From 73b68bc56bed63974eaf9170174f813862ca1ec0 Mon Sep 17 00:00:00 2001
From: Sebastian Uecker <sebastian.uecker@forum-is.de>
Date: Fri, 9 Oct 2015 15:48:03 +0200
Subject: [PATCH 01/28] +Added HtmlPolicyBuilder methods for excluding elements
 with specific missing or emtpy attributes +Removed
 AutoCloseableHtmlStreamRenderer for Java SE 6 compatibility

---
 .../org/owasp/html/HtmlPolicyBuilder.java     | 1377 +++++++++--------
 .../org/owasp/html/HtmlStreamRenderer.java    |   22 -
 2 files changed, 715 insertions(+), 684 deletions(-)

diff --git a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
index d7a6ea76..683ca5c2 100644
--- a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
+++ b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
@@ -43,7 +43,6 @@
 import com.google.common.collect.Maps;
 import com.google.common.collect.Sets;
 
-
 /**
  * Conveniences for configuring policies for the {@link HtmlSanitizer}.
  *
@@ -54,39 +53,36 @@
  * processing modes; and finally call <code>build(renderer)</code> or
  * <code>toFactory()</code>.
  * </p>
+ * 
  * <pre class="prettyprint lang-java">
  * // Define the policy.
- * Function&lt;HtmlStreamEventReceiver, HtmlSanitizer.Policy&gt; policy
- *     = new HtmlPolicyBuilder()
- *         .allowElements("a", "p")
- *         .allowAttributes("href").onElements("a")
- *         .toFactory();
- *
+ * Function&lt;HtmlStreamEventReceiver, HtmlSanitizer.Policy&gt; policy = new HtmlPolicyBuilder()
+ * 		.allowElements(&quot;a&quot;, &quot;p&quot;).allowAttributes(&quot;href&quot;).onElements(&quot;a&quot;)
+ * 		.toFactory();
+ * 
  * // Sanitize your output.
  * HtmlSanitizer.sanitize(myHtml, policy.apply(myHtmlStreamRenderer));
  * </pre>
  *
  * <h3>Embedded Content</h3>
  * <p>
- * Embedded URLs are filtered by
- * {@link HtmlPolicyBuilder#allowUrlProtocols protocol}.
- * There is a {@link HtmlPolicyBuilder#allowStandardUrlProtocols canned policy}
- * so you can easily white-list widely used policies that don't violate the
- * current pages origin.  See "Customization" below for ways to do further
- * filtering.  If you allow links it might be worthwhile to
+ * Embedded URLs are filtered by {@link HtmlPolicyBuilder#allowUrlProtocols
+ * protocol}. There is a {@link HtmlPolicyBuilder#allowStandardUrlProtocols
+ * canned policy} so you can easily white-list widely used policies that don't
+ * violate the current pages origin. See "Customization" below for ways to do
+ * further filtering. If you allow links it might be worthwhile to
  * {@link HtmlPolicyBuilder#requireRelNofollowOnLinks() require}
  * {@code rel=nofollow}.
  * </p>
  * <p>
- * This class simply throws out all embedded JS.
- * Use a custom element or attribute policy to allow through
- * signed or otherwise known-safe code.
- * Check out the Caja project if you need a way to contain third-party JS.
+ * This class simply throws out all embedded JS. Use a custom element or
+ * attribute policy to allow through signed or otherwise known-safe code. Check
+ * out the Caja project if you need a way to contain third-party JS.
  * </p>
  * <p>
- * This class does not attempt to faithfully parse and sanitize CSS.
- * It does provide {@link HtmlPolicyBuilder#allowStyling() one} styling option
- * that allows through a few CSS properties that allow textual styling, but that
+ * This class does not attempt to faithfully parse and sanitize CSS. It does
+ * provide {@link HtmlPolicyBuilder#allowStyling() one} styling option that
+ * allows through a few CSS properties that allow textual styling, but that
  * disallow image loading, history stealing, layout breaking, code execution,
  * etc.
  * </p>
@@ -94,51 +90,44 @@
  * <h3>Customization</h3>
  * <p>
  * You can easily do custom processing on tags and attributes by supplying your
- * own {@link ElementPolicy element policy} or
- * {@link AttributePolicy attribute policy} when calling
- * <code>allow&hellip;</code>.
- * E.g. to convert headers into {@code <div>}s, you could use an element policy
+ * own {@link ElementPolicy element policy} or {@link AttributePolicy attribute
+ * policy} when calling <code>allow&hellip;</code>. E.g. to convert headers into
+ * {@code <div>}s, you could use an element policy
  * </p>
+ * 
  * <pre class="prettyprint lang-java">
- * new HtmlPolicyBuilder()
- *   .allowElement(
- *     new ElementPolicy() {
- *       public String apply(String elementName, List&lt;String&gt; attributes){
- *         attributes.add("class");
- *         attributes.add("header-" + elementName);
- *         return "div";
- *       }
- *     },
- *     "h1", "h2", "h3", "h4", "h5", "h6")
- *   .build(outputChannel)
+ * new HtmlPolicyBuilder().allowElement(new ElementPolicy() {
+ * 	public String apply(String elementName, List&lt;String&gt; attributes) {
+ * 		attributes.add(&quot;class&quot;);
+ * 		attributes.add(&quot;header-&quot; + elementName);
+ * 		return &quot;div&quot;;
+ * 	}
+ * }, &quot;h1&quot;, &quot;h2&quot;, &quot;h3&quot;, &quot;h4&quot;, &quot;h5&quot;, &quot;h6&quot;).build(outputChannel)
  * </pre>
  *
  * <h3>Rules of Thumb</h3>
  * <p>
  * Throughout this class, several rules hold:
  * <ul>
- *   <li>Everything is denied by default.  There are
- *     <code>disallow&hellip;</code> methods, but those reverse
- *     allows instead of rolling back overly permissive defaults.
