This document provides an overview of how to use the AntiSamy HTML sanitization library. It describes downloading and configuring AntiSamy, creating a policy file to define sanitization rules, and includes examples of how different policy file configurations affect sanitization behavior. The document is intended to introduce unfamiliar users to the AntiSamy project and guide them through initial setup and usage.
Joomla is said to be one of the most popularly used Content Management Systems used worldwide. Most people are attracted towards Joomla is because of its $0 price tag.
Maruthi Prithivirajan, Head of ASEAN & IN Solution Architecture, Neo4j
Get an inside look at the latest Neo4j innovations that enable relationship-driven intelligence at scale. Learn more about the newest cloud integrations and product enhancements that make Neo4j an essential choice for developers building apps with interconnected data and generative AI.
How to Get CNIC Information System with Paksim Ga.pptxdanishmna97
Pakdata Cf is a groundbreaking system designed to streamline and facilitate access to CNIC information. This innovative platform leverages advanced technology to provide users with efficient and secure access to their CNIC details.
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!SOFTTECHHUB
As the digital landscape continually evolves, operating systems play a critical role in shaping user experiences and productivity. The launch of Nitrux Linux 3.5.0 marks a significant milestone, offering a robust alternative to traditional systems such as Windows 11. This article delves into the essence of Nitrux Linux 3.5.0, exploring its unique features, advantages, and how it stands as a compelling choice for both casual users and tech enthusiasts.
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...DanBrown980551
Do you want to learn how to model and simulate an electrical network from scratch in under an hour?
Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)!
During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook.
PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides:
- A fully editable and extendable library for grid component modelling;
- Visualization tools to display your network;
- Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses;
The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well.
What you will learn during the webinar:
- For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills;
- For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
Joomla is said to be one of the most popularly used Content Management Systems used worldwide. Most people are attracted towards Joomla is because of its $0 price tag.
Maruthi Prithivirajan, Head of ASEAN & IN Solution Architecture, Neo4j
Get an inside look at the latest Neo4j innovations that enable relationship-driven intelligence at scale. Learn more about the newest cloud integrations and product enhancements that make Neo4j an essential choice for developers building apps with interconnected data and generative AI.
How to Get CNIC Information System with Paksim Ga.pptxdanishmna97
Pakdata Cf is a groundbreaking system designed to streamline and facilitate access to CNIC information. This innovative platform leverages advanced technology to provide users with efficient and secure access to their CNIC details.
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!SOFTTECHHUB
As the digital landscape continually evolves, operating systems play a critical role in shaping user experiences and productivity. The launch of Nitrux Linux 3.5.0 marks a significant milestone, offering a robust alternative to traditional systems such as Windows 11. This article delves into the essence of Nitrux Linux 3.5.0, exploring its unique features, advantages, and how it stands as a compelling choice for both casual users and tech enthusiasts.
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...DanBrown980551
Do you want to learn how to model and simulate an electrical network from scratch in under an hour?
Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)!
During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook.
PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides:
- A fully editable and extendable library for grid component modelling;
- Visualization tools to display your network;
- Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses;
The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well.
What you will learn during the webinar:
- For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills;
- For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AIVladimir Iglovikov, Ph.D.
Presented by Vladimir Iglovikov:
- https://www.linkedin.com/in/iglovikov/
- https://x.com/viglovikov
- https://www.instagram.com/ternaus/
This presentation delves into the journey of Albumentations.ai, a highly successful open-source library for data augmentation.
Created out of a necessity for superior performance in Kaggle competitions, Albumentations has grown to become a widely used tool among data scientists and machine learning practitioners.
This case study covers various aspects, including:
People: The contributors and community that have supported Albumentations.
Metrics: The success indicators such as downloads, daily active users, GitHub stars, and financial contributions.
Challenges: The hurdles in monetizing open-source projects and measuring user engagement.
Development Practices: Best practices for creating, maintaining, and scaling open-source libraries, including code hygiene, CI/CD, and fast iteration.
Community Building: Strategies for making adoption easy, iterating quickly, and fostering a vibrant, engaged community.
Marketing: Both online and offline marketing tactics, focusing on real, impactful interactions and collaborations.
Mental Health: Maintaining balance and not feeling pressured by user demands.
