Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit df8058b

Browse files
leocwolterleocwolter
committed
refactoring sanitizer and "unit" test
1 parent d7f685d commit df8058b

File tree

6 files changed

+140
-70
lines changed

6 files changed

+140
-70
lines changed

‎src/main/java/org/mamute/sanitizer/HtmlAttribute.java‎ renamed to ‎src/main/java/org/mamute/sanitizer/HtmlAttributesBuilder.java‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,44 @@
11
package org.mamute.sanitizer;
22

3+
import static org.mamute.sanitizer.HtmlElementsBuilder.COMMA;
34
import static org.mamute.sanitizer.HtmlSanitizer.ALLOWED_ATTRIBUTES_KEY_PREFIX;
45
import static org.mamute.sanitizer.HtmlSanitizer.ALLOWED_ATTRIBUTES_WHITELIST_KEY_SUFIX;
56

67
import java.util.HashMap;
78
import java.util.Map;
89

10+
import javax.inject.Inject;
11+
912
import br.com.caelum.vraptor.environment.Environment;
1013

14+
public class HtmlAttributesBuilder {
15+
private Environment env;
1116

12-
public class HtmlAttribute {
17+
/**
18+
* @deprecated CDI eyes only
19+
*/
20+
public HtmlAttributesBuilder() {
21+
}
22+
23+
@Inject
24+
public HtmlAttributesBuilder(Environment env) {
25+
this.env = env;
26+
}
1327

14-
public static Map<String, String> using(String element, Environment environment){
28+
public Map<String, String> build(String element) {
1529
Map<String, String> attributesAndWhitelist = new HashMap<>();
1630
String allowedAttributesKey = ALLOWED_ATTRIBUTES_KEY_PREFIX+element;
17-
if(environment.has(allowedAttributesKey)){
18-
String allowedString = environment.get(allowedAttributesKey);
19-
String[] allowedAttributes = allowedString.split(HtmlElement.COMMA);
31+
if(env.has(allowedAttributesKey)){
32+
String allowedString = env.get(allowedAttributesKey);
33+
String[] allowedAttributes = allowedString.split(COMMA);
2034
for (String attribute : allowedAttributes) {
2135
String whitelistKey = allowedAttributesKey+ALLOWED_ATTRIBUTES_WHITELIST_KEY_SUFIX+attribute;
22-
String whitelist = environment.get(whitelistKey, null);
36+
String whitelist = env.get(whitelistKey, null);
2337
attributesAndWhitelist.put(attribute, whitelist);
2438
}
2539
}
2640
return attributesAndWhitelist;
2741
}
28-
42+
43+
2944
}

‎src/main/java/org/mamute/sanitizer/HtmlElement.java‎

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,47 @@
11
package org.mamute.sanitizer;
22

3-
import static org.mamute.sanitizer.HtmlSanitizer.ALLOWED_ELEMENTS_KEY;
3+
import static java.util.regex.Pattern.compile;
44

5-
import java.util.ArrayList;
6-
import java.util.List;
75
import java.util.Map;
6+
import java.util.Set;
87

98
import javax.enterprise.inject.Vetoed;
109

11-
import br.com.caelum.vraptor.environment.Environment;
10+
import org.owasp.html.HtmlPolicyBuilder;
11+
import org.owasp.html.HtmlPolicyBuilder.AttributeBuilder;
1212

1313
@Vetoed
1414
public class HtmlElement {
1515

16-
static final String COMMA = "(\\s)?+,(\\s)?+";
1716
private String element;
1817
private Map<String, String> attributesAndWhitelist;
1918

20-
public static List<HtmlElement> using(Environment environment) {
21-
String[] allowed = environment.get(ALLOWED_ELEMENTS_KEY).split(COMMA);
22-
List<HtmlElement> elements = new ArrayList<>();
23-
for (String element: allowed) {
24-
elements.add(new HtmlElement(element, HtmlAttribute.using(element, environment)));
25-
}
26-
return elements;
27-
}
28-
29-
private HtmlElement(String element, Map<String, String> attributesAndWhitelist) {
19+
HtmlElement(String element, Map<String, String> attributesAndWhitelist) {
3020
this.element = element;
3121
this.attributesAndWhitelist = attributesAndWhitelist;
3222
}
3323