- *   <li>The order of allows and disallows does not matter.
- *     Disallows trump allows whether they occur before or after them.
- *     The only method that needs to be called in a particular place is
- *     {@link HtmlPolicyBuilder#build}.
- *     Allows or disallows after {@code build} is called have no
- *     effect on the already built policy.
- *   <li>Element and attribute policies are applied in the following order:
- *     element specific attribute policy, global attribute policy, element
- *     policy.
- *     Element policies come last so they can observe all the post-processed
- *     attributes, and so they can add attributes that are exempt from
- *     attribute policies.
- *     Element specific policies go first, so they can normalize content to
- *     a form that might be acceptable to a more simplistic global policy.
+ * <li>Everything is denied by default. There are <code>disallow&hellip;</code>
+ * methods, but those reverse allows instead of rolling back overly permissive
+ * defaults.
+ * <li>The order of allows and disallows does not matter. Disallows trump allows
+ * whether they occur before or after them. The only method that needs to be
+ * called in a particular place is {@link HtmlPolicyBuilder#build}. Allows or
+ * disallows after {@code build} is called have no effect on the already built
+ * policy.
+ * <li>Element and attribute policies are applied in the following order:
+ * element specific attribute policy, global attribute policy, element policy.
+ * Element policies come last so they can observe all the post-processed
+ * attributes, and so they can add attributes that are exempt from attribute
+ * policies. Element specific policies go first, so they can normalize content
+ * to a form that might be acceptable to a more simplistic global policy.
  * </ul>
  *
  * <h3>Thread safety and efficiency</h3>
  * <p>
- * This class is not thread-safe.  The resulting policy will not violate its
+ * This class is not thread-safe. The resulting policy will not violate its
  * security guarantees as a result of race conditions, but is not thread safe
  * because it maintains state to track whether text inside disallowed elements
  * should be suppressed.
@@ -153,613 +142,677 @@
 @TCB
 @NotThreadSafe
 public class HtmlPolicyBuilder {
-  /**
-   * The default set of elements that are removed if they have no attributes.
-   * Since {@code <img>} is in this set, by default, a policy will remove
-   * {@code <img src=javascript:alert(1337)>} because its URL is not allowed
-   * and it has no other attributes that would warrant it appearing in the
-   * output.
-   */
-  public static final ImmutableSet<String> DEFAULT_SKIP_IF_EMPTY
-      = ImmutableSet.of("a", "font", "img", "input", "span");
-
-  private final Map<String, ElementPolicy> elPolicies = Maps.newLinkedHashMap();
-  private final Map<String, Map<String, AttributePolicy>> attrPolicies
-      = Maps.newLinkedHashMap();
-  private final Map<String, AttributePolicy> globalAttrPolicies
-      = Maps.newLinkedHashMap();
-  private final Set<String> allowedProtocols = Sets.newLinkedHashSet();
-  private final Set<String> skipIfEmpty = Sets.newLinkedHashSet(
-      DEFAULT_SKIP_IF_EMPTY);
-  private final Map<String, Boolean> textContainers = Maps.newLinkedHashMap();
-  private boolean requireRelNofollowOnLinks;
-
-  /**
-   * Allows the named elements.
-   */
-  public HtmlPolicyBuilder allowElements(String... elementNames) {
-    return allowElements(ElementPolicy.IDENTITY_ELEMENT_POLICY, elementNames);
-  }
-
-  /**
-   * Disallows the named elements.  Elements are disallowed by default, so
-   * there is no need to disallow elements, unless you are making an exception
-   * based on an earlier allow.
-   */
-  public HtmlPolicyBuilder disallowElements(String... elementNames) {
-    return allowElements(ElementPolicy.REJECT_ALL_ELEMENT_POLICY, elementNames);
-  }
-
-  /**
-   * Allow the given elements with the given policy.
-   *
-   * @param policy May remove or add attributes, change the element name, or
-   *    deny the element.
-   */
-  public HtmlPolicyBuilder allowElements(
-      ElementPolicy policy, String... elementNames) {
-    invalidateCompiledState();
-    for (String elementName : elementNames) {
-      elementName = HtmlLexer.canonicalName(elementName);
-      ElementPolicy newPolicy = ElementPolicy.Util.join(
-          elPolicies.get(elementName), policy);
-      // Don't remove if newPolicy is the always reject policy since we want
-      // that to infect later allowElement calls for this particular element
-      // name.  rejects should have higher priority than allows.
-      elPolicies.put(elementName, newPolicy);
-      if (!textContainers.containsKey(elementName)
-          && TagBalancingHtmlStreamEventReceiver
-              .allowsPlainTextualContent(elementName)) {
-        textContainers.put(elementName, true);
-      }
-    }
-    return this;
-  }
-
-  /**
-   * A canned policy that allows a number of common formatting elements.
-   */
-  public HtmlPolicyBuilder allowCommonInlineFormattingElements() {
-    return allowElements(
-        "b", "i", "font", "s", "u", "o", "sup", "sub", "ins", "del", "strong",
-        "strike", "tt", "code", "big", "small", "br", "span", "em");
-  }
-
-  /**
-   * A canned policy that allows a number of common block elements.
