Hi Gunnar, I had an idea today for a new validation constraint called @WebSafe - in summary what it would do is validate a rich text value provided by the user to ensure that it contains no malicious code, such as embedded <script> elements. The implementation for this would use JTidy to convert the value to a DOM tree, after which it would walk the nodes of the tree and locate any <script> tags, and if any are present the validation would fail. Anyway, the implementation isn't so important - what I was wondering though is whether you think something like this would be useful to have in the Seam Validation module. I tend to think that it would be (and we can probably come up with quite a few other useful validation constraints also) but I would like to know what you think about this. Shane _______________________________________________ seam-dev mailing list seam-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/seam-dev

Sure, if you think it's suitable.  Seam Validation is based on HV anyways. On 10/06/11 18:32, Emmanuel Bernard wrote: > > Why not in Hibernate Validator? > > On 10 juin 2011, at 10:02, Shane Bryzak wrote: > >> Hi Gunnar, >> >> I had an idea today for a new validation constraint called @WebSafe - in >> summary what it would do is validate a rich text value provided by the >> user to ensure that it contains no malicious code, such as embedded >> <script>  elements.  The implementation for this would use JTidy to >> convert the value to a DOM tree, after which it would walk the nodes of >> the tree and locate any<script>  tags, and if any are present the >> validation would fail. >> >> Anyway, the implementation isn't so important - what I was wondering >> though is whether you think something like this would be useful to have >> in the Seam Validation module.  I tend to think that it would be (and we >> can probably come up with quite a few other useful validation >> constraints also) but I would like to know what you think about this. >> >> Shane >> _______________________________________________ >> seam-dev mailing list >> seam-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/seam-dev

I'm not totally sure what the right place for it would be, though. The constraints we have in HV so far are independent from any application layer. @WebSafe would be the first one specific to the web layer.

Maybe it would also be a good idea to have a separate library exclusively for custom constraints which could be used from everywhere ("HV Commons" or similar).

We already have a CR for 4.2. If we decide to add @WebSafe to HV do you think we should add this in 4.2 or to the next release?

Hi all, Answers inline. Le dimanche 12 juin 2011 à 20:22, Hardy Ferentschik a écrit : Hi all, nice to see some new constraints :-) Some more thoughts inline On Sun, 12 Jun 2011 12:31:14 +0200, Gunnar Morling <gunnar.morling(a)googlemail.com&gt; wrote: I'm not totally sure what the right place for it would be, though. The constraints we have in HV so far are independent from any application layer. @WebSafe would be the first one specific to the web layer. IMO this is validator is not really application layer dependent, even thought this is obviously where it will be most useful. Personally I would find something like SafeHtml better than @WebSafe. It would also tie the constraints less to a layer. IMO it also communicates its purpose better. +1 I think that renaming the annotation will better communicates its purpose. WebSafe is general, SafeHtml sounds good to me. Maybe it would also be a good idea to have a separate library exclusively for custom constraints which could be used from everywhere ("HV Commons" or similar). I think it is to early think about a new module/library. As said, I don't see this constraints necessarily tied to a layer and without at least a couple of concrete layer specific constraints I think we should wait. > I'm not sure to understand. Why a new module could be created? We already have a CR for 4.2. If we decide to add @WebSafe to HV do you think we should add this in 4.2 or to the next release? My initial feeling is to wait for the next release, but I don't feel to strongly about this. However, -1 for a new library/module and +1 for a rename of the constraint. --Hardy Like Hardy my initial feeling is to wait for the next release but the pull request is opened and it will not be very hard to integrate it in master :-) I've no strong opinion about this. --Kevin

