... i think i found a way to bypass ....

[wurtzelsepp]

if you are trying

"><img src=a onerror=alert(1)>

and put it in as parameter
antiSamy.scan ( parameter, policy, AntiSamy.SAX ).getCleanHTML ();

you will get ><img src=a onerror=alert(1)> and so an alert popping up.... even if img Tags are set to remove.

[davewichers]

I end up with this output:

""><img src=a onerror=alert(1)>"

Which is safe/expected. Now if you then pass that to another interpreter which decodes it again, then something bad can happen of course.

Can you confirm the encoded values above are what you actually get? And you agree this safe/expected behavior?

[davewichers]

@wurtzelsepp As we can't replicate this, we are closing this for now. But please provide additional details if you still think this is an issue.