-   */
-  public HtmlPolicyBuilder allowCommonBlockElements() {
-    return allowElements(
-        "p", "div", "h1", "h2", "h3", "h4", "h5", "h6", "ul", "ol", "li",
-        "blockquote");
-  }
-
-  /**
-   * Allows text content in the named elements.
-   * By default, text content is allowed in any
-   * {@link #allowElements allowed elements} that can contain character data per
-   * the HTML5 spec, but text content is not allowed by default in elements that
-   * contain content of other kinds (like JavaScript in {@code <script>}
-   * elements.
-   * <p>
-   * To write a policy that whitelists {@code <script>} or {@code <style>}
-   * elements, first {@code allowTextIn("script")}.
-   */
-  public HtmlPolicyBuilder allowTextIn(String... elementNames) {
-    invalidateCompiledState();
-    for (String elementName : elementNames) {
-      elementName = HtmlLexer.canonicalName(elementName);
-      textContainers.put(elementName, true);
-    }
-    return this;
-  }
-
-  /**
-   * Disallows text in elements with the given name.
-   * <p>
-   * This is useful when an element contains text that is not meant to be
-   * displayed to the end-user.
-   * Typically these elements are styled {@code display:none} in browsers'
-   * default stylesheets, or, like {@code <template>} contain text nodes that
-   * are eventually for human consumption, but which are created in a separate
-   * document fragment.
-   */
-  public HtmlPolicyBuilder disallowTextIn(String... elementNames) {
-    invalidateCompiledState();
-    for (String elementName : elementNames) {
-      elementName = HtmlLexer.canonicalName(elementName);
-      textContainers.put(elementName, false);
-    }
-    return this;
-  }
-
-  /**
-   * Assuming the given elements are allowed, allows them to appear without
-   * attributes.
-   *
-   * @see #DEFAULT_SKIP_IF_EMPTY
-   * @see #disallowWithoutAttributes
-   */
-  public HtmlPolicyBuilder allowWithoutAttributes(String... elementNames) {
-    invalidateCompiledState();
-    for (String elementName : elementNames) {
-      elementName = HtmlLexer.canonicalName(elementName);
-      skipIfEmpty.remove(elementName);
-    }
-    return this;
-  }
-
-  /**
-   * Disallows the given elements from appearing without attributes.
-   *
-   * @see #DEFAULT_SKIP_IF_EMPTY
-   * @see #allowWithoutAttributes
-   */
-  public HtmlPolicyBuilder disallowWithoutAttributes(String... elementNames) {
-    invalidateCompiledState();
-    for (String elementName : elementNames) {
-      elementName = HtmlLexer.canonicalName(elementName);
-      skipIfEmpty.add(elementName);
-    }
-    return this;
-  }
-
-  /**
-   * Returns an object that lets you associate policies with the given
-   * attributes, and allow them globally or on specific elements.
-   */
-  public AttributeBuilder allowAttributes(String... attributeNames) {
-    ImmutableList.Builder<String> b = ImmutableList.builder();
-    for (String attributeName : attributeNames) {
-      b.add(HtmlLexer.canonicalName(attributeName));
-    }
-    return new AttributeBuilder(b.build());
-  }
-
-  /**
-   * Reverse an earlier attribute {@link #allowAttributes allow}.
-   * <p>
-   * For this to have an effect you must call at least one of
-   * {@link AttributeBuilder#globally} and {@link AttributeBuilder#onElements}.
-   * <p>
-   * Attributes are disallowed by default, so there is no need to call this
-   * with a laundry list of attribute/element pairs.
-   */
-  public AttributeBuilder disallowAttributes(String... attributeNames) {
-    return this.allowAttributes(attributeNames)
-        .matching(AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY);
-  }
-
-
-  private HtmlPolicyBuilder allowAttributesGlobally(
-      AttributePolicy policy, List<String> attributeNames) {
-    invalidateCompiledState();
-    for (String attributeName : attributeNames) {
-      // We reinterpret the identity policy later via policy joining since its
-      // the default passed from the policy-less method, but we don't do
-      // anything here since we don't know until build() is called whether the
-      // policy author wants to allow certain URL protocols or wants to deal
-      // with styles.
-      AttributePolicy oldPolicy = globalAttrPolicies.get(attributeName);
-      globalAttrPolicies.put(
-          attributeName, AttributePolicy.Util.join(oldPolicy, policy));
-    }
-    return this;
-  }
-
-  private HtmlPolicyBuilder allowAttributesOnElements(
-      AttributePolicy policy, List<String> attributeNames,
-      List<String> elementNames) {
-    invalidateCompiledState();
-    for (String elementName : elementNames) {
-      Map<String, AttributePolicy> policies = attrPolicies.get(elementName);
-      if (policies == null) {
-        policies = Maps.newLinkedHashMap();
-        attrPolicies.put(elementName, policies);
-      }
-      for (String attributeName : attributeNames) {
-        AttributePolicy oldPolicy = policies.get(attributeName);
-        policies.put(
-            attributeName,
-            AttributePolicy.Util.join(oldPolicy, policy));
-      }
-    }
-    return this;
-  }
-
-  /**
-   * Adds <a href="http://en.wikipedia.org/wiki/Nofollow"><code>rel=nofollow</code></a>
-   * to links.
