diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 5e11ad9..1fa315e 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -57,7 +57,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v1 + uses: github/codeql-action/init@v2 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -66,21 +66,16 @@ jobs: # queries: ./path/to/local/query, your-org/your-repo/queries@main # This prevents errors when automatically installing SDK. - # CodeQL does not install .NET 5.0 nor 6.0. - - name: Setup .NET 5.0 SDK+Runtime + # CodeQL does not install .NET 8.0. + - name: Setup .NET 8.0 SDK+Runtime uses: actions/setup-dotnet@v1.7.2 with: - dotnet-version: 5.0.404 - - - name: Setup .NET 6.0 SDK+Runtime - uses: actions/setup-dotnet@v1.7.2 - with: - dotnet-version: 6.0.101 + dotnet-version: 8.0.100 # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v1 + uses: github/codeql-action/autobuild@v2 # ℹ️ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -94,4 +89,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 + uses: github/codeql-action/analyze@v2 diff --git a/.github/workflows/netcore_and_netframework.yml b/.github/workflows/netcore_and_netframework.yml index e99363f..1721458 100644 --- a/.github/workflows/netcore_and_netframework.yml +++ b/.github/workflows/netcore_and_netframework.yml @@ -40,20 +40,10 @@ jobs: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - uses: actions/checkout@v2 - - name: Setup .NET Core SDK+Runtime + - name: Setup .NET 8.0 SDK+Runtime uses: actions/setup-dotnet@v1.7.2 with: - dotnet-version: 3.1.x - - - name: Setup .NET 5.0 SDK+Runtime - uses: actions/setup-dotnet@v1.7.2 - with: - dotnet-version: 5.0.404 - - - name: Setup .NET 6.0 SDK+Runtime - uses: actions/setup-dotnet@v1.7.2 - with: - dotnet-version: 6.0.101 + dotnet-version: 8.0.100 - name: Setup MSBuild for .NET Framework uses: microsoft/setup-msbuild@v1 diff --git a/LICENSE b/LICENSE index ded0ada..1daba2b 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ BSD 3-Clause License -Copyright (c) 2022, spassarop +Copyright (c) 2023, spassarop All rights reserved. Redistribution and use in source and binary forms, with or without diff --git a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-anythinggoes.xml b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-anythinggoes.xml index efa3a6e..67ffbdf 100644 --- a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-anythinggoes.xml +++ b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-anythinggoes.xml @@ -41,7 +41,7 @@ http://www.w3.org/TR/html401/struct/global.html - + diff --git a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-ebay.xml b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-ebay.xml index b5baa7b..6040f37 100644 --- a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-ebay.xml +++ b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-ebay.xml @@ -39,7 +39,7 @@ http://www.w3.org/TR/html401/struct/global.html - + diff --git a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-myspace.xml b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-myspace.xml index fb3ad50..59fd1f0 100644 --- a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-myspace.xml +++ b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-myspace.xml @@ -41,7 +41,7 @@ http://www.w3.org/TR/html401/struct/global.html - + diff --git a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy.xml b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy.xml index 76fbe4e..5b6b4c2 100644 --- a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy.xml +++ b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy.xml @@ -44,7 +44,7 @@ http://www.w3.org/TR/html401/struct/global.html - + diff --git a/OWASP.AntiSamy/Css/CssScanner.cs b/OWASP.AntiSamy/Css/CssScanner.cs index dd33395..8e598c5 100644 --- a/OWASP.AntiSamy/Css/CssScanner.cs +++ b/OWASP.AntiSamy/Css/CssScanner.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2022, Jerry Hoff, Caner Patir, Sebastin Passaro + * Copyright (c) 2023, Jerry Hoff, Caner Patir, Sebastián Passaro * * * All rights reserved. diff --git a/OWASP.AntiSamy/Exceptions/ParseException.cs b/OWASP.AntiSamy/Exceptions/ParseException.cs index 97b535e..8419067 100644 --- a/OWASP.AntiSamy/Exceptions/ParseException.cs +++ b/OWASP.AntiSamy/Exceptions/ParseException.