edu.cornell.mannlib.vitro.webapp.web.AntiScript Maven / Gradle / Ivy
/* $This file is distributed under the terms of the license in LICENSE$ */
package edu.cornell.mannlib.vitro.webapp.web;
import java.net.URL;
import java.util.Map;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.owasp.validator.html.AntiSamy;
import org.owasp.validator.html.CleanResults;
import org.owasp.validator.html.Policy;
import org.owasp.validator.html.PolicyException;
import org.owasp.validator.html.ScanException;
/**
* This is a class to provide methods to strip bad HTML from user input.
* The primary goal of this is to avoid XSS attacks.
*/
public class AntiScript {
private static final Log log = LogFactory.getLog(AntiScript.class);
private static Policy policy;
private static AntiSamy antiSamy;
private static final String ANTI_SCRIPT_SCANNER = "ANTI_SCRIPT_SCANNER";
private static String ANTI_SCRIPT_POLICY_FILE = "/edu/cornell/mannlib/vitro/webapp/web/antisamy-vitro-1.4.4.xml";
/**
* This will attempt to return HTML that has been cleaned up according
* to the policy.
*
* If there is any error during the scan, an error message
* will be returned instead of the HTML. This might not be ideal so
* consider changing it once we see how this works. Other options include
* returning an empty string or some other error message. Returning
* the un-scanned HTML is not a secure option as it may contain scripts.
*
* This will return null if dirtyInput is null.
*/
public static String cleanText( String dirtyInput ){
if( dirtyInput == null )
return null;
AntiSamy as = getAntiSamyScanner();
CleanResults cr;
try {
cr = as.scan(dirtyInput);
return cr.getCleanHTML();
} catch (ScanException | PolicyException e) {
log.error("Error while scanning HTML" ,e );
}
return "AntiScript: HTML caused scan error.";
}
/**
* Method to clean a URL or URI.
*/
public static String cleanURI( String dirtyInput ){
return cleanText(dirtyInput);
}
/**
* Method to clean all of the values in a map where the values are of
* type String.
*/
public static void cleanMapValues( Map map ){
for( T key : map.keySet() ){
map.put(key, cleanText(map.get(key)) );
}
}
/**
* Try to get the static policy, if none exists, create a new one.
* This is a anti-script policy for use with OWASP AntiSamy, not a vivo auth Policy.
* Returns null if no policy can be created.
*/
protected static Policy getAntiScriptPolicy( ){
if( policy == null ){
Policy newPolicy;
try {
String url = ANTI_SCRIPT_POLICY_FILE;
URL policyFile= AntiScript.class.getResource( url );
newPolicy = Policy.getInstance( policyFile );
log.debug("anti-script policy loaded successfully");
policy = newPolicy;
} catch (Throwable e) {
log.error("Anti-Script policy not setup.", e);
return null;
}
}
return policy;
}
/**
* Try to get a static AntiSamy HTML scanner object that is shared the
* whole application. This may return a scanner with a null
* policy if the policy is not setup correctly.
*/
public static AntiSamy getAntiSamyScanner( ){
if( antiSamy == null ){
antiSamy = new AntiSamy( getAntiScriptPolicy() );
log.debug("anti-script scanner loaded successfully");
}
return antiSamy;
}
}