-   */
-  public HtmlPolicyBuilder requireRelNofollowOnLinks() {
-    invalidateCompiledState();
-    this.requireRelNofollowOnLinks = true;
-    return this;
-  }
-
-  /**
-   * Adds to the set of protocols that are allowed in URL attributes.
-   * For each URL attribute that is allowed, we further constrain it by
-   * only allowing the value through if it specifies no protocol, or if it
-   * specifies one in the allowedProtocols white-list.
-   * This is done regardless of whether any protocols have been allowed, so
-   * allowing the attribute "href" globally with the identity policy but
-   * not white-listing any protocols, effectively disallows the "href"
-   * attribute globally.
-   * <p>
-   * Do not allow any <code>*script</code> such as <code>javascript</code>
-   * protocols if you might use this policy with untrusted code.
-   */
-  public HtmlPolicyBuilder allowUrlProtocols(String... protocols) {
-    invalidateCompiledState();
-    // If there is at least one allowed protocol, then allow URLs and
-    // add a filter that checks href and src values.
-
-    // Do not allow href and srcs through otherwise, and only allow on images
-    // and links.
-    for (String protocol : protocols) {
-      protocol = Strings.toLowerCase(protocol);
-      allowedProtocols.add(protocol);
-    }
-    return this;
-  }
-
-  /**
-   * Reverses a decision made by {@link #allowUrlProtocols}.
-   */
-  public HtmlPolicyBuilder disallowUrlProtocols(String... protocols) {
-    invalidateCompiledState();
-    for (String protocol : protocols) {
-      protocol = Strings.toLowerCase(protocol);
-      allowedProtocols.remove(protocol);
-    }
-    return this;
-  }
-
-  /**
-   * A canned URL protocol policy that allows <code>http</code>,
-   * <code>https</code>, and <code>mailto</code>.
-   */
-  public HtmlPolicyBuilder allowStandardUrlProtocols() {
-    return allowUrlProtocols("http", "https", "mailto");
-  }
-
-  /**
-   * Convert <code>style="&lt;CSS&gt;"</code> to sanitized CSS which allows
-   * color, font-size, type-face, and other styling using the default schema;
-   * but which does not allow content to escape its clipping context.
-   */
-  public HtmlPolicyBuilder allowStyling() {
-    allowStyling(CssSchema.DEFAULT);
-    return this;
-  }
-
-  /**
-   * Convert <code>style="&lt;CSS&gt;"</code> to sanitized CSS which allows
-   * color, font-size, type-face, and other styling using the given schema.
-   */
-  public HtmlPolicyBuilder allowStyling(CssSchema whitelist) {
-    invalidateCompiledState();
-    allowAttributesGlobally(
-        new StylingPolicy(whitelist), ImmutableList.of("style"));
-    return this;
-  }
-
-  /**
-   * Names of attributes from HTML 4 whose values are URLs.
-   * Other attributes, e.g. <code>style</code> may contain URLs even though
-   * there values are not URLs.
-   */
-  private static final Set<String> URL_ATTRIBUTE_NAMES = ImmutableSet.of(
-      "action", "archive", "background", "cite", "classid", "codebase", "data",
-      "dsync", "formaction", "href", "icon", "longdesc", "manifest", "poster",
-      "profile", "src", "srcset", "usemap");
-
-  /**
-   * Produces a policy based on the allow and disallow calls previously made.
-   *
-   * @param out receives calls to open only tags allowed by
-   *      previous calls to this object.
-   *      Typically a {@link HtmlStreamRenderer}.
-   */
-  public HtmlSanitizer.Policy build(HtmlStreamEventReceiver out) {
-    return toFactory().apply(out);
-  }
-
-  /**
-   * Produces a policy based on the allow and disallow calls previously made.
-   *
-   * @param out receives calls to open only tags allowed by
-   *      previous calls to this object.
-   *      Typically a {@link HtmlStreamRenderer}.
-   * @param listener is notified of dropped tags and attributes so that
-   *      intrusion detection systems can be alerted to questionable HTML.
-   *      If {@code null} then no notifications are sent.
-   * @param context if {@code (listener != null)} then the context value passed
-   *      with alerts.  This can be used to let the listener know from which
-   *      connection or request the questionable HTML was received.
-   */
-  public <CTX> HtmlSanitizer.Policy build(
-      HtmlStreamEventReceiver out,
-      @Nullable HtmlChangeListener<? super CTX> listener,
-      @Nullable CTX context) {
-    return toFactory().apply(out, listener, context);
-  }
-
-  /**
-   * Like {@link #build} but can be reused to create many different policies
-   * each backed by a different output channel.
-   */
-  public PolicyFactory toFactory() {
-    ImmutableSet.Builder<String> textContainerSet = ImmutableSet.builder();
-    for (Map.Entry<String, Boolean> textContainer
-         : this.textContainers.entrySet()) {
-      if (Boolean.TRUE.equals(textContainer.getValue())) {
-        textContainerSet.add(textContainer.getKey());
-      }
-    }
-    return new PolicyFactory(compilePolicies(), textContainerSet.build(),
-                             ImmutableMap.copyOf(globalAttrPolicies));
-  }
-
-  // Speed up subsequent builds by caching the compiled policies.
-  private transient ImmutableMap<String, ElementAndAttributePolicies>
-      compiledPolicies;
-
-  /** Called by mutators to signal that any compiled policy is out-of-date. */
-  private void invalidateCompiledState() {
-    compiledPolicies = null;
-  }
-
-  private ImmutableMap<String, ElementAndAttributePolicies> compilePolicies() {
-    if (compiledPolicies != null) { return compiledPolicies; }
-
-    // Copy maps before normalizing in case builder is reused.
