diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 5e11ad9..1fa315e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -57,7 +57,7 @@ jobs:
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@v1
+ uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -66,21 +66,16 @@ jobs:
# queries: ./path/to/local/query, your-org/your-repo/queries@main
# This prevents errors when automatically installing SDK.
- # CodeQL does not install .NET 5.0 nor 6.0.
- - name: Setup .NET 5.0 SDK+Runtime
+ # CodeQL does not install .NET 8.0.
+ - name: Setup .NET 8.0 SDK+Runtime
uses: actions/setup-dotnet@v1.7.2
with:
- dotnet-version: 5.0.404
-
- - name: Setup .NET 6.0 SDK+Runtime
- uses: actions/setup-dotnet@v1.7.2
- with:
- dotnet-version: 6.0.101
+ dotnet-version: 8.0.100
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
- uses: github/codeql-action/autobuild@v1
+ uses: github/codeql-action/autobuild@v2
# ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl
@@ -94,4 +89,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v1
+ uses: github/codeql-action/analyze@v2
diff --git a/.github/workflows/netcore_and_netframework.yml b/.github/workflows/netcore_and_netframework.yml
index e99363f..1721458 100644
--- a/.github/workflows/netcore_and_netframework.yml
+++ b/.github/workflows/netcore_and_netframework.yml
@@ -40,20 +40,10 @@ jobs:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v2
- - name: Setup .NET Core SDK+Runtime
+ - name: Setup .NET 8.0 SDK+Runtime
uses: actions/setup-dotnet@v1.7.2
with:
- dotnet-version: 3.1.x
-
- - name: Setup .NET 5.0 SDK+Runtime
- uses: actions/setup-dotnet@v1.7.2
- with:
- dotnet-version: 5.0.404
-
- - name: Setup .NET 6.0 SDK+Runtime
- uses: actions/setup-dotnet@v1.7.2
- with:
- dotnet-version: 6.0.101
+ dotnet-version: 8.0.100
- name: Setup MSBuild for .NET Framework
uses: microsoft/setup-msbuild@v1
diff --git a/LICENSE b/LICENSE
index ded0ada..1daba2b 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
BSD 3-Clause License
-Copyright (c) 2022, spassarop
+Copyright (c) 2023, spassarop
All rights reserved.
Redistribution and use in source and binary forms, with or without
diff --git a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-anythinggoes.xml b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-anythinggoes.xml
index efa3a6e..67ffbdf 100644
--- a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-anythinggoes.xml
+++ b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-anythinggoes.xml
@@ -41,7 +41,7 @@ http://www.w3.org/TR/html401/struct/global.html
-
+
diff --git a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-ebay.xml b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-ebay.xml
index b5baa7b..6040f37 100644
--- a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-ebay.xml
+++ b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-ebay.xml
@@ -39,7 +39,7 @@ http://www.w3.org/TR/html401/struct/global.html
-
+
diff --git a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-myspace.xml b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-myspace.xml
index fb3ad50..59fd1f0 100644
--- a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-myspace.xml
+++ b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy-myspace.xml
@@ -41,7 +41,7 @@ http://www.w3.org/TR/html401/struct/global.html
-
+
diff --git a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy.xml b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy.xml
index 76fbe4e..5b6b4c2 100644
--- a/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy.xml
+++ b/OWASP.AntiSamy/AntiSamyPolicyExamples/antisamy.xml
@@ -44,7 +44,7 @@ http://www.w3.org/TR/html401/struct/global.html
-
+
diff --git a/OWASP.AntiSamy/Css/CssScanner.cs b/OWASP.AntiSamy/Css/CssScanner.cs
index dd33395..8e598c5 100644
--- a/OWASP.AntiSamy/Css/CssScanner.cs
+++ b/OWASP.AntiSamy/Css/CssScanner.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2022, Jerry Hoff, Caner Patir, Sebastin Passaro
+ * Copyright (c) 2023, Jerry Hoff, Caner Patir, Sebastián Passaro
*
*
* All rights reserved.
