Skip to content

Commit 7ea6673

Browse files
mikesamuelmikesamuel
committed
fixed links in docs
1 parent f9074d0 commit 7ea6673

7 files changed

+39
-31
lines changed

‎README.md

+7-7
Original file line numberDiff line numberDiff line change
@@ -9,20 +9,20 @@ are only needed by the test suite. The JSR 305 dependency is a
99
compile-only dependency, only needed for annotations.
1010

1111
This code was written with security best practices in mind, has an
12-
extensive test suite, and has undergone [adversarial security review](AttackReviewGroundRules).
12+
extensive test suite, and has undergone [adversarial security review](tree/master/docs/attack_review_ground_rules.md).
1313

1414
----
1515

16-
[Getting Started](GettingStarted) includes instructions on how to get started with or without Maven.
16+
[Getting Started](tree/master/docs/getting_started.md) includes instructions on how to get started with or without Maven.
1717

18-
You can use [prepackaged policies](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/org/owasp/html/Sanitizers.html):
18+
You can use [prepackaged policies](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/org/owasp/html/Sanitizers.html):
1919

2020
```Java
2121
PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
2222
String safeHTML = policy.sanitize(untrustedHTML);
2323
```
2424

25-
or the [tests](http://code.google.com/p/owasp-java-html-sanitizer/source/browse/trunk/src/tests/org/owasp/html/HtmlPolicyBuilderTest.java) show how to configure your own [policy](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/org/owasp/html/HtmlPolicyBuilder.html):
25+
or the [tests](https://github.com/OWASP/java-html-sanitizer/tree/master/src/tests/org/owasp/html/HtmlPolicyBuilderTest.java) show how to configure your own [policy](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/org/owasp/html/HtmlPolicyBuilder.html):
2626

2727
```Java
2828
PolicyFactory policy = new HtmlPolicyBuilder()
@@ -34,7 +34,7 @@ PolicyFactory policy = new HtmlPolicyBuilder()
3434
String safeHTML = policy.sanitize(untrustedHTML);
3535
```
3636

37-
or you can write [custom policies](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/org/owasp/html/ElementPolicy.html) to do things like changing `h1`s to `div`s with a certain class:
37+
or you can write [custom policies](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/org/owasp/html/ElementPolicy.html) to do things like changing `h1`s to `div`s with a certain class:
3838