-    @SuppressWarnings("hiding")
-    Map<String, ElementPolicy> elPolicies
-        = Maps.newLinkedHashMap(this.elPolicies);
-    @SuppressWarnings("hiding")
-    Map<String, Map<String, AttributePolicy>> attrPolicies
-        = Maps.newLinkedHashMap(this.attrPolicies);
-    for (Map.Entry<String, Map<String, AttributePolicy>> e :
-         attrPolicies.entrySet()) {
-      e.setValue(Maps.newLinkedHashMap(e.getValue()));
-    }
-    @SuppressWarnings("hiding")
-    Map<String, AttributePolicy> globalAttrPolicies
-        = Maps.newLinkedHashMap(this.globalAttrPolicies);
-    @SuppressWarnings("hiding")
-    Set<String> allowedProtocols = ImmutableSet.copyOf(this.allowedProtocols);
-
-    // Implement requireRelNofollowOnLinks
-    if (requireRelNofollowOnLinks) {
-      ElementPolicy linkPolicy = elPolicies.get("a");
-      if (linkPolicy == null) {
-        linkPolicy = ElementPolicy.REJECT_ALL_ELEMENT_POLICY;
-      }
-      elPolicies.put(
-          "a",
-          ElementPolicy.Util.join(linkPolicy, RelNofollowPolicy.INSTANCE));
-    }
-
-    // Implement protocol policies.
-    // For each URL attribute that is allowed, we further constrain it by
-    // only allowing the value through if it specifies no protocol, or if it
-    // specifies one in the allowedProtocols white-list.
-    // This is done regardless of whether any protocols have been allowed, so
-    // allowing the attribute "href" globally with the identity policy but
-    // not white-listing any protocols, effectively disallows the "href"
-    // attribute globally.
-    {
-      AttributePolicy urlAttributePolicy;
-      if (allowedProtocols.size() == 3
-          && allowedProtocols.contains("mailto")
-          && allowedProtocols.contains("http")
-          && allowedProtocols.contains("https")) {
-        urlAttributePolicy = StandardUrlAttributePolicy.INSTANCE;
-      } else {
-        urlAttributePolicy = new FilterUrlByProtocolAttributePolicy(
-            allowedProtocols);
-      }
-      Set<String> toGuard = Sets.newLinkedHashSet(URL_ATTRIBUTE_NAMES);
-      for (String urlAttributeName : URL_ATTRIBUTE_NAMES) {
-        if (globalAttrPolicies.containsKey(urlAttributeName)) {
-          toGuard.remove(urlAttributeName);
-          globalAttrPolicies.put(urlAttributeName, AttributePolicy.Util.join(
-              urlAttributePolicy, globalAttrPolicies.get(urlAttributeName)));
-        }
-      }
-      // Implement guards not implemented on global policies in the per-element
-      // policy maps.
-      for (Map.Entry<String, Map<String, AttributePolicy>> e
-           : attrPolicies.entrySet()) {
-        Map<String, AttributePolicy> policies = e.getValue();
-        for (String urlAttributeName : toGuard) {
-          if (policies.containsKey(urlAttributeName)) {
-            policies.put(urlAttributeName, AttributePolicy.Util.join(
-                urlAttributePolicy, policies.get(urlAttributeName)));
-          }
-        }
-      }
-    }
-
-    ImmutableMap.Builder<String, ElementAndAttributePolicies> policiesBuilder
-        = ImmutableMap.builder();
-    for (Map.Entry<String, ElementPolicy> e : elPolicies.entrySet()) {
-      String elementName = e.getKey();
-      ElementPolicy elPolicy = e.getValue();
-      if (ElementPolicy.REJECT_ALL_ELEMENT_POLICY.equals(elPolicy)) {
-        continue;
-      }
-
-      Map<String, AttributePolicy> elAttrPolicies
-          = attrPolicies.get(elementName);
-      if (elAttrPolicies == null) { elAttrPolicies = ImmutableMap.of(); }
-      ImmutableMap.Builder<String, AttributePolicy> attrs
-          = ImmutableMap.builder();
-      for (Map.Entry<String, AttributePolicy> ape : elAttrPolicies.entrySet()) {
-        String attributeName = ape.getKey();
-        // Handle below so we don't end up putting the same key into the map
-        // twice.  ImmutableMap.Builder hates that.
-        if (globalAttrPolicies.containsKey(attributeName)) { continue; }
-        AttributePolicy policy = ape.getValue();
-        if (!AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY.equals(policy)) {
-          attrs.put(attributeName, policy);
-        }
-      }
-      for (Map.Entry<String, AttributePolicy> ape
-           : globalAttrPolicies.entrySet()) {
-        String attributeName = ape.getKey();
-        AttributePolicy policy = AttributePolicy.Util.join(
-            elAttrPolicies.get(attributeName), ape.getValue());
-        if (!AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY.equals(policy)) {
-          attrs.put(attributeName, policy);
-        }
-      }
-
-      policiesBuilder.put(
-          elementName,
-          new ElementAndAttributePolicies(
-              elementName,
-              elPolicy, attrs.build(), skipIfEmpty.contains(elementName)));
-    }
-    return compiledPolicies = policiesBuilder.build();
-  }
-
-  /**
-   * Builds the relationship between attributes, the values that they may have,
-   * and the elements on which they may appear.