diff --git a/OWASP.AntiSamy/Exceptions/ParseException.cs b/OWASP.AntiSamy/Exceptions/ParseException.cs
index 97b535e..8419067 100644
--- a/OWASP.AntiSamy/Exceptions/ParseException.cs
+++ b/OWASP.AntiSamy/Exceptions/ParseException.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2022, Caner Patir, Sebastin Passaro
+ * Copyright (c) 2023, Caner Patir, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Exceptions/PolicyException.cs b/OWASP.AntiSamy/Exceptions/PolicyException.cs
index 1835e85..3823412 100644
--- a/OWASP.AntiSamy/Exceptions/PolicyException.cs
+++ b/OWASP.AntiSamy/Exceptions/PolicyException.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro
+ * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Exceptions/ScanException.cs b/OWASP.AntiSamy/Exceptions/ScanException.cs
index 4cb3bdc..933a24c 100644
--- a/OWASP.AntiSamy/Exceptions/ScanException.cs
+++ b/OWASP.AntiSamy/Exceptions/ScanException.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro
+ * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Exceptions/UnknownSelectorException.cs b/OWASP.AntiSamy/Exceptions/UnknownSelectorException.cs
index ba96f31..c2e7152 100644
--- a/OWASP.AntiSamy/Exceptions/UnknownSelectorException.cs
+++ b/OWASP.AntiSamy/Exceptions/UnknownSelectorException.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2009-2022, Sebastián Passaro
+ * Copyright (c) 2009-2023, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Html/AntiSamy.cs b/OWASP.AntiSamy/Html/AntiSamy.cs
index a7b1f10..a1760b8 100644
--- a/OWASP.AntiSamy/Html/AntiSamy.cs
+++ b/OWASP.AntiSamy/Html/AntiSamy.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro
+ * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Html/CleanResults.cs b/OWASP.AntiSamy/Html/CleanResults.cs
index f169d85..0f05065 100644
--- a/OWASP.AntiSamy/Html/CleanResults.cs
+++ b/OWASP.AntiSamy/Html/CleanResults.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro
+ * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro
*
* All rights reserved.
*
@@ -29,11 +29,31 @@
namespace OWASP.AntiSamy.Html
{
///
- /// This class contains the results of a scan.
- ///
- /// The list of error messages () will let the user know
- /// what, if any HTML errors existed, and what, if any, security or
- /// validation-related errors existed, and what was done about them.
+ /// This class contains the results of a scan. It primarily provides access to the clean sanitized
+ /// HTML, per the AntiSamy sanitization policy applied. It also provides access to some utility
+ /// information, like possible error messages and error message counts.
+ ///
+ /// WARNING: The ONLY output from the class you can completely rely on is the CleanResults output.
+ /// As stated in the documentation, neither the nor the methods
+ /// subtly answer the question "is this safe input?" in the affirmative if it returns an empty list.
+ /// You must always use the sanitized 'Clean' input and there is no way to be sure the input passed in had no attacks.
+ ///
+ ///
+ /// The serialization and deserialization process that is critical to the effectiveness of the
+ /// sanitizer is purposefully lossy and will filter out attacks via a number of attack vectors.
+ /// Unfortunately, one of the tradeoffs of this strategy is that AntiSamy doesn't always know in
+ /// retrospect that an attack was seen. Thus, the API is there to help users
+ /// understand whether their well-intentioned input meets the requirements of the system, not help a
+ /// developer detect if an attack was present.
+ ///
+ ///
+ /// The list of error messages () will let the user know what, if any
+ /// HTML errors existed, and what, if any, security or validation-related errors were detected, and
+ /// what was done about them. NOTE: As just stated, the absence of error messages does NOT mean there
+ /// were no attacks in the input that was sanitized out. You CANNOT rely on the to tell
+ /// you if the input was dangerous. You MUST use the output of to ensure your output
+ /// is safe.
+ ///
///
public class CleanResults
{
@@ -74,11 +94,17 @@ public CleanResults(DateTime startOfScan, DateTime endOfScan, string cleanHTML,
///
public void SetCleanHtml(string cleanHtml) => this.cleanHtml = cleanHtml;
- /// Return the filtered HTML as a string.
+ ///
+ /// Return the filtered HTML as a string. This output is the ONLY output you can trust to be safe.
+ /// The absence of error messages does NOT indicate the input was safe.
+ ///
/// A string object which contains the serialized, safe HTML.
public string GetCleanHtml() => cleanHtml;
- /// Return a list of error messages.
+ ///
+ /// Return a list of error messages -- but an empty list returned does not mean there was no attack
+ /// present, due to the serialization and deserialization process automatically cleaning up some attacks.
