Skip to content

Deprecations for 1.8.0 #602

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
spassarop wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Deprecations for 1.8.0 #602

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7c3042c
Remove all code related to CSS style imports
spassarop Aug 17, 2025
cb41f40
Add deprecated annotations on AntiSamyDOMScanner
spassarop Aug 17, 2025
3919471
Refactor code style with maven `site`
spassarop Aug 17, 2025
0494b8f
Add more deprecation annotations for DOM
spassarop Aug 17, 2025
f1ffa6c
Merge branch 'main' into deprecations-for-1.8.0
spassarop Dec 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 0 additions & 22 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,28 +96,6 @@
<artifactId>commons-io</artifactId>
<version>2.21.0</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.client5</groupId>
<artifactId>httpclient5</artifactId>
<version>5.5.1</version>
<exclusions>
<!-- exclude this old version as we directly import a newer one -->
<exclusion>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
</exclusion>
<!-- exclude this slightly older version as we directly import a newer one -->
<exclusion>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5</artifactId>
<version>5.3.6</version>
</dependency>
<dependency>
<groupId>org.apache.xmlgraphics</groupId>
<artifactId>batik-css</artifactId>
Expand Down
112 changes: 11 additions & 101 deletions src/main/java/org/owasp/validator/css/CssHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,11 +28,8 @@
*/
package org.owasp.validator.css;

import java.net.URI;
import java.net.URISyntaxException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.LinkedList;
import java.util.List;
import java.util.Objects;
import java.util.ResourceBundle;
Expand Down Expand Up @@ -82,9 +79,6 @@ public class CssHandler implements DocumentHandler {
/** The error message bundle to pull from. */
private ResourceBundle messages;

/** A queue of imported stylesheets; used to track imported stylesheets */
private final LinkedList<URI> importedStyleSheets;

/** The tag currently being examined (if any); used for inline stylesheet error messages */
private final String tagName;

Expand All @@ -102,12 +96,15 @@ public class CssHandler implements DocumentHandler {

private MediaState mediaState = MediaState.OUTSIDE;

private enum MediaState {INSIDE, OUTSIDE, DENIED}
private enum MediaState {
INSIDE,
OUTSIDE,
DENIED
}

/**
* Constructs a handler for stylesheets using the given policy. The List of embedded stylesheets
* produced by this constructor is now available via the getImportedStylesheetsURIList() method.
* This constructor to be used when there is no tag name associated with this inline style.
* Constructs a handler for stylesheets using the given policy. This constructor to be used when
* there is no tag name associated with this inline style.
*
* @param policy the policy to use
* @param errorMessages the List of error messages to add error messages too if there are errors
Expand All @@ -118,8 +115,7 @@ public CssHandler(Policy policy, List<String> errorMessages, ResourceBundle mess
}

/**
* Constructs a handler for stylesheets using the given policy. The List of embedded stylesheets
* produced by this constructor is available via the getImportedStylesheetsURIList() method.
* Constructs a handler for stylesheets using the given policy.
*
* @param policy the policy to use
* @param errorMessages the List of error messages to add error messages too if there are errors
Expand All @@ -133,9 +129,6 @@ public CssHandler(
this.errorMessages = errorMessages;
this.messages = messages;
this.validator = new CssValidator(policy);
// Create a queue of all style sheets that need to be validated to
// account for any sheets that may be imported by the current CSS
this.importedStyleSheets = new LinkedList<URI>();
this.tagName = tagName;
this.isInline = (tagName != null);
}
Expand All @@ -150,20 +143,6 @@ public String getCleanStylesheet() {
return styleSheet.toString();
}

/**
* Returns a list of imported stylesheets from the main parsed stylesheet.
*
* @return the import stylesheet URI list.
*/
public LinkedList<URI> getImportedStylesheetsURIList() {
return importedStyleSheets;
}

/** Empties the stylesheet buffer. */
public void emptyStyleSheet() {
styleSheet.delete(0, styleSheet.length());
}

/**
* Returns the error messages generated during parsing, if any. Note: the lack of error messages
* does not mean the HTML input being sanitized can be considered safe.
Expand Down Expand Up @@ -224,77 +203,7 @@ public void ignorableAtRule(String atRule) throws CSSException {
@Override
public void importStyle(String uri, SACMediaList media, String defaultNamespaceURI)
throws CSSException {

