Using The OWASP AntiSamy 1.5.7 Project With ColdFusion 10 To Sanitize HTML Input And Help Prevent XSS Attacks

<?xml version="1.0" encoding="UTF-8" ?>
<anti-samy-rules
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:noNamespaceSchemaLocation="antisamy.xsd">

	<directives>
		<directive name="embedStyleSheets" value="false" />
		<directive name="formatOutput" value="true" />
		<directive name="maxInputSize" value="100000" />
		<directive name="nofollowAnchors" value="true" />
		<directive name="omitDoctypeDeclaration" value="true" />
		<directive name="omitXmlDeclaration" value="true" />
		<directive name="onUnknownTag" value="remove" />
		<directive name="useXHTML" value="true" />
	</directives>

	<tag-rules>
		<tag name="a" action="validate">
			<attribute name="href" onInvalid="filterTag">
				<regexp-list>
					<regexp value="https?://[A-Za-z0-9]+[~a-zA-Z0-9-_\.@\#\$%&amp;;:,\?=/\+!\(\)]*" />
				</regexp-list>
			</attribute>

			<attribute name="rel">
				<literal-list>
					<literal value="nofollow" />
				</literal-list>
			</attribute>
		</tag>
		<tag name="b" action="validate" />
		<tag name="blockquote" action="validate" />
		<tag name="code" action="validate">
			<attribute name="class">
				<regexp-list>
					<regexp value="language-[a-zA-Z0-9]+" />
				</regexp-list>
			</attribute>
		</tag>
		<tag name="em" action="validate" />
		<tag name="i" action="validate" />
		<tag name="li" action="validate" />
		<tag name="ol" action="validate" />
		<tag name="p" action="validate" />
		<tag name="pre" action="validate">
			<attribute name="class">
				<regexp-list>
					<regexp value="language-[a-zA-Z0-9]+" />
				</regexp-list>
			</attribute>
		</tag>
		<tag name="strong" action="validate" />
		<tag name="ul" action="validate" />
	</tag-rules>

</anti-samy-rules>

component
	output = false
	hint = "I provide the application settings and event handlers."
	{

	// Define the application.
	this.name = hash( getCurrentTemplatePath() );
	this.applicationTimeout = createTimeSpan( 0, 0, 10, 0 );
	this.sessionManagement = false;

	// Setup the mappings
	this.directory = getDirectoryFromPath( getCurrentTemplatePath() );
	this.mappings[ "/" ] = this.directory;
	this.mappings[ "/antisamy" ] = ( this.directory & "vendor/antisamy-1.5.7/" );
	this.mappings[ "/javaloader" ] = ( this.directory & "vendor/javaloader-1.2/javaloader/" );
	this.mappings[ "/javaloaderfactory" ] = ( this.directory & "vendor/javaloaderfactory/" );

	// ---
	// PUBLIC METHODS.
	// ---

	/**
	* I initialize the application.
	*
	* @output false
	*/
	public boolean function onApplicationStart() {

		// In order to prevent memory leaks, we're going to use the JavaLoaderFactory to
		// instantiate our JavaLoader. This will keep the instance cached in the Server
		// scope so that it doesn't have to continually re-create it as we test our
		// application configuration.
		application.javaLoaderFactory = new javaloaderfactory.JavaLoaderFactory();