Key insights include the importance of automation, making the adoption process seamless, and leveraging offline interactions for marketing. The presentation also emphasizes the need for continuous small improvements and building a friendly, inclusive community that contributes to the project's growth.
Vladimir Iglovikov brings his extensive experience as a Kaggle Grandmaster, ex-Staff ML Engineer at Lyft, sharing valuable lessons and practical advice for anyone looking to enhance the adoption of their open-source projects.
Explore more about Albumentations and join the community at:
GitHub: https://github.com/albumentations-team/albumentations
Website: https://albumentations.ai/
LinkedIn: https://www.linkedin.com/company/100504475
Twitter: https://x.com/albumentations
DevOps and Testing slides at DASA ConnectKari Kakkonen
My and Rik Marselis slides at 30.5.2024 DASA Connect conference. We discuss about what is testing, then what is agile testing and finally what is Testing in DevOps. Finally we had lovely workshop with the participants trying to find out different ways to think about quality and testing in different parts of the DevOps infinity loop.
Epistemic Interaction - tuning interfaces to provide information for AI supportAlan Dix
Paper presented at SYNERGY workshop at AVI 2024, Genoa, Italy. 3rd June 2024
https://alandix.com/academic/papers/synergy2024-epistemic/
As machine learning integrates deeper into human-computer interactions, the concept of epistemic interaction emerges, aiming to refine these interactions to enhance system adaptability. This approach encourages minor, intentional adjustments in user behaviour to enrich the data available for system learning. This paper introduces epistemic interaction within the context of human-system communication, illustrating how deliberate interaction design can improve system understanding and adaptation. Through concrete examples, we demonstrate the potential of epistemic interaction to significantly advance human-computer interaction by leveraging intuitive human communication strategies to inform system design and functionality, offering a novel pathway for enriching user-system engagements.
Removing Uninteresting Bytes in Software FuzzingAftab Hussain
Imagine a world where software fuzzing, the process of mutating bytes in test seeds to uncover hidden and erroneous program behaviors, becomes faster and more effective. A lot depends on the initial seeds, which can significantly dictate the trajectory of a fuzzing campaign, particularly in terms of how long it takes to uncover interesting behaviour in your code. We introduce DIAR, a technique designed to speedup fuzzing campaigns by pinpointing and eliminating those uninteresting bytes in the seeds. Picture this: instead of wasting valuable resources on meaningless mutations in large, bloated seeds, DIAR removes the unnecessary bytes, streamlining the entire process.
In this work, we equipped AFL, a popular fuzzer, with DIAR and examined two critical Linux libraries -- Libxml's xmllint, a tool for parsing xml documents, and Binutil's readelf, an essential debugging and security analysis command-line tool used to display detailed information about ELF (Executable and Linkable Format). Our preliminary results show that AFL+DIAR does not only discover new paths more quickly but also achieves higher coverage overall. This work thus showcases how starting with lean and optimized seeds can lead to faster, more comprehensive fuzzing campaigns -- and DIAR helps you find such seeds.
- These are slides of the talk given at IEEE International Conference on Software Testing Verification and Validation Workshop, ICSTW 2022.
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Albert Hoitingh
In this session I delve into the encryption technology used in Microsoft 365 and Microsoft Purview. Including the concepts of Customer Key and Double Key Encryption.
Communications Mining Series - Zero to Hero - Session 1DianaGray10
This session provides introduction to UiPath Communication Mining, importance and platform overview. You will acquire a good understand of the phases in Communication Mining as we go over the platform with you. Topics covered:
• Communication Mining Overview
• Why is it important?
• How can it help today’s business and the benefits
• Phases in Communication Mining
• Demo on Platform overview
• Q/A
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdfPaige Cruz
Monitoring and observability aren’t traditionally found in software curriculums and many of us cobble this knowledge together from whatever vendor or ecosystem we were first introduced to and whatever is a part of your current company’s observability stack.
While the dev and ops silo continues to crumble….many organizations still relegate monitoring & observability as the purview of ops, infra and SRE teams. This is a mistake - achieving a highly observable system requires collaboration up and down the stack.
I, a former op, would like to extend an invitation to all application developers to join the observability party will share these foundational concepts to build on:
The Art of the Pitch: WordPress Relationships and SalesLaura Byrne
Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes?
All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.