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2022, Caner Patir, Sebastin Passaro + * Copyright (c) 2023, Caner Patir, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Exceptions/PolicyException.cs b/OWASP.AntiSamy/Exceptions/PolicyException.cs index 1835e85..3823412 100644 --- a/OWASP.AntiSamy/Exceptions/PolicyException.cs +++ b/OWASP.AntiSamy/Exceptions/PolicyException.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro + * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Exceptions/ScanException.cs b/OWASP.AntiSamy/Exceptions/ScanException.cs index 4cb3bdc..933a24c 100644 --- a/OWASP.AntiSamy/Exceptions/ScanException.cs +++ b/OWASP.AntiSamy/Exceptions/ScanException.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro + * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Exceptions/UnknownSelectorException.cs b/OWASP.AntiSamy/Exceptions/UnknownSelectorException.cs index ba96f31..c2e7152 100644 --- a/OWASP.AntiSamy/Exceptions/UnknownSelectorException.cs +++ b/OWASP.AntiSamy/Exceptions/UnknownSelectorException.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2009-2022, Sebastián Passaro + * Copyright (c) 2009-2023, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Html/AntiSamy.cs b/OWASP.AntiSamy/Html/AntiSamy.cs index a7b1f10..a1760b8 100644 --- a/OWASP.AntiSamy/Html/AntiSamy.cs +++ b/OWASP.AntiSamy/Html/AntiSamy.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro + * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Html/CleanResults.cs b/OWASP.AntiSamy/Html/CleanResults.cs index f169d85..0f05065 100644 --- a/OWASP.AntiSamy/Html/CleanResults.cs +++ b/OWASP.AntiSamy/Html/CleanResults.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro + * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro * * All rights reserved. * @@ -29,11 +29,31 @@ namespace OWASP.AntiSamy.Html { /// - /// This class contains the results of a scan. - /// - /// The list of error messages () will let the user know - /// what, if any HTML errors existed, and what, if any, security or - /// validation-related errors existed, and what was done about them. + /// This class contains the results of a scan. It primarily provides access to the clean sanitized + /// HTML, per the AntiSamy sanitization policy applied. It also provides access to some utility + /// information, like possible error messages and error message counts. + /// + /// WARNING: The ONLY output from the class you can completely rely on is the CleanResults output. + /// As stated in the documentation, neither the nor the methods + /// subtly answer the question "is this safe input?" in the affirmative if it returns an empty list. + /// You must always use the sanitized 'Clean' input and there is no way to be sure the input passed in had no attacks. + /// + /// + /// The serialization and deserialization process that is critical to the effectiveness of the + /// sanitizer is purposefully lossy and will filter out attacks via a number of attack vectors. + /// Unfortunately, one of the tradeoffs of this strategy is that AntiSamy doesn't always know in + /// retrospect that an attack was seen. Thus, the API is there to help users + /// understand whether their well-intentioned input meets the requirements of the system, not help a + /// developer detect if an attack was present. + /// + /// + /// The list of error messages () will let the user know what, if any + /// HTML errors existed, and what, if any, security or validation-related errors were detected, and + /// what was done about them. NOTE: As just stated, the absence of error messages does NOT mean there + /// were no attacks in the input that was sanitized out. You CANNOT rely on the to tell + /// you if the input was dangerous. You MUST use the output of to ensure your output + /// is safe. + /// /// public class CleanResults { @@ -74,11 +94,17 @@ public CleanResults(DateTime startOfScan, DateTime endOfScan, string cleanHTML, /// public void SetCleanHtml(string cleanHtml) => this.cleanHtml = cleanHtml; - /// Return the filtered HTML as a string. + /// + /// Return the filtered HTML as a string. This output is the ONLY output you can trust to be safe. + /// The absence of error messages does