private RE regularExpressionLT;
private RE regularExpressionGT;
+ private RE regularExpressionWhitespace;
public MirBasicProducerAssistantLocalizer() throws MirLocalizerFailure {
- try{
- regularExpressionLT = new RE("<");
- regularExpressionGT = new RE(">");
- }
- catch (Throwable t) {
- throw new MirLocalizerFailure(t);
- }
+ try{
+ regularExpressionLT = new RE("<");
+ regularExpressionGT = new RE(">");
+ regularExpressionWhitespace = new RE("\\s+");
+ }
+ catch (Throwable t) {
+ throw new MirLocalizerFailure(t);
+ }
}
public void initializeGenerationValueSet(Map aValueSet) throws MirLocalizerExc, MirLocalizerFailure {
}
}
- private String[] badAttributes = {"onload","onclick","onfocus","onblur","onmouseover","onmouseout","style","height","width"};
+
+ private String[] badAttributeValuePrefixes= {"javascript","vbscript","about","wysiwyg","data","view-source","ms-its","mhtml","shell","lynxexec","lynxcgi","hcp","ms-help","help","disk","vnd.ms.radio","opera","res","resource","chrome","mocha","livescript"};
+
+
+ private String[] badAttributes = {"onabort", "onblur", "onchange", "onclick", "ondblclick", "onerror", "onfocus", "onkeydown", "onKeypress", "onkeyup", "onload", "onmousedown", "onmousemove", "onmouseout", "onmouseover", "onmouseup", "onreset", "onselect", "onsubmit", "onunload","onload","onclick","onfocus","onblur","style","height","width"};
private boolean isBadAttr(String attrName){
- for (int i=0;i<badAttributes.length;i++){
- if (badAttributes[i].toLowerCase().equals(attrName.toLowerCase()))
- return true;
+ for (int i=0;i<badAttributes.length;i++){
+ if (badAttributes[i].toLowerCase().equals(attrName.toLowerCase()))
+ return true;
}
- return false;
- }
+ return false;
+ }
+
+ private String stripWhitespace(String aString){
+ try{
+ return regularExpressionWhitespace.substituteAll(aString, "");
+ }
+ catch (Throwable t){
+ return "";
+ }
+ }
private boolean checkAttr(String attrName) {
if (isBadAttr(attrName)){
}
private boolean checkAttrValue(String attrValue) {
- if (attrValue.toLowerCase().startsWith("javascript:")){
+ for (int i=0;i<badAttributeValuePrefixes.length;i++){
+ if ((stripWhitespace(attrValue.toLowerCase())).startsWith(badAttributeValuePrefixes[i].toLowerCase()+":")){
return false;
+ }
}
return true;
-
}