/* The ability to import remote styles is deprecated and will be removed in a future
* release. When that is done this method will simply generate the following error
* message and return.
*/

if (!policy.isEmbedStyleSheets()) {
errorMessages.add(
ErrorMessageUtil.getMessage(
messages, ErrorMessageUtil.ERROR_CSS_IMPORT_DISABLED, new Object[] {}));
return;
}

try {
// check for non-nullness (validate after canonicalization)
if (uri == null) {
errorMessages.add(
ErrorMessageUtil.getMessage(
messages, ErrorMessageUtil.ERROR_CSS_IMPORT_URL_INVALID, new Object[] {}));
return;
}

URI importedStyleSheet = new URI(uri);

// canonicalize the URI
importedStyleSheet.normalize();

// validate the URL

if (!policy.getCommonRegularExpressions("offsiteURL").matches(importedStyleSheet.toString())
&& !policy
.getCommonRegularExpressions("onsiteURL")
.matches(importedStyleSheet.toString())) {
errorMessages.add(
ErrorMessageUtil.getMessage(
messages,
ErrorMessageUtil.ERROR_CSS_IMPORT_URL_INVALID,
new Object[] {HTMLEntityEncoder.htmlEntityEncode(uri)}));
return;
}

if (!importedStyleSheet.isAbsolute()) {
// we have no concept of relative reference for free form text as an end user can't know
// where the corresponding free form will end up
if (tagName != null) {
errorMessages.add(
ErrorMessageUtil.getMessage(
messages,
ErrorMessageUtil.ERROR_CSS_TAG_RELATIVE,
new Object[] {
HTMLEntityEncoder.htmlEntityEncode(tagName),
HTMLEntityEncoder.htmlEntityEncode(uri)
}));
} else {
errorMessages.add(
ErrorMessageUtil.getMessage(
messages,
ErrorMessageUtil.ERROR_STYLESHEET_RELATIVE,
new Object[] {HTMLEntityEncoder.htmlEntityEncode(uri)}));
}
return;
}

importedStyleSheets.add(importedStyleSheet);
} catch (URISyntaxException use) {
errorMessages.add(
ErrorMessageUtil.getMessage(
messages,
ErrorMessageUtil.ERROR_CSS_IMPORT_URL_INVALID,
new Object[] {HTMLEntityEncoder.htmlEntityEncode(uri)}));
}
// no-op, left due to interface implementation requirement
}

/*
Expand Down Expand Up @@ -547,7 +456,8 @@ public void startMedia(SACMediaList media) throws CSSException {
}
styleSheet.append(query.getMediaType());
for (CssMediaFeature feature : query.getMediaFeatures()) {
if (feature == query.getMediaFeatures().get(0) && Objects.equals(query.getMediaType(), "")) {
if (feature == query.getMediaFeatures().get(0)
&& Objects.equals(query.getMediaType(), "")) {
styleSheet.append("(");
} else {
styleSheet.append(" and (");
Expand Down
6 changes: 4 additions & 2 deletions src/main/java/org/owasp/validator/css/CssParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,8 @@ protected CSSSACMediaList parseMediaList() {
}

private boolean hasAnotherMediaQuery() {
return current == LexicalUnits.COMMA || (current == LexicalUnits.IDENTIFIER && scanner.getStringValue().equals(OR.toString()));
return current == LexicalUnits.COMMA
|| (current == LexicalUnits.IDENTIFIER && scanner.getStringValue().equals(OR.toString()));
}

protected CssMediaQuery parseMediaQuery() {
Expand Down Expand Up @@ -165,7 +166,8 @@ protected CssMediaQuery parseMediaQuery() {
query.addMediaFeature(parseMediaFeature());
}

while (current == LexicalUnits.IDENTIFIER && CssMediaQueryLogicalOperator.parse(scanner.getStringValue()) == AND) {
while (current == LexicalUnits.IDENTIFIER
&& CssMediaQueryLogicalOperator.parse(scanner.getStringValue()) == AND) {
nextIgnoreSpaces();
query.addMediaFeature(parseMediaFeature());
}
Expand Down
Loading