java - Hibernate Validator @SafeHtml 不允许自定义 HTML 标签和属性

Question

我有一个基于 Java 的后端，我在其中使用 Hibernate 进行一些更具体的 bean 验证，即:@SafeHtml。它可以很好地满足我 99% 的需求，但是，我有一个部分允许用户输入基本的 HTML 来创建他们自己的页眉/页脚。因此，我需要在这里放宽限制。

出于某种原因，我的代码中有些地方不对。我收到 400 错误请求。我真的很感激任何帮助。提前致谢!

HTML:

 <table bgcolor="navy" cellpadding="0" cellspacing="0" border="0" height="60" width="600" style="border-collapse:collapse;">
    <tr>
      <td>
          <div style="display:none;font-size:1px;line-height:1px;max-height:0px;max-width:0px;opacity:0;overflow:hidden;mso-hide:all;font-family: sans-serif;">
          </div>
          <table align="left" width="600" class="email-container" cellpadding="0" cellspacing="0" border="0">
            <tr>
              <td style="padding: 20px 10px;width: 100%;font-size: 12px; mso-height-rule: exactly; line-height:14px; text-align: center; color: #CCCCCC;">
                © HELLO WORLD All rights reserved - <a href="https://www.someUrl" style="color: #CCCCCC" target="new" rel="noopener noreferrer">Privacy Policy GK</a>
              </td>
            </tr>
          </table>
      </td>
    </tr>
  </table>


Java:

    @SafeHtml(whitelistType = SafeHtml.WhiteListType.RELAXED,
            additionalTags = {"html", "tr", "body", "b", "i", "table", "td", "center", "div", "a", "img", "font"},
            additionalTagsWithAttributes = {
                    //@SafeHtml.Tag(name = "a", attributesWithProtocols = @SafeHtml.Attribute(name = "href", protocols = "#")),
                    @SafeHtml.Tag(name = "a", attributes = {"href"}),
                    @SafeHtml.Tag(name = "body", attributes = {"bgcolor", "width", "style"}),
                    @SafeHtml.Tag(name = "table", attributes = {"align", "bgcolor", "cellpadding", "cellspacing", "border", "height", "width", "style", "color", "class"}),
                    @SafeHtml.Tag(name = "td", attributes = {"style", "align", "bgcolor"}),
                    @SafeHtml.Tag(name = "font", attributes = {"face"}),
                    @SafeHtml.Tag(name = "img", attributes = {"src", "width", "height", "alt", "border"}),
                    @SafeHtml.Tag(name = ":all", attributes = {"style", "dir", "checked", "class", "id", "target", "title", "type"})
            })

Answer 1

您不允许在“a”中使用“rel”。试试看:

@SafeHtml.Tag(name = "a", attributes = {"href", "rel"}),

它会起作用。

完整测试源:

package org.example;

import static org.junit.Assert.assertTrue;

import org.hibernate.validator.constraints.SafeHtml;
import org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator;
import org.junit.Test;

@SafeHtml(whitelistType = SafeHtml.WhiteListType.RELAXED,
        additionalTags = {"html", "tr", "body", "b", "i", "table", "td", "center", "div", "a", "img", "font"},
        additionalTagsWithAttributes = {
                //@SafeHtml.Tag(name = "a", attributesWithProtocols = @SafeHtml.Attribute(name = "href", protocols = "#")),
                @SafeHtml.Tag(name = "a", attributes = {"href", "rel"}),
                @SafeHtml.Tag(name = "body", attributes = {"bgcolor", "width", "style"}),
                @SafeHtml.Tag(name = "table", attributes = {"align", "bgcolor", "cellpadding", "cellspacing", "border", "height", "width", "style", "color", "class"}),
                @SafeHtml.Tag(name = "td", attributes = {"style", "align", "bgcolor"}),
                @SafeHtml.Tag(name = "font", attributes = {"face"}),
                @SafeHtml.Tag(name = "img", attributes = {"src", "width", "height", "alt", "border"}),
                @SafeHtml.Tag(name = ":all", attributes = {"style", "dir", "checked", "class", "id", "target", "title", "type"})
        })
public class Q60122842Test
{
    @Test
    public void isValid()
    {
        String value = " <table bgcolor=\"navy\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" height=\"60\" width=\"600\" style=\"border-collapse:collapse;\">\n" +
                "    <tr>\n" +
                "      <td>\n" +
                "          <div style=\"display:none;font-size:1px;line-height:1px;max-height:0px;max-width:0px;opacity:0;overflow:hidden;mso-hide:all;font-family: sans-serif;\">\n" +
                "          </div>\n" +
                "          <table align=\"left\" width=\"600\" class=\"email-container\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\">\n" +
                "            <tr>\n" +
                "              <td style=\"padding: 20px 10px;width: 100%;font-size: 12px; mso-height-rule: exactly; line-height:14px; text-align: center; color: #CCCCCC;\">\n" +
                "                © HELLO WORLD All rights reserved - <a href=\"https://www.someUrl\" style=\"color: #CCCCCC\" target=\"new\" rel=\"noopener noreferrer\">Privacy Policy GK</a>\n" +
                "              </td>\n" +
                "            </tr>\n" +
                "          </table>\n" +
                "      </td>\n" +
                "    </tr>\n" +
                "  </table>";

        SafeHtml annotation = Q60122842Test.class.getAnnotation(SafeHtml.class);
        SafeHtmlValidator validator = new SafeHtmlValidator();
        validator.initialize( annotation );
        assertTrue(validator.isValid(value, null));
    }
}