[
https://issues.apache.org/jira/browse/SLING-7231?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16395019#comment-16395019
]
Radu Cotescu commented on SLING-7231:
-------------------------------------
Hello [~Gimo],
Apache Sling has a XSS protection library [0], however it's using OWASP's
AntiSamy module for filtering HTML. The goal of this issue would be to
transition the module to use the OWASP HTML Sanitizer Project [1]. However,
there should be a bridge between these two dependencies, in the sense that the
Apache Sling XSS Protection API module should still be able to read AntiSamy
configurations, but apply them to [1], so that customers can upgrade the Apache
Sling XSS Protection API module in-place, without the need of migrating
configurations to a new format.
You should be familiar with Java, Maven and Git. XSS mitigation knowledge is
recommended.
[0] - https://github.com/apache/sling-org-apache-sling-xss/
[1] - https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project
> Move to owasp sanitizer library
> -------------------------------
>
> Key: SLING-7231
> URL: https://issues.apache.org/jira/browse/SLING-7231
> Project: Sling
> Issue Type: Improvement
> Components: XSS Protection API
> Reporter: Carsten Ziegeler
> Priority: Critical
> Labels: gsoc2018, java
> Fix For: XSS Protection API 2.1.0
>
>
> While looking at the extensive dependency list of the XSS module (which are
> all caused by the embedded owasp.org artifacts), I found out that the
> versions we use are outdated.
> So I think we should update those to the latest.
> Furthermore, the embedded antisamy library does not look to be maintained
> anymore
> (https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project)
> instead the html sanitizer looks much fresher and claims to be faster
> https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project
> I think we should switch. Quick analysis:
> Pros:
> Actively maintained
> Much faster
> Lightweight (also from a dependency POV)
> Cons:
> Incompatible (and runtime-object based) configuration
> Not completely feature equivalent (but close enough and better in some
> aspects)
> Some investigation is needed on how
> a) filter rules can be configured (e.g. sling configurations, file based,
> code bundle, ... ?)
> b) existing configurations can be migrated
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
