antisamy 0.0.1 → 0.2.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (45) hide show
  1. data/README.rdoc +6 -1
  2. data/lib/antisamy/css/css_filter.rb +187 -0
  3. data/lib/antisamy/css/css_scanner.rb +84 -0
  4. data/lib/antisamy/css/css_validator.rb +129 -0
  5. data/lib/antisamy/csspool/rsac/sac/conditions/attribute_condition.rb +50 -0
  6. data/lib/antisamy/csspool/rsac/sac/conditions/begin_hyphen_condition.rb +18 -0
  7. data/lib/antisamy/csspool/rsac/sac/conditions/class_condition.rb +18 -0
  8. data/lib/antisamy/csspool/rsac/sac/conditions/combinator_condition.rb +36 -0
  9. data/lib/antisamy/csspool/rsac/sac/conditions/condition.rb +29 -0
  10. data/lib/antisamy/csspool/rsac/sac/conditions/id_condition.rb +23 -0
  11. data/lib/antisamy/csspool/rsac/sac/conditions/one_of_condition.rb +18 -0
  12. data/lib/antisamy/csspool/rsac/sac/conditions/pseudo_class_condition.rb +20 -0
  13. data/lib/antisamy/csspool/rsac/sac/conditions.rb +5 -0
  14. data/lib/antisamy/csspool/rsac/sac/document_handler.rb +66 -0
  15. data/lib/antisamy/csspool/rsac/sac/error_handler.rb +13 -0
  16. data/lib/antisamy/csspool/rsac/sac/generated_parser.rb +1012 -0
  17. data/lib/antisamy/csspool/rsac/sac/generated_property_parser.rb +9284 -0
  18. data/lib/antisamy/csspool/rsac/sac/lexeme.rb +27 -0
  19. data/lib/antisamy/csspool/rsac/sac/lexical_unit.rb +201 -0
  20. data/lib/antisamy/csspool/rsac/sac/parse_exception.rb +4 -0
  21. data/lib/antisamy/csspool/rsac/sac/parser.rb +109 -0
  22. data/lib/antisamy/csspool/rsac/sac/property_parser.rb +44 -0
  23. data/lib/antisamy/csspool/rsac/sac/selectors/child_selector.rb +36 -0
  24. data/lib/antisamy/csspool/rsac/sac/selectors/conditional_selector.rb +45 -0
  25. data/lib/antisamy/csspool/rsac/sac/selectors/descendant_selector.rb +36 -0
  26. data/lib/antisamy/csspool/rsac/sac/selectors/element_selector.rb +35 -0
  27. data/lib/antisamy/csspool/rsac/sac/selectors/selector.rb +25 -0
  28. data/lib/antisamy/csspool/rsac/sac/selectors/sibling_selector.rb +35 -0
  29. data/lib/antisamy/csspool/rsac/sac/selectors/simple_selector.rb +21 -0
  30. data/lib/antisamy/csspool/rsac/sac/selectors.rb +5 -0
  31. data/lib/antisamy/csspool/rsac/sac/token.rb +25 -0
  32. data/lib/antisamy/csspool/rsac/sac/tokenizer.rb +185 -0
  33. data/lib/antisamy/csspool/rsac/sac.rb +14 -0
  34. data/lib/antisamy/csspool/rsac/stylesheet/rule.rb +20 -0
  35. data/lib/antisamy/csspool/rsac/stylesheet/stylesheet.rb +76 -0
  36. data/lib/antisamy/csspool/rsac/stylesheet.rb +3 -0
  37. data/lib/antisamy/csspool/rsac.rb +1 -0
  38. data/lib/antisamy/html/handler.rb +4 -0
  39. data/lib/antisamy/html/sax_filter.rb +49 -33
  40. data/lib/antisamy/html/scanner.rb +1 -43
  41. data/lib/antisamy/policy.rb +8 -3
  42. data/lib/antisamy/scan_results.rb +68 -0
  43. data/lib/antisamy.rb +4 -0
  44. data/spec/antisamy_spec.rb +111 -3
  45. metadata +39 -3
data/spec/antisamy_spec.rb CHANGED
@@ -2,7 +2,9 @@ require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
2
 
3
3
  module AntiSamy
4
4
  describe AntiSamy do
5
- let(:policy_file) {"#{File.join(File.dirname(__FILE__), '..', 'policy-examples')}/antisamy.xml"}
5
+ let(:policy_file) {"#{File.join(File.dirname(__FILE__), '..', 'policy-examples')}/antisamy-testing.xml"}
6
+ let(:strict_policy) {"#{File.join(File.dirname(__FILE__), '..', 'policy-examples')}/antisamy-anythinggoes.xml"}