The Art of the Pitch: WordPress Relationships and Sales
Developer guide
1. AntiSamy User Guide
This document was prepared by Julian Cohen and generously donated to the OWASP AntiSamy project. It introduces the
project to unfamiliar users and describes how to get, configure and use AntiSamy in your application.
May 11, 20100
1. Introduction
AntiSamy is an HTML, CSS and JavaScript filter for Java that sanitizes user input based on a policy file. AntiSamy is not an
HTML, CSS and JavaScript validator. It is merely a way to make sure HTML, CSS and JavaScript input strictly follows rules
defined by a policy file. The project’s main site and repository are shown here:
http://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project
http://code.google.com/p/owaspantisamy/
AntiSamy does a very good job of removing malicious HTML, CSS and JavaScript, but in security, no solution is
guaranteed. AntiSamy’s success depends on the strictness of your policy file and the predictability of browsers’
behavior. AntiSamy is a sanitization framework; it is up to the user how it does its sanitization. Using AntiSamy does not
guarantee filtering of all malicious code. AntiSamy simply does what is described by the policy file.
AntiSamy is simple from an external view. AntiSamy’s function is based on an XML policy file. The policy file is read in to
create a Policy object that is used by AntiSamy. The Policy object is then passed to AntiSamy to be used in the parsing
and filtering of input. AntiSamy uses the third party libraries Xerces, Batik and NekoHTML to help facilitate parsing and
filtering of input.
2. 2. Setting Up
Download the current AntiSamy jar file from http://code.google.com/p/owaspantisamy/downloads/list or from Maven’s
central repo (under org.owasp.antisamy). These are the dependencies that you will need to satisfy. These are all also
available in Maven’s central repo, or can be downloaded from the locations specified:
xercesImpl.jar http://xerces.apache.org/mirrors.cgi#binary
batik.jar http://xmlgraphics.apache.org/batik/download.cgi
nekohtml.jar http://sourceforge.net/projects/nekohtml/
Once all these jars are in your classpath, you’re ready to start using AntiSamy. A code snippet invoking AntiSamy is
broken down in the next section.
import org.owasp.validator.html.*; // Import AntiSamy
Here, all necessary AntiSamy objects are imported to be used.
String POLICY_FILE_LOCATION = "antisamy-1.4.1.xml"; // Path to policy file
String dirtyInput = "<div><script>alert(1);</script></div>"; // Some fake input
In this step, the path to the XML policy file was declared, and some fake, possibly malicious, data was stored as our user
input.
Policy policy = Policy.getInstance(POLICY_FILE_LOCATION); // Create Policy object
The Policy object was created and populated from the XML policy file in this line. Policy objects can also be read from
InputStreams or File objects directly.
AntiSamy as = new AntiSamy(); // Create AntiSamy object
CleanResults cr = as.scan(dirtyInput, policy, AntiSamy.SAX); // Scan dirtyInput
Here, an AntiSamy object was created and used to sanitize user input based on the Policy object with the SAX parser.
System.out.println(cr.getCleanHTML()); // Do something with your clean output!
The output from AntiSamy was written to the console. As is shown in the “Output”, script tag was removed:
Input:
<div><script>alert(1);</script></div>
Output:
<div></div>
A large part of getting a Cross Site Scripting attack to execute is context. An attacker injecting JavaScript inside a tag
would use a different payload than if they were injecting JavaScript inside an attribute. This is what is meant my
“context.” When AntiSamy filters your input, context plays a major role in if that filtered output is going to be malicious
or not. To avoid anything exceedingly complicated, AntiSamy assumes that all filtered output will be placed in between
a start and end tag.
3. Each line from this code snippet shows whether or not it’s safe to place AntiSamy into a particular HTML context. If
AntiSamy data is used in any other context than what’s shown it’s safe to assume that it’s being used unsafely.
<div>[SAFE]</div>
<input type="text" value="[UNSAFE]">
<textarea>[UNSAFE]</textarea>
<script>var j = '[UNSAFE]';</script>
For more on this distinction, see the following OWASP AntiSamy mailing list threads [1] [2] and the OWASP XSS
Prevention Cheat Sheet.
[1] https://lists.owasp.org/pipermail/owasp-antisamy/2009-October/000263.html
[2] https://lists.owasp.org/pipermail/owasp-antisamy/2011-May/000400.html
[3] https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
4. 3. Policy Files
AntiSamy comes with several example policy files based on the function of real-world websites. You can use these as
your policy files, or build upon them to create more specific policies.