NOT indicate the input was safe. + /// /// A string object which contains the serialized, safe HTML. public string GetCleanHtml() => cleanHtml; - /// Return a list of error messages. + /// + /// Return a list of error messages -- but an empty list returned does not mean there was no attack + /// present, due to the serialization and deserialization process automatically cleaning up some attacks. + /// /// A object which contains the error messages after a scan. public List GetErrorMessages() => errorMessages; @@ -98,7 +124,10 @@ public CleanResults(DateTime startOfScan, DateTime endOfScan, string cleanHTML, /// An error message to append to the list of aggregate error messages during filtering. public void AddErrorMessage(string msg) => errorMessages.Add(msg); - /// Return the number of errors encountered during filtering. + /// + /// Return the number of errors encountered during filtering. Note that 0 errors does NOT + /// mean the input was safe. Only the output of can be considered safe. + /// public int GetNumberOfErrors() => errorMessages.Count; } } diff --git a/OWASP.AntiSamy/Html/InternalPolicy.cs b/OWASP.AntiSamy/Html/InternalPolicy.cs index 8bc56d9..3900bcf 100644 --- a/OWASP.AntiSamy/Html/InternalPolicy.cs +++ b/OWASP.AntiSamy/Html/InternalPolicy.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2022, Kristian Rosenvold, Sebastin Passaro + * Copyright (c) 2008-2023, Kristian Rosenvold, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Html/Model/AntiSamyPattern.cs b/OWASP.AntiSamy/Html/Model/AntiSamyPattern.cs index 811d213..4c0167d 100644 --- a/OWASP.AntiSamy/Html/Model/AntiSamyPattern.cs +++ b/OWASP.AntiSamy/Html/Model/AntiSamyPattern.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro + * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Html/Model/Attribute.cs b/OWASP.AntiSamy/Html/Model/Attribute.cs index d52d311..00b4455 100644 --- a/OWASP.AntiSamy/Html/Model/Attribute.cs +++ b/OWASP.AntiSamy/Html/Model/Attribute.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro + * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Html/Model/Property.cs b/OWASP.AntiSamy/Html/Model/Property.cs index 9fa146c..fff4eb0 100644 --- a/OWASP.AntiSamy/Html/Model/Property.cs +++ b/OWASP.AntiSamy/Html/Model/Property.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro + * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Html/Model/Tag.cs b/OWASP.AntiSamy/Html/Model/Tag.cs index 8a48fac..f6f49da 100644 --- a/OWASP.AntiSamy/Html/Model/Tag.cs +++ b/OWASP.AntiSamy/Html/Model/Tag.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro + * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Html/ParseContext.cs b/OWASP.AntiSamy/Html/ParseContext.cs index a83603e..a9d2105 100644 --- a/OWASP.AntiSamy/Html/ParseContext.cs +++ b/OWASP.AntiSamy/Html/ParseContext.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li, Kristian Rosenvold, Sebastin Passaro + * Copyright (c) 2007-2023, Arshan Dabirsiaghi, Jason Li, Kristian Rosenvold, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Html/Policy.cs b/OWASP.AntiSamy/Html/Policy.cs index ab1df9e..7a6643d 100644 --- a/OWASP.AntiSamy/Html/Policy.cs +++ b/OWASP.AntiSamy/Html/Policy.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008-2022, Jerry Hoff, Sebastián Passaro + * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro * * All rights reserved. * diff --git a/OWASP.AntiSamy/Html/Scan/AntiSamyDomScanner.cs b/OWASP.AntiSamy/Html/Scan/AntiSamyDomScanner.cs index 680bd39..48f455c 100644 --- a/OWASP.AntiSamy/Html/Scan/AntiSamyDomScanner.cs +++ b/OWASP.AntiSamy/Html/Scan/AntiSamyDomScanner.cs @@ -1,5 +1,5 @@ /* - * Copyright (c) 2009-2022, Jerry Hoff, Sebastin Passaro + * Copyright (c) 2009-2023, Jerry Hoff, Sebastián Passaro * * All rights reserved. * @@ -136,7 +136,7 @@ public CleanResults Scan(string html) // All the cleaned HTML string finalCleanHTML = Policy.PreservesSpace ? htmlDocument.DocumentNode.InnerHtml : htmlDocument.DocumentNode.InnerHtml.Trim(); - + // Encode special/international characters if stated by policy if (Policy.EntityEncodesInternationalCharacters) { @@ -371,6 +371,15 @@ private void ValidateTag(HtmlNode node, HtmlNode parentNode, string tagName, Tag return; } + /* + * Parse every