmlChangeListener to catch all elements that are sanitized. The code then looks something like:

List<String> results = new ArrayList<String>();

HtmlChangeListener<List<String>> htmlChangeListener = new HtmlChangeListener<>()
{
    @Override
    public void discardedTag(List<String> context, String elementName)
    {
        context.add(elementName);
    }

    @Override
    public void discardedAttributes(List<String> context, String tagName, String... attributeNames)
    {
        context.add(tagName);
    }
};

String sanitizedHtml = POLICY_DEFINITION.sanitize(rawHtml, htmlChangeListener, results);
System.out.println("Sanitized elements include: " + String.join(",", results));

edited Nov 17, 2017 at 7:13

Kayaman

73.8k6 gold badges91 silver badges128 bronze badges

answered Nov 17, 2017 at 7:08

Stephane Grenier

16k42 gold badges123 silver badges208 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

codebusta Over a year ago

It should be StringUtils.join()

firstpostcommenter Oct 12 at 18:16

So this can be the indirect way to validate input right? Because the library doesn’t provide it github.com/OWASP/java-html-sanitizer/blob/main/docs/…

Collectives™ on Stack Overflow

How to report if input is sanitized with OWASP Java HTML Sanitizer

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related