-   *
-   * @author Mike Samuel
-   */
-  public final class AttributeBuilder {
-    private final List<String> attributeNames;
-    private AttributePolicy policy = AttributePolicy.IDENTITY_ATTRIBUTE_POLICY;
-
-    AttributeBuilder(List<? extends String> attributeNames) {
-      this.attributeNames = ImmutableList.copyOf(attributeNames);
-    }
-
-    /**
-     * Filters and/or transforms the attribute values
-     * allowed by later {@code allow*} calls.
-     * Multiple calls to {@code matching} are combined so that the policies
-     * receive the value in order, each seeing the value after any
-     * transformation by a previous policy.
-     */
-    public AttributeBuilder matching(AttributePolicy attrPolicy) {
-      this.policy = AttributePolicy.Util.join(this.policy, attrPolicy);
-      return this;
-    }
-
-    /**
-     * Restrict the values allowed by later {@code allow*} calls to those
-     * matching the pattern.
-     * Multiple calls to {@code matching} are combined to restrict to the
-     * intersection of possible matched values.
-     */
-    public AttributeBuilder matching(final Pattern pattern) {
-      return matching(new AttributePolicy() {
-        public @Nullable String apply(
-            String elementName, String attributeName, String value) {
-          return pattern.matcher(value).matches() ? value : null;
-        }
-      });
-    }
-
-    /**
-     * Restrict the values allowed by later {@code allow*} calls to those
-     * matching the given predicate.
-     * Multiple calls to {@code matching} are combined to restrict to the
-     * intersection of possible matched values.
-     */
-    public AttributeBuilder matching(
-        final Predicate<? super String> filter) {
-      return matching(new AttributePolicy() {
-        public @Nullable String apply(
-            String elementName, String attributeName, String value) {
-          return filter.apply(value) ? value : null;
-        }
-      });
-    }
-
-    /**
-     * Restrict the values allowed by later {@code allow*} calls to those
-     * supplied.
-     * Multiple calls to {@code matching} are combined to restrict to the
-     * intersection of possible matched values.
-     */
-    public AttributeBuilder matching(
-        boolean ignoreCase, String... allowedValues) {
-      return matching(ignoreCase, ImmutableSet.copyOf(allowedValues));
-    }
-
-    /**
-     * Restrict the values allowed by later {@code allow*} calls to those
-     * supplied.
-     * Multiple calls to {@code matching} are combined to restrict to the
-     * intersection of possible matched values.
-     */
-    public AttributeBuilder matching(
-        final boolean ignoreCase, Set<? extends String> allowedValues) {
-      final ImmutableSet<String> allowed = ImmutableSet.copyOf(allowedValues);
-      return matching(new AttributePolicy() {
-        public @Nullable String apply(
-            String elementName, String attributeName, String uncanonValue) {
-          String value = ignoreCase
-              ? Strings.toLowerCase(uncanonValue)
-              : uncanonValue;
-          return allowed.contains(value) ? value : null;
-        }
-      });
-    }
-
-    /**
-     * Allows the given attributes on any elements but filters the
-     * attributes' values based on previous calls to {@code matching(...)}.
-     * Global attribute policies are applied after element specific policies.
-     * Be careful of using this with attributes like <code>type</code> which
-     * have different meanings on different attributes.
-     * Also be careful of allowing globally attributes like <code>href</code>
-     * which can have more far-reaching effects on tags like
-     * <code>&lt;base&gt;</code> and <code>&lt;link&gt;</code> than on
-     * <code>&lt;a&gt;</code> because in the former, they have an effect without
-     * user interaction and can change the behavior of the current page.
-     */
-    @SuppressWarnings("synthetic-access")
-    public HtmlPolicyBuilder globally() {
-      return HtmlPolicyBuilder.this.allowAttributesGlobally(
-          policy, attributeNames);
-    }
-
-    /**
-     * Allows the named attributes on the given elements but filters the
-     * attributes' values based on previous calls to {@code matching(...)}.
-     */
-    @SuppressWarnings("synthetic-access")
-    public HtmlPolicyBuilder onElements(String... elementNames) {
-      ImmutableList.Builder<String> b = ImmutableList.builder();
-      for (String elementName : elementNames) {
-        b.add(HtmlLexer.canonicalName(elementName));
-      }
-      return HtmlPolicyBuilder.this.allowAttributesOnElements(
-          policy, attributeNames, b.build());
-    }
-  }
-
-
-  private static final class RelNofollowPolicy implements ElementPolicy {
-    static final RelNofollowPolicy INSTANCE = new RelNofollowPolicy();
-
-    public String apply(String elementName, List<String> attrs) {
-      for (int i = 0, n = attrs.size(); i < n; i += 2) {
-        if ("href".equals(attrs.get(i))) {
-          attrs.add("rel");
-          attrs.add("nofollow");
-          break;
-        }
-      }
-      return elementName;
-    }
-  }
+	/**
+	 * The default set of elements that are removed if they have no attributes.
+	 * Since {@code <img>} is in this set, by default, a policy will remove
+	 * {@code <img src=javascript:alert(1337)>} because its URL is not allowed
+	 * and it has no other attributes that would warrant it appearing in the
+	 * output.
