Hello Christian, It's nice to see that you are interested in XWiki security :) As for the secure html macro I've been working on, there's no PR made for it (the issue was that it was breaking a lot of panels that were using unsafe html code thanks to this macro), but I would try to create a branch on github with the corresponding code when I have time. To sum up what I've done, I just used a library called JSoup which allows to easily deal with whitelists (see http://jsoup.org/apidocs/org/jsoup/safety/Whitelist.html for example). And as I wanted to let users with Programming Rights use the HTML macro without restriction, I had to put my "secure" html macro in xwiki-platform instead of xwiki-rendering, so that my whitelist check is not used against these users. BTW let me know if there any issue you get with my other XSS PR and don't hesitate to contact me if you have questions or suggestions about what I've done there (or for other security matters !). As Vincent said, I'm in holidays right now, so I could be slow to answer, but I won't forget you ;). Thanks ! Thomas On Wed, Aug 7, 2013 at 5:32 PM, Vincent Massol <vincent@massol.net> wrote:
On Aug 7, 2013, at 5:30 PM, Christian Meunier < christian.meunier@magelo.com> wrote:
Hi Vincent,
Can you point me to the PR from Thomas ? I have already integrated the XSS PR but it does not secure the Html Macro out of the box right now. Looks like a @Named("securehtml") component who be needed in order to provide a secured Html macro, has anyone started working on it already ?
I'll let ThomasD answer this since I'm not sure where it is… (Note: Thomas might be on Holidays ATM)
AFAIR he's using tagsoup as a htmlcleaner filter (configurable through xwiki configuration files).
Thanks -Vincent
Thanks !
Also if you could explain me how I can secure the HtmlMacro without
touching its jar that would be very helpful. From looking around and the discussion, I was under the impression that it was possible but I just dont know how… This is a work in progress. There's a pull request from Thomas Delafosse about this but it's not been applied yet AFAIK.
Thanks -Vincent
_______________________________________________ devs mailing list devs@xwiki.org http://lists.xwiki.org/mailman/listinfo/devs