7
+ let(:policy_object) {AntiSamy.policy(policy_file)}
6
8
 
7
9
  it "should load a policy" do
8
10
  p = AntiSamy.policy(policy_file)
@@ -17,12 +19,118 @@ module AntiSamy
17
19
  end
18
20
 
19
21
  it "should tak our input and remove the script tags" do
20
- input = "<p>Hi</p><script> some junk</script>"
22
+ input = "<p style='font-size: 16px'>Hi</p><script> some junk</script>"
21
23
  expec = "<p>Hi</p>"
22
24
  p = AntiSamy.policy(policy_file)
23
25
  r = AntiSamy.scan(input,p)
24
26
  r.clean_html.should == expec
27
+ r.messages.size.should == 2 # error 1 for script tag, error 2 for style tag
25
28
  end
26
-
29
+
30
+ # Script attacks
31
+ {
32
+ "test<script>alert(document.cookie)</script>" => "script",
33
+ "<<<><<script src=http://fake-evil.ru/test.js>" => "<script",
34
+ "<script<script src=http://fake-evil.ru/test.js>>" => "<script",
35
+ "<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>" => "<script",
36
+ '<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>' => "onload",
37
+ "<BODY ONLOAD=alert('XSS')>" => "alert",
38
+ "<iframe src=http://ha.ckers.org/scriptlet.html <" => "<iframe",
39
+ "<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">" => "src"
40
+ }.each_pair do |k,v|
41
+ it "should remove #{v} from #{k} for script attacks" do
42
+ r = AntiSamy.scan(k,policy_object)
43
+ r.clean_html.should_not include(v)
44
+ end
45
+ end
46
+
47
+ #Image Attacks
48
+ {
49
+ "<img src='http://www.myspace.com/img.gif'>"=>"<img",
50
+ "<img src=javascript:alert(document.cookie)>"=>"<img",
51
+ "<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>"=>"<img",
52
+ "<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>" => "&amp;",
53
+ "<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>"=>"&amp;",
54
+ "<IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">" => "alert",
55
+ "<IMG SRC=\"javascript:alert('XSS')\"" => "javascript",
56
+ "<IMG LOWSRC=\"javascript:alert('XSS')\">"=>"javascript",
57
+ "<BGSOUND SRC=\"javascript:alert('XSS');\">"=>"javascript",
58
+ }.each_pair do |k,v|
59
+ it "should remove #{v} from #{k} for image attacks" do
60
+ r = AntiSamy.scan(k,policy_object)
61
+ r.clean_html.should_not include(v)
62
+ end
63
+ end
64
+
65
+ # Css attacks
66
+ {
67
+ "<div style=\"position:absolute\">" => "position",
68
+ "<style>b { position:absolute }</style>" => "position",
69
+ "<div style=\"z-index:25\">" => "z-index",
70
+ "<style>z-index:25</style>" => "z-index",
71
+ "<div style=\"font-family: Geneva, Arial, courier new, sans-serif\">" => "font-family"
72
+ }.each_pair do |k,v|
73
+ it "should remove #{v} from #{k} for CSS attacks" do
74
+ r = AntiSamy.scan(k,policy_object)
75
+ r.clean_html.should_not include(v)
76
+ end
77
+ end
78
+
79
+ #href attacks
80
+ {
81
+ "<LINK REL=\"stylesheet\" HREF=\"javascript:alert('XSS');\">" => "href",
82
+ "<LINK REL=\"stylesheet\" HREF=\"http://ha.ckers.org/xss.css\">" => "href",
83
+ "<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>" => "ha.ckers",
84
+ "<STYLE>BODY{-moz-binding:url(\"http://ha.ckers.org/xssmoz.xml#xss\")}</STYLE>" => "ha.ckers",
85
+ "<STYLE>BODY{-moz-binding:url(\"http://ha.ckers.org/xssmoz.xml#xss\")}</STYLE>" => "xss",
86
+ "<STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS" => "javascript",
87
+ "<IMG SRC='vbscript:msgbox(\"XSS\")'>" => "vbscript",