+	 */
+	public static final ImmutableSet<String> DEFAULT_SKIP_IF_EMPTY = ImmutableSet
+			.of("a", "font", "img", "input", "span");
+
+	private final Map<String, ElementPolicy> elPolicies = Maps
+			.newLinkedHashMap();
+	private final Map<String, Map<String, AttributePolicy>> attrPolicies = Maps
+			.newLinkedHashMap();
+	private final Map<String, AttributePolicy> globalAttrPolicies = Maps
+			.newLinkedHashMap();
+	private final Set<String> allowedProtocols = Sets.newLinkedHashSet();
+	private final Set<String> skipIfEmpty = Sets
+			.newLinkedHashSet(DEFAULT_SKIP_IF_EMPTY);
+	private final Map<String, Boolean> textContainers = Maps.newLinkedHashMap();
+	private boolean requireRelNofollowOnLinks;
+
+	/**
+	 * Allows the named elements.
+	 */
+	public HtmlPolicyBuilder allowElements(String... elementNames) {
+		return allowElements(ElementPolicy.IDENTITY_ELEMENT_POLICY,
+				elementNames);
+	}
+
+	/**
+	 * Disallows the named elements. Elements are disallowed by default, so
+	 * there is no need to disallow elements, unless you are making an exception
+	 * based on an earlier allow.
+	 */
+	public HtmlPolicyBuilder disallowElements(String... elementNames) {
+		return allowElements(ElementPolicy.REJECT_ALL_ELEMENT_POLICY,
+				elementNames);
+	}
+
+	/**
+	 * Allow the given elements with the given policy.
+	 *
+	 * @param policy
+	 *            May remove or add attributes, change the element name, or deny
+	 *            the element.
+	 */
+	public HtmlPolicyBuilder allowElements(ElementPolicy policy,
+			String... elementNames) {
+		invalidateCompiledState();
+		for (String elementName : elementNames) {
+			elementName = HtmlLexer.canonicalName(elementName);
+			ElementPolicy newPolicy = ElementPolicy.Util.join(
+					elPolicies.get(elementName), policy);
+			// Don't remove if newPolicy is the always reject policy since we
+			// want
+			// that to infect later allowElement calls for this particular
+			// element
+			// name. rejects should have higher priority than allows.
+			elPolicies.put(elementName, newPolicy);
+			if (!textContainers.containsKey(elementName)
+					&& TagBalancingHtmlStreamEventReceiver
+							.allowsPlainTextualContent(elementName)) {
+				textContainers.put(elementName, true);
+			}
+		}
+		return this;
+	}
+
+	/**
+	 * A canned policy that allows a number of common formatting elements.
+	 */
+	public HtmlPolicyBuilder allowCommonInlineFormattingElements() {
+		return allowElements("b", "i", "font", "s", "u", "o", "sup", "sub",
+				"ins", "del", "strong", "strike", "tt", "code", "big", "small",
+				"br", "span", "em");
+	}
+
+	/**
+	 * A canned policy that allows a number of common block elements.
+	 */
+	public HtmlPolicyBuilder allowCommonBlockElements() {
+		return allowElements("p", "div", "h1", "h2", "h3", "h4", "h5", "h6",
+				"ul", "ol", "li", "blockquote");
+	}
+
+	/**
+	 * Allows text content in the named elements. By default, text content is
+	 * allowed in any {@link #allowElements allowed elements} that can contain
+	 * character data per the HTML5 spec, but text content is not allowed by
+	 * default in elements that contain content of other kinds (like JavaScript
+	 * in {@code <script>} elements.
+	 * <p>
+	 * To write a policy that whitelists {@code <script>} or {@code <style>}
+	 * elements, first {@code allowTextIn("script")}.
+	 */
+	public HtmlPolicyBuilder allowTextIn(String... elementNames) {
+		invalidateCompiledState();
+		for (String elementName : elementNames) {
+			elementName = HtmlLexer.canonicalName(elementName);
+			textContainers.put(elementName, true);
+		}
+		return this;
+	}
+
+	/**
+	 * Disallows text in elements with the given name.
+	 * <p>
+	 * This is useful when an element contains text that is not meant to be
+	 * displayed to the end-user. Typically these elements are styled
+	 * {@code display:none} in browsers' default stylesheets, or, like
+	 * {@code <template>} contain text nodes that are eventually for human
+	 * consumption, but which are created in a separate document fragment.
+	 */
+	public HtmlPolicyBuilder disallowTextIn(String... elementNames) {
+		invalidateCompiledState();
+		for (String elementName : elementNames) {
+			elementName = HtmlLexer.canonicalName(elementName);
+			textContainers.put(elementName, false);
+		}
+		return this;
+	}
+
+	/**
+	 * Assuming the given elements are allowed, allows them to appear without
+	 * attributes.
+	 *
+	 * @see #DEFAULT_SKIP_IF_EMPTY
+	 * @see #disallowWithoutAttributes
+	 */
+	public HtmlPolicyBuilder allowWithoutAttributes(String... elementNames) {
+		invalidateCompiledState();
+		for (String elementName : elementNames) {
+			elementName = HtmlLexer.canonicalName(elementName);
+			skipIfEmpty.remove(elementName);
+		}
+		return this;
+	}
+
+	/**
+	 * Disallows the given elements from appearing without attributes.
+	 *
+	 * @see #DEFAULT_SKIP_IF_EMPTY
+	 * @see #allowWithoutAttributes
+	 */
+	public HtmlPolicyBuilder disallowWithoutAttribute(String elementName, final String attributeName) {
+		invalidateCompiledState();
+			elementName = HtmlLexer.canonicalName(elementName);
+			ElementPolicy policy = new ElementPolicy() {
+				public @Nullable String apply(String elementName, List<String> attrs) {
+					for(int i=0; i<attrs.size(); i+=2) {
+						if(attrs.get(i).equals(attributeName)){
+							return elementName;
+						}
+					}
+					return null;
+				}
+			};
+			ElementPolicy newPolicy = ElementPolicy.Util.join(
+					elPolicies.get(elementName), policy);
+			elPolicies.put(elementName, newPolicy);
+		return this;
+	}
+
+	/**
+	 * Disallows the given elements from appearing without attributes.