When starting out with AntiSamy, you’ll probably want to start off with a base policy file. However, sometimes it may
be difficult to decide which policy file to start with. The following table breaks down the various default policy files that
ship with AntiSamy:
Policy Description
antisamy-tinymce.xml Based on the HTML WYSIWYG editor, relatively safe. This policy file only allows
text formatting, and may be a good choice if users are submitting HTML to be used
in a blog post.
antisamy-anythinggoes.xml A very dangerous policy file, this will allow all HTML, CSS and JavaScript. You
shouldn’t use this in production.
antisamy-ebay.xml Based on the content filtering for the popular electronic auction website,
relatively safe. This policy file gives the user a little bit of freedom, and may be
a good choice if users are submitting HTML for a large portion of a page.
antisamy-myspace.xml Based on the content filtering for the popular social networking site, relatively
dangerous. This policy file gives the user a lot of freedom, and may be a good
choice if users are submitting HTML for an entire page.
antisamy-slashdot.xml Based on the comment filtering on the popular news site, but not quite as strict.
This policy file only allows strict text formatting, and may be a good choice if
users are submitting HTML in a comment thread.
antisamy.xml Default policy file, fairly permissive. This policy file allows most HTML
elements, and may be useful if users are submitting full HTML pages.
Configuring Your AntiSamy Policy
If a base policy file doesn’t meet your needs, you can tweak your policy file to your needs. Each section of the policy file
is broken down in the next few sections to give the developer background on tweaking the output.
Policy File Directives [<directives></directives>]
The following table shows the directives, their default values, and their impact on the AntiSamy filtering process.
Directive Type Default Description
useXHTML boolean false When this feature is on, AntiSamy will output the sanitized
data in XHTML format as opposed to just regular HTML.
omitXMLDeclaration boolean true When "omitXMLDeclaration" is turned on, AntiSamy will
automatically prepend the XML header to output.
Enabling this feature will tell AntiSamy not to do that.
omitDoctypeDeclaration boolean true When this feature is enabled, AntiSamy will automatically
prepend the HTML doctype declaration. By default,
AntiSamy will not prepend this header.
formatOutput boolean true When enabled, AntiSamy will automatically format the
output according to some basic rules and indentation.
Kind of like "pretty print."
maxInputSize int 100000 This directive specifies the maximum size (in bytes) of
user input before it's validated.
embedStyleSheets boolean false When the developer chooses to allow CSS, this directive
5. will specify whether or not remote stylesheets found
referenced in the user's input will be pulled down and
embedded into the current user input.
maxStyleSheetImports int 1 This feature allows developers to specify how many
remote stylesheets can be downloaded from any one
input.
connectionTimeout int 1000 When "embedStyleSheets" is enabled, this timeout value
(in milliseconds) will be used when fetching the offsite
resource in question. This should be used to prevent
validation threads from blocking when connecting to 3rd
party systems that may purposefully act really, really
slowly.
preserveComments boolean false When enabled, AntiSamy will keep HTML comments
supplied in the input.
nofollowAnchors boolean false When enabled, AntiSamy will append rel="nofollow"
attributes to all anchor (<a>) tags supplied in the input.
This is useful for telling search engines not to associate
your site with sites that are under the control of your
users.
validateParamAsEmbed boolean false When enabled, AntiSamy will treat attributes of <embed>
tags in the policy the same as any <param> tags nested
inside the the <embed>. This allows users to, according to
policy, pass in data in either of those two methods with
equal security. This is needed for sites that allow users to
supply videos, etc.
preserveSpace boolean false When enabled, this feature is intended to preserve spaces
as specified in the input without normalization. Right now
it only works as according
to http://xerces.apache.org/xerces-
j/apiDocs/org/apache/xml/serialize/OutputFormat.html#setP
reserveSpace%28boolean%29.
onUnknownTag String remove When this directive is set to "encode," it will encode the
tag using HTML entities, instead of removing the tag,
which is the default behavior.
Common Regular Expressions [<common-regexps> </common-regexps>]
You can declare regular expressions here that can be used in the rest of the Policy File. Example:
<regexp name="htmlId" value="[a-zA-Z0-9:-_.]+"/>
Line 51 in antisamy-1.4.1.xml
This regular expression is used to determine whether text in an id attribute is valid or not.
