8

I have application where customer can store following html lines in order to load different styles for actual browser:

<!--[if IE 6]><link rel="stylesheet" type="text/css" media="all" href="default/css/general_ie6.css"><![endif]--> 
<!--[if IE 7]><link rel="stylesheet" type="text/css" media="all" href="default/css/general_ie7.css"><![endif]--> 
<!--[if IE 8]><link rel="stylesheet" type="text/css" media="all" href="default/css/general_ie8.css"><![endif]-->

Also I've configured OWASP policy to disallow malicious html tags in following way:

new HtmlPolicyBuilder().allowElements("link").allowAttributes("rel", "type", "media", "href").onElements("link").toFactory();

But after sanitation if browser lines are dropped.

Could you please suggest how to configure policy in order to allow storing such content?

fashuser
  • 2,152
  • 3
  • 29
  • 51

2 Answers2

2

The OWASP Sanitizer can not be configured to accept these tags. Instead you could use a HTML parser like JSoup to extract these lines before santizing, then add them back in afterwards.

Ben-JD
  • 96
  • 5
1

There is Issue #1532: Allow comments to be preserved in HTML. Until that feature request, or a similar one, is completed, this is not possible with the HTML sanitizer.

Thunderforge
  • 19,637
  • 18
  • 83
  • 130