88
+ "<a . href=\"http://www.test.com\">" => "href",
89
+ "<a - href=\"http://www.test.com\">" => "href",
90
+ "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\">" => "meta",
91
+ "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">" => "meta",
92
+ "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\">" => "meta",
93
+ "<IFRAME SRC=\"javascript:alert('XSS');\"></IFRAME>" => "iframe",
94
+ "<FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>" => "javascript",
95
+ "<TABLE BACKGROUND=\"javascript:alert('XSS')\">" => "background",
96
+ "<TABLE><TD BACKGROUND=\"javascript:alert('XSS')\">" => "background",
97
+ "<DIV STYLE=\"background-image: url(javascript:alert('XSS'))\">" => "javascript",
98
+ "<DIV STYLE=\"width: expression(alert('XSS'));\">" => "alert",
99
+ "<IMG STYLE=\"xss:expr/*XSS*/ession(alert('XSS'))\">" => "alert",
100
+ "<STYLE>@im\\port'\\ja\\vasc\\ript:alert(\"XSS\")';</STYLE>" => "alert",
101
+ "<BASE HREF=\"javascript:alert('XSS');//\">" => "javascript",
102
+ "<BaSe hReF=\"http://arbitrary.com/\">" => "base",
103
+ "<OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http://ha.ckers.org/scriptlet.html\"></OBJECT>" => "object",
104
+ "<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>" => "object",
105
+ "<EMBED SRC=\"http://ha.ckers.org/xss.swf\" AllowScriptAccess=\"always\"></EMBED>" => "embed",
106
+ "<EMBED SRC=\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"></EMBED>" => "embed",
107
+ "<SCRIPT a=\">\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>" => "script",
108
+ "<SCRIPT a=\">\" '' SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>" => "script",
109
+ "<SCRIPT a=`>` SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>" => "script",
110
+ "<SCRIPT a=\">'>\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>" => "script",
111
+ "<SCRIPT>document.write(\"<SCRI\");</SCRIPT>PT SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>" => "script",
112
+ "<SCRIPT SRC=http://ha.ckers.org/xss.js" => "script",
113
+ "<div/style=&#92&#45&#92&#109&#111&#92&#122&#92&#45&#98&#92&#105&#92&#110&#100&#92&#105&#110&#92&#103:&#92&#117&#114&#108&#40&#47&#47&#98&#117&#115&#105&#110&#101&#115&#115&#92&#105&#92&#110&#102&#111&#46&#99&#111&#46&#117&#107&#92&#47&#108&#97&#98&#115&#92&#47&#120&#98&#108&#92&#47&#120&#98&#108&#92&#46&#120&#109&#108&#92&#35&#120&#115&#115&#41&>" => "style",
114
+ "<a href='aim: &c:\\windows\\system32\\calc.exe' ini='C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\pwnd.bat'>" => "calc.exe",
115
+ "<!--\n<A href=\n- --><a href=javascript:alert:document.domain>test-->" => "javascript",
116
+ "<a></a style=\"\"xx:expr/**/ession(document.appendChild(document.createElement('script')).src='http://h4k.in/i.js')\">" => "<a style=",
117
+ "<a onblur=\"alert(secret)\" href=\"http://www.google.com\">Google</a>" => "href",
118
+ "<b><i>Some Text</b></i>" => "<i />",
119
+ "<div style=\"font-family: Geneva, Arial, courier new, sans-serif\">" => "font-family",
120
+ "<style type=\"text/css\"><![CDATA[P { margin-bottom: 0.08in; } ]]></style>" => "margin"
121
+
122
+ }.each_pair do |k,v|
123
+ it "should remove #{v} from #{k} for href attacks" do
124
+ r = AntiSamy.scan(k,policy_object)
125
+ r.clean_html.should_not include(v)
126
+ end
127
+ end
128
+
129
+ it "shoud import some stylesheets" do
130