34-
3524
public String getElement() {
3625
return element;
3726
}
3827

39-
public Map<String, String> getAttributesAndWhitelist() {
40-
return attributesAndWhitelist;
28+
public void configure(HtmlPolicyBuilder policyBuilder) {
29+
String elementName = getElement();
30+
policyBuilder.allowElements(elementName);
31+
32+
Set<String> allowedAttributes = attributesAndWhitelist.keySet();
33+
AttributeBuilder attributesBuilder = policyBuilder.allowAttributes(allowedAttributes.toArray(new String[]{}));
34+
35+
for (String attribute : allowedAttributes) {
36+
String regex = attributesAndWhitelist.get(attribute);
37+
if(regex != null){
38+
attributesBuilder.matching(compile(regex));
39+
continue;
40+
}
41+
}
42+
attributesBuilder.onElements(elementName);
43+
44+
4145
}
4246

4347
}

‎src/main/java/org/mamute/sanitizer/HtmlElementsBuilder.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package org.mamute.sanitizer;
2+
3+
import static org.mamute.sanitizer.HtmlSanitizer.ALLOWED_ELEMENTS_KEY;
4+
5+
import java.util.ArrayList;
6+
import java.util.List;
7+
8+
import javax.inject.Inject;
9+
10+
import br.com.caelum.vraptor.environment.Environment;
11+
12+
public class HtmlElementsBuilder {
13+
static final String COMMA = "(\\s)?+,(\\s)?+";
14+
private Environment env;
15+
private HtmlAttributesBuilder builder;
16+
17+
/**
18+
* @deprecated CDI eyes only
19+
*/
20+
public HtmlElementsBuilder() {
21+
}
22+
23+
@Inject
24+
public HtmlElementsBuilder(Environment env, HtmlAttributesBuilder builder) {
25+
this.env = env;
26+
this.builder = builder;
27+
}
28+
29+
public List<HtmlElement> build() {
30+
String[] allowed = env.get(ALLOWED_ELEMENTS_KEY).split(COMMA);
31+
List<HtmlElement> elements = new ArrayList<>();
32+
for (String element: allowed) {
33+
elements.add(new HtmlElement(element, builder.build(element)));
34+
}
35+
return elements;
36+
}
37+
38+
39+
}

‎src/main/java/org/mamute/sanitizer/HtmlSanitizer.java‎

Lines changed: 3 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,20 @@
11
package org.mamute.sanitizer;
22

3-
import static java.util.regex.Pattern.compile;
43
import static org.mamute.model.SanitizedText.fromTrustedText;
54

6-
import java.util.List;
7-
import java.util.Map;
8-
import java.util.Set;
9-
10-
import javax.annotation.PostConstruct;
115
import javax.enterprise.context.ApplicationScoped;
126
import javax.inject.Inject;
137

148
import org.mamute.model.SanitizedText;
15-
import org.owasp.html.HtmlPolicyBuilder;
16-
import org.owasp.html.HtmlPolicyBuilder.AttributeBuilder;
179
import org.owasp.html.PolicyFactory;
1810

19-
import br.com.caelum.vraptor.environment.Environment;
20-
2111
@ApplicationScoped
2212
public class HtmlSanitizer {
2313

2414
static final String ALLOWED_ELEMENTS_KEY = "sanitizer.allowed_elements";
2515
static final String ALLOWED_ATTRIBUTES_KEY_PREFIX = "sanitizer.allowed_attributes.";
2616
static final String ALLOWED_ATTRIBUTES_WHITELIST_KEY_SUFIX = ".whitelist.";
2717

28-
private Environment env;
2918
private PolicyFactory policy;
3019

3120
/**
@@ -35,40 +24,11 @@ protected HtmlSanitizer() {
3524
}
3625

3726
@Inject
38-
public HtmlSanitizer(Environment env) {
39-
this.env = env;
27+
public HtmlSanitizer(PolicyFactory policy) {
28+
this.policy = policy;
4029
}
4130