Common Attributes [<common-attributes> </common-attributes>]
Here you can declare attributes here that are common to many different tags. Example:
<attribute name="id" description="The 'id' of any HTML attribute should not contain
anything besides letters and numbers">
<regexp-list>
<regexp name="htmlId"/>
</regexp-list>
</attribute>
Lines 145-149 in antisamy-1.4.1.xml
6. This is where the id attribute is mapped to the htmlId regular expression.
Global Tag Attributes [<global-tag-attributes> </global-tag-attributes>]
You can declare attributes here that are global to all different tags. Example:
<attribute name="id"/>
Line 496 in antisamy-1.4.1.xml
The id attribute is global to many different tags.
Tags to Encode [<tags-to-encode> </tags-to-encode>]
You can declare tags here that will not be removed, filtered, validated or truncated, but encoded using HTML entities.
Example:
<tag>g</tag>
Line 505 in antisamy-1.4.1.xml
The g tag doesn’t actually do anything, but it isn’t malicious either so we can encode it, rather than remove it.
Tag Rules [<tag-rules> </tag-rules>]
You can define parsing rules here that will be used for each tag individually. The following section shows what happens
to tags according to what actions AntiSamy has decided to perform on it. This will help understand how to build your
own tag-rules rules.
Default: Behavior when the tag is not listed in <tag-rules>
Input:
<div><anewtag id="newtag" anewattrib="attrib">Text goes
<b>here</b>.</anewtag></div>
Output:
<div>Text goes <b>here</b>.</div>
remove: Behavior when the tag-rule action is set to “remove” for given tag. Tag is deleted with all of its child text.
Input:
<div><anewtag id="newtag" anewattrib="attrib">Text goes
<b>here</b>.</anewtag></div>
Output:
<div></div>
filter: Behavior when the tag-rule action is set to “filter” for given tag. Delete tag, but keep its child text.
Input:
<div><anewtag id="newtag" anewattrib="attrib">Text goes
<b>here</b>.</anewtag></div>
Output:
<div>Text goes <b>here</b>.</div>
validate: Behavior when the tag-rule action is set to “validate” for given tag. Verify that its attributes and children
elements follow rules defined in policy file.
Input:
<div><anewtag id="newtag" anewattrib="attrib">Text goes
<b>here</b>.</anewtag></div>
7. Output:
<div><anewtag id="newtag">Text goes <b>here</b>.</anewtag></div>
truncate: Behavior when the tag-rule action is set to “validate” for given tag . Keep the element, but remove all
attributes.
Input:
<div><anewtag id="newtag" anewattrib="attrib">Text goes
<b>here</b>.</anewtag></div>
Output:
<div><anewtag>Text goes <b>here</b>.</anewtag></div>
Example:
<tag name="html" action="validate"/>
Line 513 in antisamy-1.4.1.xml
The html tag is included in the clean output after it has been validated that it has been properly used.
CSS Rules [<css-rules> </css-rules>]
You can define parsing rules here that will be used for each CSS property individually. Only CSS defined in this section is
allowed. Example:
<property name="width" default="auto" description="">
<category-list>
<category value="visual"/>
</category-list>
<literal-list>
<literal value="auto"/>
<literal value="inherit"/>
</literal-list>
<regexp-list>
<regexp name="length"/>
<regexp name="percentage"/>
</regexp-list>
</property>
Lines 2096-2108 in antisamy-1.4.1.xml
The CSS width property is allowed only when it matches these rules when used. The value of the width element must
be a length, percentage or one of the two literal values “auto” or “inherit”.
8. 4. References
The following references may be useful for further reading.
OWASP AntiSamy Project Page
http://www.owasp.org/index.php/AntiSamy
AntiSamy Policy File Directives Documentation (old)
http://www.owasp.org/index.php?title=AntiSamy_Directives&oldid=71778
AntiSamy OWASP Project Assessment Checklist
http://spreadsheets.google.com/ccc?key=pAX6n7m2zaTW-JtGBqixbTw
AntiSamy Mailing List Archives
https://lists.owasp.org/pipermail/owasp-antisamy/
XSS (Cross Site Scripting) Prevention Cheat Sheet
http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet