Skip to content

Support standard attributes in TABLES Policy - #326

Closed
subbudvk wants to merge 2 commits into
OWASP:mainfrom
subbudvk:subbudvk-patch-4
Closed

Support standard attributes in TABLES Policy#326
subbudvk wants to merge 2 commits into
OWASP:mainfrom
subbudvk:subbudvk-patch-4

Conversation

@subbudvk

@subbudvk subbudvk commented Feb 27, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

Fixes #195 and allows more attributes than existing PR

The goal is to allow common safe attributes in table context for in a single PR instead of handling one attribute at a time. Pl let me know if we want to allow more, or if there are issues with this one.

@subbudvk

subbudvk commented Mar 18, 2024

Copy link
Copy Markdown
Contributor Author

@mikesamuel

@jmanico

jmanico commented Mar 18, 2024

Copy link
Copy Markdown
Member

I am sorry, @mikesamuel is the release master. He'll get on this as soon as he can. Forgive the delay!

@ssweber

ssweber commented Mar 4, 2025

Copy link
Copy Markdown

Hello. What is the current thinking on this? Is "colspan","rowspan" generally safe to allow?

@aalmiray
aalmiray force-pushed the main branch 6 times, most recently from 9bb458a to f40152f Compare January 3, 2026 02:00
@jmanico

jmanico commented Sep 7, 2026

Copy link
Copy Markdown
Member

PR #378 has just been merged and adds colspan and rowspan (integer-checked) to Sanitizers.TABLES, which I believe covers the main ask here and the question from @ssweber. This branch now conflicts with main. If there are other table attributes you still want in the default policy, please rebase and trim this down to just those, with a test for each, and it can go in quickly. Otherwise I will close this as superseded in a couple of weeks. Thanks for the patience, @subbudvk.

@jmanico jmanico mentioned this pull request Sep 8, 2026
Merged
@jmanico

jmanico commented Sep 8, 2026

Copy link
Copy Markdown
Member

Closing as superseded. The colspan/rowspan half landed via #378, and this branch still patches the pre-#379 src/ layout, so it can no longer be rebased cleanly. The remaining two attributes, headers on td/th and scope on th, are landing in #407 on a fresh branch with positive and negative tests and a changelog credit to you. One change from this diff: scope is now emitted in canonical lower case rather than returning the original value after a lowercased comparison. Thanks for the original work, @subbudvk.

@jmanico jmanico closed this Sep 8, 2026
hwangjeyeon pushed a commit to hwangjeyeon/java-html-sanitizer that referenced this pull request Sep 8, 2026
@jmanico @claude
Allow headers and scope on table cells in Sanitizers.TABLES (OWASP#326)
2baf56f 
Salvages the two attributes from PR OWASP#326 that OWASP#378 did not already cover.

- headers on td and th: a space-separated list of ID tokens limited to
  ASCII letters, digits and _ - . : with white-space collapsed.
- scope on th: row, col, rowgroup or colgroup, matched case-insensitively
  and emitted in canonical lower case.  OWASP#326's policy compared the
  lowercased value but returned the original.

Positive and negative tests in SanitizersTest; changelog entry crediting
the original author.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BZfawfTUAFHN7cocUjcpQK
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Allow colspan attribute on td and th elements in TABLES PolicyFactory

3 participants

@subbudvk @jmanico @ssweber