		// Create a JavaLoader that can access the AntiSamy 1.5.7 JAR files.
		// --
		// CAUTION: The directory has MORE JAR FILES than are actually necessary to run
		// the demo. However, I just downloaded all the non-optional dependencies
		// according to the MAVEN resource pages. I don't actually know enough about Java
		// to know which libraries I can and cannot exclude from the JavaLoader. I have
		// commented-out the ones that were not supplied by the "JAR Download" website.
		application.antisamyJavaLoader = application.javaLoaderFactory.getJavaLoader([
			expandPath( "/antisamy/antisamy-1.5.7.jar" ),
			// expandPath( "/antisamy/avalon-framework-4.1.3.jar" ),
			// expandPath( "/antisamy/avalon-framework-4.1.5.jar" ),
			expandPath( "/antisamy/batik-constants-1.9.1.jar" ),
			expandPath( "/antisamy/batik-css-1.9.1.jar" ),
			expandPath( "/antisamy/batik-i18n-1.9.1.jar" ),
			expandPath( "/antisamy/batik-util-1.9.1.jar" ),
			expandPath( "/antisamy/commons-codec-1.6.jar" ),
			expandPath( "/antisamy/commons-io-1.3.1.jar" ),
			// expandPath( "/antisamy/commons-logging-1.0.4.jar" ),
			expandPath( "/antisamy/commons-logging-1.1.3.jar" ),
			expandPath( "/antisamy/httpclient-4.3.6.jar" ),
			expandPath( "/antisamy/httpcore-4.3.3.jar" ),
			// expandPath( "/antisamy/log4j-1.2.17.jar" ),
			// expandPath( "/antisamy/logkit-1.0.1.jar" ),
			expandPath( "/antisamy/nekohtml-1.9.22.jar" ),
			expandPath( "/antisamy/xercesImpl-2.11.0.jar" ),
			expandPath( "/antisamy/xml-apis-1.4.01.jar" ),
			expandPath( "/antisamy/xml-apis-ext-1.3.04.jar" ),
			// expandPath( "/antisamy/xml-resolver-1.2.jar" ),
			expandPath( "/antisamy/xmlgraphics-commons-2.2.jar" )
		]);

		// Indicate that the application has been initialized successfully.
		return( true );

	}

}

<!--- Setup our untrusted HTML content. --->
<cfsavecontent variable="unsafeHtml">

	<p>
		Check out
		<a href="https://www.bennadel.com" onmousedown="alert( 'XSS!' )">my site</a>.
	</p>

	<marquee loop="-1" width="100%">
		I am very trustable! You can totes trust me!
	</marquee>

	<p>
		<strong>Thanks for stopping by!</strong> <em>You Rock!</em>
		<blink>Woot!</blink>
	</p>

</cfsavecontent>

<!--- ------------------------------------------------------------------------------ --->
<!--- ------------------------------------------------------------------------------ --->

<cfscript>

	// Create our AntiSamy instance.
	// --
	// NOTE: We would probably cache this in the Application scope. Or, more likely,
	// inside a proxy Component that handles all of the intricate interaction details
	// for us so that we don't have know about all the junk below.
	antisamy = application.antisamyJavaLoader.create( "org.owasp.validator.html.AntiSamy" ).init();

	// Create our security policy from the given XML file. This policy determines what
	// tags and attributes will be allowed in the sanitized HTML; and, about how AntiSamy
	// will treat invalid tags that it comes across.
	// --
	// NOTE: We would probably cache this so that we don't have re-read it every time.
	// --
	// Read More: https://www.wavemaker.com/learn/app-development/app-security/xss-antisamy-policy-configuration/
	policy = application.antisamyJavaLoader.switchThreadContextClassLoader(
		getInstance__inProperContext,
		{
			PolicyClass: application.antisamyJavaLoader.create( "org.owasp.validator.html.Policy" ),
			policyFilePath: expandPath( "./demo-policy.xml" )
		}
	);

	// Scan the untrusted HTML. The results will contain both error messages and the
	// sanitized HTML output.
	result = antisamy.scan( javaCast( "string", unsafeHtml ), policy );

	writeOutput( encodeForHtml( result.getCleanHTML() ));
	writeOutput( "<hr />" );
	writeDump( result.getErrorMessages() );

	// ------------------------------------------------------------------------------- //
	// ------------------------------------------------------------------------------- //

	/**
	* I am intended to be INVOKED BY THE JAVALOADER. I run the getInstance() method in a
	* context that forces the classes to be loaded from the AntiSamy JavaLoader. This
	* gets around issues in which Java classes try to load dependencies from the wrong
	* Class Loader.
	*
	* NOTE: While in this method, you cannot access the core ColdFusion classes. As such,
	* this method should do AS LITTLE AS POSSIBLE such that it can return to the normal
	* execution context as fast as possible.
	*
	* @PolicyClass I am the Policy class provided by AntiSamy.
	* @policyFilePath I am the path to our security policy XML file.
	* @output false
	*/
	public any function getInstance__inProperContext(
		required any PolicyClass,
		required string policyFilePath
		) {

		return( PolicyClass.getInstance( javaCast( "string", policyFilePath ) ) );

	}

</cfscript>