Hi All,
I've taken out the basic and restrictive JavaScript sanitation I had
used for bio and comments earlier, and provided a sanitizeHtml method in
the MashupUtils class which actually wraps AntiSamy
(http://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project) a
profile based HTML sanitation tool, which is BSD licensed.
This was pretty much the best sanitation tool I found out there with the
features and license we need. All the dependant jars it added to our
distro are apache licensed, but it does add 3 jars, along with it's own
code, for a total of 468K. Seems pretty big just to sanitize HTML, but
with AntiSamy we (and any ultimate user), can change the policy XML file
in the config directory to make the sanitation as open or as paranoid as
necessary.
If the increase in download size seems too large and the solution seems
to be an overkill, we can actually remove AntiSamy and implement our own
Java based logic in the sanitizeHtml method, but I personally would
prefer to stay with this.
Bye,
Channa.
--
********************************************
Channa Gunawardena
Technical Lead, WSO2 Inc.
channa at wso2.com; http://channa.gunawardena.org; +94 71 306 2722
"The Open Source SOA Company", http://wso2.com
_______________________________________________
Mashup-dev mailing list
[email protected]
http://wso2.org/cgi-bin/mailman/listinfo/mashup-dev