+ ///
/// A object which contains the error messages after a scan.
public List GetErrorMessages() => errorMessages;
@@ -98,7 +124,10 @@ public CleanResults(DateTime startOfScan, DateTime endOfScan, string cleanHTML,
/// An error message to append to the list of aggregate error messages during filtering.
public void AddErrorMessage(string msg) => errorMessages.Add(msg);
- /// Return the number of errors encountered during filtering.
+ ///
+ /// Return the number of errors encountered during filtering. Note that 0 errors does NOT
+ /// mean the input was safe. Only the output of can be considered safe.
+ ///
public int GetNumberOfErrors() => errorMessages.Count;
}
}
diff --git a/OWASP.AntiSamy/Html/InternalPolicy.cs b/OWASP.AntiSamy/Html/InternalPolicy.cs
index 8bc56d9..3900bcf 100644
--- a/OWASP.AntiSamy/Html/InternalPolicy.cs
+++ b/OWASP.AntiSamy/Html/InternalPolicy.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2008-2022, Kristian Rosenvold, Sebastin Passaro
+ * Copyright (c) 2008-2023, Kristian Rosenvold, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Html/Model/AntiSamyPattern.cs b/OWASP.AntiSamy/Html/Model/AntiSamyPattern.cs
index 811d213..4c0167d 100644
--- a/OWASP.AntiSamy/Html/Model/AntiSamyPattern.cs
+++ b/OWASP.AntiSamy/Html/Model/AntiSamyPattern.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro
+ * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Html/Model/Attribute.cs b/OWASP.AntiSamy/Html/Model/Attribute.cs
index d52d311..00b4455 100644
--- a/OWASP.AntiSamy/Html/Model/Attribute.cs
+++ b/OWASP.AntiSamy/Html/Model/Attribute.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro
+ * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Html/Model/Property.cs b/OWASP.AntiSamy/Html/Model/Property.cs
index 9fa146c..fff4eb0 100644
--- a/OWASP.AntiSamy/Html/Model/Property.cs
+++ b/OWASP.AntiSamy/Html/Model/Property.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro
+ * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Html/Model/Tag.cs b/OWASP.AntiSamy/Html/Model/Tag.cs
index 8a48fac..f6f49da 100644
--- a/OWASP.AntiSamy/Html/Model/Tag.cs
+++ b/OWASP.AntiSamy/Html/Model/Tag.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2008-2022, Jerry Hoff, Sebastin Passaro
+ * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Html/ParseContext.cs b/OWASP.AntiSamy/Html/ParseContext.cs
index a83603e..a9d2105 100644
--- a/OWASP.AntiSamy/Html/ParseContext.cs
+++ b/OWASP.AntiSamy/Html/ParseContext.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2007-2022, Arshan Dabirsiaghi, Jason Li, Kristian Rosenvold, Sebastin Passaro
+ * Copyright (c) 2007-2023, Arshan Dabirsiaghi, Jason Li, Kristian Rosenvold, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Html/Policy.cs b/OWASP.AntiSamy/Html/Policy.cs
index ab1df9e..7a6643d 100644
--- a/OWASP.AntiSamy/Html/Policy.cs
+++ b/OWASP.AntiSamy/Html/Policy.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2008-2022, Jerry Hoff, Sebastián Passaro
+ * Copyright (c) 2008-2023, Jerry Hoff, Sebastián Passaro
*
* All rights reserved.
*
diff --git a/OWASP.AntiSamy/Html/Scan/AntiSamyDomScanner.cs b/OWASP.AntiSamy/Html/Scan/AntiSamyDomScanner.cs
index 680bd39..48f455c 100644
--- a/OWASP.AntiSamy/Html/Scan/AntiSamyDomScanner.cs
+++ b/OWASP.AntiSamy/Html/Scan/AntiSamyDomScanner.cs
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2009-2022, Jerry Hoff, Sebastin Passaro
+ * Copyright (c) 2009-2023, Jerry Hoff, Sebastián Passaro
*
* All rights reserved.
*
@@ -136,7 +136,7 @@ public CleanResults Scan(string html)
// All the cleaned HTML
string finalCleanHTML = Policy.PreservesSpace ? htmlDocument.DocumentNode.InnerHtml : htmlDocument.DocumentNode.InnerHtml.Trim();
-
+
// Encode special/international characters if stated by policy
if (Policy.EntityEncodesInternationalCharacters)
{
@@ -371,6 +371,15 @@ private void ValidateTag(HtmlNode node, HtmlNode parentNode, string tagName, Tag
return;
}
+ /*
+ * Parse every