3939
```Java
4040
PolicyFactory policy = new HtmlPolicyBuilder()
@@ -53,8 +53,8 @@ String safeHTML = policy.sanitize(untrustedHTML);
5353

5454
----
5555

56-
Subscribe to the [mailing list](http://groups.google.com/group/owasp-java-html-sanitizer-support) to be notified of known [Vulnerabilities](Vulnerabilities). If you wish to report a vulnerability, please see [AttackReviewGroundRules](AttackReviewGroundRules).
56+
Subscribe to the [mailing list](http://groups.google.com/group/owasp-java-html-sanitizer-support) to be notified of known [Vulnerabilities](tree/master/docs/vulnerabilities.md). If you wish to report a vulnerability, please see [AttackReviewGroundRules](tree/master/docs/attack_review_ground_rules.md).
5757

5858
----
5959

60-
[Thanks to everyone who has helped with criticism and code](Credits)
60+
[Thanks to everyone who has helped with criticism and code](tree/master/docs/credits.md)

‎docs/attack_review_ground_rules.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
# Attack Review Ground Rules
55

6-
Please take a look at [http://canyouxssthis.com/HTMLSanitizer](http://canyouxssthis.com/HTMLSanitizer). That page includes a form that allows you to try out attacks against a sanitizer that implements the AntiSAMY [Ebay policy example](http://code.google.com/p/owasp-java-html-sanitizer/source/browse/trunk/src/main/org/owasp/html/examples/EbayPolicyExample.java).
6+
Please take a look at [http://canyouxssthis.com/HTMLSanitizer](http://canyouxssthis.com/HTMLSanitizer). That page includes a form that allows you to try out attacks against a sanitizer that implements the AntiSAMY [Ebay policy example](https://github.com/OWASP/java-html-sanitizer/tree/master/src/main/org/owasp/html/examples/EbayPolicyExample.java).
77

88
Enter an attack payload in that form, and it will be reflected back to you. For example, if you enter `<b>Hello</b>, <i>World!</i>` you should see "**Hello**, _World!_" upon submitting the form. If you want to see the actual HTML produced, just view source.
99

@@ -25,10 +25,10 @@ If you are the first to provide me with a payload that does any of the following
2525

2626
This is not an exhaustive list and creative attacks are welcome.
2727

28-
If you find the web interface cumbersome, feel free to download and test the sanitizer directly. See [GettingStarted](GettingStarted) for instructions.
28+
If you find the web interface cumbersome, feel free to download and test the sanitizer directly. See [GettingStarted](getting_started.md) for instructions.
2929

3030
## Reporting Vulnerabilities
31-
Please report successful attacks with example input via [the issue tracker](http://code.google.com/p/owasp-java-html-sanitizer/issues/entry).
31+
Please report successful attacks with example input via [the issue tracker](https://github.com/OWASP/java-html-sanitizer/issues/new).
3232

3333
If you believe the issue might affect production systems, please file the issue with the label `Private`.
3434

‎docs/cve20114457.md

+16-8
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,27 @@
33

44
#CVE-2011-4457
55

6-
A vulnerability in the [OWASP HTML Sanitizer](http://code.google.com/p/owasp-java-html-sanitizer/)
6+
A vulnerability in the
7+
[OWASP HTML Sanitizer](https://github.com/OWASP/java-html-sanitizer)
8+
79
allows redirecting or POSTing to an arbitrary URL when the user
810
interacts with sanitized content and when JavaScript is disabled.
911

10-
It also allows inclusion of links without "[rel=nofollow](http://microformats.org/wiki/rel-nofollow)" when JavaScript is disabled.
11-
Crawlers that respect `nofollow` and which look for links inside `<noscript>...</noscript>` could conclude a containing page has link-spam.
12+
It also allows inclusion of links without
13+
"[rel=nofollow](http://microformats.org/wiki/rel-nofollow)" when
14+
JavaScript is disabled.
15+
16+
Crawlers that respect `nofollow` and which look for links inside
17+
`<noscript>...</noscript>` could conclude a containing page has
18+
link-spam.
1219

1320
Due to the constrained circumstances and the fact that it does not
1421
allow exfiltration of data protected by the same-origin policy it is
1522
considered low risk. For policies that allow external links, the
1623
escalation of privilege only includes POSTing, possibly including
1724
upload of files chosen by the user.
1825

19-
We recommend upgrading to [release 88](http://code.google.com/p/owasp-java-html-sanitizer/source/detail?r=88) or later available via
20-
[downloads](http://code.google.com/p/owasp-java-html-sanitizer/downloads/list)
26+
We recommend upgrading to release 88 or later available
2127
which does not break API compatibility with the previous release.
2228

2329
The project CHANGE log is available at
@@ -36,7 +42,9 @@ The attack hinges on the way `<noscript>` was parsed and rendered.
3642
</noscript>
3743
```
3844

39-
will POST `x=y` to `http://evil.org/` when the submit button is pressed
40-
and when the user has javascript turned off as when running the NoScript extension.
45+
will POST `x=y` to `http://evil.org/` when the submit button is
46+
pressed and when the user has javascript turned off as when running
47+
the NoScript extension.
4148

42-
The POST will carry user credentials so a vulnerable page can be used to initiate XSRF against vulnerable servers.
49+
The POST will carry user credentials so a vulnerable page can be used
50+
to initiate XSRF against vulnerable servers.

‎docs/getting_started.md

+8-8
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@
55

66
## Getting the JARs
77

8-
If you are using Maven then follow the [maven](Maven) directions to add a dependency. Otherwise, [download prebuilt jars](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/lib/) or [checkout](http://code.google.com/p/owasp-java-html-sanitizer/source/checkout) and build the latest source.
8+
If you are using Maven then follow the [maven](maven.md) directions to add a dependency. Otherwise, [download prebuilt jars](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/lib/) or [checkout](git@github.com:OWASP/java-html-sanitizer.git) and build the latest source.
99