+ input = "<style>@import url(http://www.owasp.org/skins/monobook/main.css);@import url(http://www.w3schools.com/stdtheme.css);@import url(http://www.google.com/ig/f/t1wcX5O39cc/ig.css); </style>"
131
+ r = AntiSamy.scan(input,policy_object)
132
+ r.clean_html.should_not be_empty
133
+ end
134
+
27
135
  end
28
136
  end
metadata CHANGED
@@ -2,7 +2,7 @@
2
2
  name: antisamy
3
3
  version: !ruby/object:Gem::Version
4
4
  prerelease:
5
- version: 0.0.1
5
+ version: 0.2.0
6
6
  platform: ruby
7
7
  authors:
8
8
  - Sal Scotto
@@ -10,7 +10,7 @@ autorequire:
10
10
  bindir: bin
11
11
  cert_chain: []
12
12
 
13
- date: 2011-03-07 00:00:00 -05:00
13
+ date: 2011-03-14 00:00:00 -04:00
14
14
  default_executable:
15
15
  dependencies:
16
16
  - !ruby/object:Gem::Dependency
@@ -112,6 +112,42 @@ extra_rdoc_files:
112
112
  - README.rdoc
113
113
  files:
114
114
  - lib/antisamy.rb
115
+ - lib/antisamy/css/css_filter.rb
116
+ - lib/antisamy/css/css_scanner.rb
117
+ - lib/antisamy/css/css_validator.rb
118
+ - lib/antisamy/csspool/rsac.rb
119
+ - lib/antisamy/csspool/rsac/sac.rb
120
+ - lib/antisamy/csspool/rsac/sac/conditions.rb
121
+ - lib/antisamy/csspool/rsac/sac/conditions/attribute_condition.rb
122
+ - lib/antisamy/csspool/rsac/sac/conditions/begin_hyphen_condition.rb
123
+ - lib/antisamy/csspool/rsac/sac/conditions/class_condition.rb
124
+ - lib/antisamy/csspool/rsac/sac/conditions/combinator_condition.rb
125
+ - lib/antisamy/csspool/rsac/sac/conditions/condition.rb
126
+ - lib/antisamy/csspool/rsac/sac/conditions/id_condition.rb
127
+ - lib/antisamy/csspool/rsac/sac/conditions/one_of_condition.rb
128
+ - lib/antisamy/csspool/rsac/sac/conditions/pseudo_class_condition.rb
129
+ - lib/antisamy/csspool/rsac/sac/document_handler.rb
130
+ - lib/antisamy/csspool/rsac/sac/error_handler.rb
131
+ - lib/antisamy/csspool/rsac/sac/generated_parser.rb
132
+ - lib/antisamy/csspool/rsac/sac/generated_property_parser.rb
133
+ - lib/antisamy/csspool/rsac/sac/lexeme.rb
134
+ - lib/antisamy/csspool/rsac/sac/lexical_unit.rb
135
+ - lib/antisamy/csspool/rsac/sac/parse_exception.rb
136
+ - lib/antisamy/csspool/rsac/sac/parser.rb
137
+ - lib/antisamy/csspool/rsac/sac/property_parser.rb
138
+ - lib/antisamy/csspool/rsac/sac/selectors.rb
139
+ - lib/antisamy/csspool/rsac/sac/selectors/child_selector.rb
140
+ - lib/antisamy/csspool/rsac/sac/selectors/conditional_selector.rb
141
+ - lib/antisamy/csspool/rsac/sac/selectors/descendant_selector.rb
142
+ - lib/antisamy/csspool/rsac/sac/selectors/element_selector.rb
143
+ - lib/antisamy/csspool/rsac/sac/selectors/selector.rb
144
+ - lib/antisamy/csspool/rsac/sac/selectors/sibling_selector.rb
145
+ - lib/antisamy/csspool/rsac/sac/selectors/simple_selector.rb
146
+ - lib/antisamy/csspool/rsac/sac/token.rb
147
+ - lib/antisamy/csspool/rsac/sac/tokenizer.rb
148
+ - lib/antisamy/csspool/rsac/stylesheet.rb
149
+ - lib/antisamy/csspool/rsac/stylesheet/rule.rb
150
+ - lib/antisamy/csspool/rsac/stylesheet/stylesheet.rb
115
151
  - lib/antisamy/html/handler.rb
116
152
  - lib/antisamy/html/sax_filter.rb
117
153
  - lib/antisamy/html/scanner.rb
@@ -138,7 +174,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
138
174
  requirements:
139
175
  - - ">="
140
176
  - !ruby/object:Gem::Version
141
- hash: -39737283441268027
177
+ hash: -3694882257398018241
142
178
  segments:
143
179
  - 0
144
180
  version: "0"