42-
@PostConstruct
43-
public void setUp(){
44-
List<HtmlElement> allowedElements = HtmlElement.using(env);
45-
HtmlPolicyBuilder builder = new HtmlPolicyBuilder();
46-
for (HtmlElement htmlElement : allowedElements) {
47-
String elementName = htmlElement.getElement();
48-
builder.allowElements(elementName);
49-
50-
Map<String, String> attributesAndWhitelist = htmlElement.getAttributesAndWhitelist();
51-
Set<String> allowedAttributes = attributesAndWhitelist.keySet();
52-
53-
AttributeBuilder attributesBuilder = builder.allowAttributes(allowedAttributes.toArray(new String[]{}));
54-
55-
for (String attribute : allowedAttributes) {
56-
String regex = attributesAndWhitelist.get(attribute);
57-
if(regex != null){
58-
attributesBuilder.matching(compile(regex));
59-
continue;
60-
}
61-
}
62-
attributesBuilder.onElements(elementName);
63-
64-
}
65-
policy = builder
66-
.allowUrlProtocols("https", "http")
67-
.requireRelNofollowOnLinks()
68-
.toFactory();
69-
}
70-
7131
public SanitizedText sanitize(String html){
72-
return html == null ? null: fromTrustedText(policy.sanitize(html));
32+
return html == null ? null : fromTrustedText(policy.sanitize(html));
7333
}
7434
}

‎src/main/java/org/mamute/sanitizer/MamutePolicyProducer.java‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
package org.mamute.sanitizer;
2+
3+
import java.util.List;
4+
5+
import javax.annotation.PostConstruct;
6+
import javax.enterprise.context.ApplicationScoped;
7+
import javax.enterprise.inject.Produces;
8+
import javax.inject.Inject;
9+
10+
import org.owasp.html.HtmlPolicyBuilder;
11+
import org.owasp.html.PolicyFactory;
12+
13+
@ApplicationScoped
14+
public class MamutePolicyProducer {
15+
16+
private HtmlElementsBuilder builder;
17+
private PolicyFactory policy;
18+
19+
/**
20+
* @deprecated CDI eyes only
21+
*/
22+
public MamutePolicyProducer() {
23+
}
24+
25+
@Inject
26+
public MamutePolicyProducer(HtmlElementsBuilder builder) {
27+
this.builder = builder;
28+
}
29+
30+
@PostConstruct
31+
public void setUp(){
32+
List<HtmlElement> allowedElements = builder.build();
33+
HtmlPolicyBuilder policyBuilder = new HtmlPolicyBuilder();
34+
for (HtmlElement htmlElement : allowedElements) {
35+
htmlElement.configure(policyBuilder);
36+
}
37+
policy = policyBuilder
38+
.allowUrlProtocols("https", "http")
39+
.requireRelNofollowOnLinks()
40+
.toFactory();
41+
42+
}
43+
44+
@Produces
45+
public PolicyFactory getInstance(){
46+
return policy;
47+
}
48+
}

‎src/test/java/org/mamute/sanitizer/HtmlSanitizerTest.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import org.junit.runner.RunWith;
1313
import org.mockito.Mock;
1414
import org.mockito.runners.MockitoJUnitRunner;
15+
import org.owasp.html.PolicyFactory;
1516

1617
import br.com.caelum.vraptor.environment.Environment;
1718

@@ -30,8 +31,11 @@ public void setUp(){
3031
envReturns(ALLOWED_ATTRIBUTES_KEY_PREFIX+"iframe", "src, width, height, scrolling, frameborder");
3132
envReturns(ALLOWED_ATTRIBUTES_KEY_PREFIX+"iframe"+ALLOWED_ATTRIBUTES_WHITELIST_KEY_SUFIX+"href", ".*soundcloud.com\\/tracks\\/.*|.*youtube.com\\/embed\\/.*|.*//player.vimeo.com\\/video\\/.*");
3233

33-
htmlSanitizer = new HtmlSanitizer(env);
34-
htmlSanitizer.setUp();
34+
MamutePolicyProducer mamutePolicyProducer = new MamutePolicyProducer(new HtmlElementsBuilder(env, new HtmlAttributesBuilder(env)));
35+
mamutePolicyProducer.setUp();
36+
PolicyFactory policy = mamutePolicyProducer.getInstance();
37+
38+
htmlSanitizer = new HtmlSanitizer(policy);
3539
}
3640

3741
@Test

0 commit comments

Comments
 (0)