10-
Unless maven is managing your [CLASSPATH](http://download.oracle.com/javase/1.3/docs/tooldocs/win32/classpath.html) for you, you need to add both `owasp-java-html-sanitizer.jar` and the Guava JAR.
10+
Unless maven is managing your [CLASSPATH](http://download.oracle.com//javase/1.3/docs/tooldocs/win32/classpath.html) for you, you need to add both `owasp-java-html-sanitizer.jar` and the Guava JAR.
1111

1212
Once you have your CLASSPATH set up correctly with the relevant JARs you should be able to add
1313

@@ -19,18 +19,18 @@ to one of your project's `.java` files and compile it.
1919

2020
## Using the APIs
2121

22-
The [examples](http://code.google.com/p/owasp-java-html-sanitizer/source/browse/trunk/#trunk%2Fsrc%2Fmain%2Forg%2Fowasp%2Fhtml%2Fexamples) include source code which defines a sanitization policy, and applies it to HTML.
22+
The [examples](https://github.com/OWASP/java-html-sanitizer/tree/master/#trunk%2Fsrc%2Fmain%2Forg%2Fowasp%2Fhtml%2Fexamples) include source code which defines a sanitization policy, and applies it to HTML.
2323

24-
The [javadoc](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/index.html) covers more detailed topics, including [customization](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/org/owasp/html/HtmlPolicyBuilder.html).
24+
The [javadoc](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/index.html) covers more detailed topics, including [customization](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/org/owasp/html/HtmlPolicyBuilder.html).
2525

2626
Important classes are:
2727

28-
* [Sanitizers](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
29-
* [HtmlPolicyBuilder](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
28+
* [Sanitizers](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
29+
* [HtmlPolicyBuilder](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
3030

3131
For advanced use, see:
32-
* [AttributePolicy](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/org/owasp/html/ElementPolicy.html) allow complex customization.
33-
* [HtmlStreamEventReceiver](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
32+
* [AttributePolicy](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/org/owasp/html/AttributePolicy.html) and [ElementPolicy](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/org/owasp/html/ElementPolicy.html) allow complex customization.
33+
* [HtmlStreamEventReceiver](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
3434

3535
## Asking Questions
3636

‎docs/maven.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ Including among your POMs `<dependencies>` this snippet of XML
1717

1818
will make the sanitizer available.
1919

20-
Be sure to change the [version](http://docs.codehaus.org/display/MAVEN/Dependency+Mediation+and+Conflict+Resolution#DependencyMediationandConflictResolution-DependencyVersionRanges) to a range suitable to your project. There are no unstable releases in maven. Bigger numbers are more recent and the [change log](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/CHANGE_LOG.html) can shed light on the salient differences.
20+
Be sure to change the [version](http://docs.codehaus.org/display/MAVEN/Dependency+Mediation+and+Conflict+Resolution#DependencyMediationandConflictResolution-DependencyVersionRanges) to a range suitable to your project. There are no unstable releases in maven. Bigger numbers are more recent and the [change log](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/CHANGE_LOG.html) can shed light on the salient differences.
2121

22-
You should be able to build with the HTML sanitizer. You can peruse the [javadoc](http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/distrib/javadoc/index.html), and if you have questions that aren't answered by these wiki pages, you can ask on the [mailing list](http://groups.google.com/group/owasp-java-html-sanitizer-support).
22+
You should be able to build with the HTML sanitizer. You can peruse the [javadoc](https://rawgit.com/OWASP/java-html-sanitizer/tree/master/distrib/javadoc/index.html), and if you have questions that aren't answered by these wiki pages, you can ask on the [mailing list](http://groups.google.com/group/owasp-java-html-sanitizer-support).
2323

2424
Happy sanitizing...

‎docs/side_bar.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
* [GettingStarted](GettingStarted)
2-
* [Maven](Maven)
1+
* [GettingStarted](getting_started.md)
2+
* [Maven](maven.md)

‎docs/vulnerabilities.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@
33

44
## Known & public vulnerabilities in this project
55

6-
* [CVE-2011-4457](CVE20114457) - 17 Nov. 2011 - Recommend upgrade to r88 or later.
6+
* [CVE-2011-4457](cve20114457.md) - 17 Nov. 2011 - Recommend upgrade to r88 or later.

0 commit comments

Comments
 (0)