There is an issue though: Whitelists are created through the use of Whiltelist class itself. It´s hard to extend this class (and meaningless). The best would be to specify  a WhilelistFactory class . What do u think ? Regards, George 2011/6/13 Gunnar Morling <gunnar.morling(a)googlemail.com&gt;: > +1 for renaming the constraint to @SafeHtml. > > Apart from that the pull request looks good to me and IMO we can > include it in 4.2. The change doesn't modify anything of the HV > internals, so there is no big risk about it. > > -- Gunnar > > 2011/6/13 Kevin Pollet <pollet.kevin(a)gmail.com&gt;: >> Hi all, >> Answers inline. >> >> Le dimanche 12 juin 2011 à 20:22, Hardy Ferentschik a écrit : >> >> Hi all, >> >> nice to see some new constraints :-) >> Some more thoughts inline >> >> On Sun, 12 Jun 2011 12:31:14 +0200, Gunnar Morling >> <gunnar.morling(a)googlemail.com&gt; wrote: >> >> I'm not totally sure what the right place for it would be, though. The >> constraints we have in HV so far are independent from any application >> layer. @WebSafe would be the first one specific to the web layer. >> >> IMO this is validator is not really application layer dependent, even >> thought this is >> obviously where it will be most useful. Personally I would find something >> like SafeHtml >> better than @WebSafe. It would also tie the constraints less to a layer. >> IMO it also communicates >> its purpose better. >> >> +1 >> I think that renaming the annotation will better communicates its purpose. >> WebSafe is general, SafeHtml sounds good to me. >> >> >> Maybe it would also be a good idea to have a separate library >> exclusively for custom constraints which could be used from everywhere >> ("HV Commons" or similar). >> >> I think it is to early think about a new module/library. As said, I don't >> see this constraints >> necessarily tied to a layer and without at least a couple of concrete >> layer specific constraints I >> think we should wait. >>> >> >> I'm not sure to understand. >> Why a new module could be created? >> >> >> We already have a CR for 4.2. If we decide to add @WebSafe to HV do >> you think we should add this in 4.2 or to the next release? >> >> My initial feeling is to wait for the next release, but I don't feel to >> strongly about this. >> However, -1 for a new library/module and +1 for a rename of the constraint. >> >> --Hardy >> >> Like Hardy my initial feeling is to wait for the next release but the pull >> request is >> opened and it will not be very hard to integrate it in master :-) I've >> no strong >> opinion about this. >> >> --Kevin >

I would just allow the user to specify a list of tags for the custom option.. i.e @SafeHtml(whitelist = custom, tags = ["b", "span", "pre", "div", "table", "tr", "td"]) etc. On 14/06/11 07:22, George Gastaldi wrote: > > There is an issue though: Whitelists are created through the use of > Whiltelist class itself. It´s hard to extend this class (and > meaningless). > The best would be to specify  a WhilelistFactory class . > > What do u think ? > > Regards, > > George > > > 2011/6/13 Gunnar Morling&lt;gunnar.morling(a)googlemail.com&gt;: >> >> +1 for renaming the constraint to @SafeHtml. >> >> Apart from that the pull request looks good to me and IMO we can >> include it in 4.2. The change doesn't modify anything of the HV >> internals, so there is no big risk about it. >> >> -- Gunnar >> >> 2011/6/13 Kevin Pollet&lt;pollet.kevin(a)gmail.com&gt;: >>> >>> Hi all, >>> Answers inline. >>> >>> Le dimanche 12 juin 2011 à 20:22, Hardy Ferentschik a écrit : >>> >>> Hi all, >>> >>> nice to see some new constraints :-) >>> Some more thoughts inline >>> >>> On Sun, 12 Jun 2011 12:31:14 +0200, Gunnar Morling >>> <gunnar.morling(a)googlemail.com&gt;  wrote: >>> >>> I'm not totally sure what the right place for it would be, though. The >>> constraints we have in HV so far are independent from any application >>> layer. @WebSafe would be the first one specific to the web layer. >>> >>> IMO this is validator is not really application layer dependent, even >>> thought this is >>> obviously where it will be most useful. Personally I would find >>> something >>> like SafeHtml >>> better than @WebSafe. It would also tie the constraints less to a layer. >>> IMO it also communicates >>> its purpose better. >>> >>> +1 >>> I think that renaming the annotation will better communicates its >>> purpose. >>> WebSafe is general, SafeHtml sounds good to me. >>> >>> >>> Maybe it would also be a good idea to have a separate library >>> exclusively for custom constraints which could be used from everywhere >>> ("HV Commons" or similar). >>> >>> I think it is to early think about a new module/library. As said, I >>> don't >>> see this constraints >>> necessarily tied to a layer and without at least a couple of concrete >>> layer specific constraints I >>> think we should wait. >>> I'm not sure to understand. >>> Why a new module could be created? >>> >>> >>> We already have a CR for 4.2. If we decide to add @WebSafe to HV do >>> you think we should add this in 4.2 or to the next release? >>> >>> My initial feeling is to wait for the next release, but I don't feel to >>> strongly about this. >>> However, -1 for a new library/module and +1 for a rename of the >>> constraint. >>> >>> --Hardy >>> >>> Like Hardy my initial feeling is to wait for the next release but the >>> pull >>> request is >>> opened and it will not be very hard to integrate it in master :-) I've >>> no strong >>> opinion about this. >>> >>> --Kevin