+	 *
+	 * @see #DEFAULT_SKIP_IF_EMPTY
+	 * @see #allowWithoutAttributes
+	 */
+	public HtmlPolicyBuilder disallowWithoutAttributes(String... elementNames) {
+		invalidateCompiledState();
+		for (String elementName : elementNames) {
+			elementName = HtmlLexer.canonicalName(elementName);
+			skipIfEmpty.add(elementName);
+		}
+		return this;
+	}
+
+	/**
+	 * Returns an object that lets you associate policies with the given
+	 * attributes, and allow them globally or on specific elements.
+	 */
+	public AttributeBuilder allowAttributes(String... attributeNames) {
+		ImmutableList.Builder<String> b = ImmutableList.builder();
+		for (String attributeName : attributeNames) {
+			b.add(HtmlLexer.canonicalName(attributeName));
+		}
+		return new AttributeBuilder(b.build());
+	}
+
+	/**
+	 * Reverse an earlier attribute {@link #allowAttributes allow}.
+	 * <p>
+	 * For this to have an effect you must call at least one of
+	 * {@link AttributeBuilder#globally} and {@link AttributeBuilder#onElements}.
+	 * <p>
+	 * Attributes are disallowed by default, so there is no need to call this
+	 * with a laundry list of attribute/element pairs.
+	 */
+	public AttributeBuilder disallowAttributes(String... attributeNames) {
+		return this.allowAttributes(attributeNames).matching(
+				AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY);
+	}
+
+	private HtmlPolicyBuilder allowAttributesGlobally(AttributePolicy policy,
+			List<String> attributeNames) {
+		invalidateCompiledState();
+		for (String attributeName : attributeNames) {
+			// We reinterpret the identity policy later via policy joining since
+			// its
+			// the default passed from the policy-less method, but we don't do
+			// anything here since we don't know until build() is called whether
+			// the
+			// policy author wants to allow certain URL protocols or wants to
+			// deal
+			// with styles.
+			AttributePolicy oldPolicy = globalAttrPolicies.get(attributeName);
+			globalAttrPolicies.put(attributeName,
+					AttributePolicy.Util.join(oldPolicy, policy));
+		}
+		return this;
+	}
+
+	private HtmlPolicyBuilder allowAttributesOnElements(AttributePolicy policy,
+			List<String> attributeNames, List<String> elementNames) {
+		invalidateCompiledState();
+		for (String elementName : elementNames) {
+			Map<String, AttributePolicy> policies = attrPolicies
+					.get(elementName);
+			if (policies == null) {
+				policies = Maps.newLinkedHashMap();
+				attrPolicies.put(elementName, policies);
+			}
+			for (String attributeName : attributeNames) {
+				AttributePolicy oldPolicy = policies.get(attributeName);
+				policies.put(attributeName,
+						AttributePolicy.Util.join(oldPolicy, policy));
+			}
+		}
+		return this;
+	}
+
+	/**
+	 * Adds <a href="http://en.wikipedia.org/wiki/Nofollow">
+	 * <code>rel=nofollow</code></a> to links.
+	 */
+	public HtmlPolicyBuilder requireRelNofollowOnLinks() {
+		invalidateCompiledState();
+		this.requireRelNofollowOnLinks = true;
+		return this;
+	}
+
+	/**
+	 * Adds to the set of protocols that are allowed in URL attributes. For each
+	 * URL attribute that is allowed, we further constrain it by only allowing
+	 * the value through if it specifies no protocol, or if it specifies one in
+	 * the allowedProtocols white-list. This is done regardless of whether any
+	 * protocols have been allowed, so allowing the attribute "href" globally
+	 * with the identity policy but not white-listing any protocols, effectively
+	 * disallows the "href" attribute globally.
+	 * <p>
+	 * Do not allow any <code>*script</code> such as <code>javascript</code>
+	 * protocols if you might use this policy with untrusted code.
+	 */
+	public HtmlPolicyBuilder allowUrlProtocols(String... protocols) {
+		invalidateCompiledState();
+		// If there is at least one allowed protocol, then allow URLs and
+		// add a filter that checks href and src values.
+
+		// Do not allow href and srcs through otherwise, and only allow on
+		// images
+		// and links.
+		for (String protocol : protocols) {
+			protocol = Strings.toLowerCase(protocol);
+			allowedProtocols.add(protocol);
+		}
+		return this;
+	}
+
+	/**
+	 * Reverses a decision made by {@link #allowUrlProtocols}.
+	 */
+	public HtmlPolicyBuilder disallowUrlProtocols(String... protocols) {
+		invalidateCompiledState();
+		for (String protocol : protocols) {
+			protocol = Strings.toLowerCase(protocol);
+			allowedProtocols.remove(protocol);
+		}
+		return this;
+	}
+
+	/**
+	 * A canned URL protocol policy that allows <code>http</code>,
+	 * <code>https</code>, and <code>mailto</code>.
+	 */
+	public HtmlPolicyBuilder allowStandardUrlProtocols() {
+		return allowUrlProtocols("http", "https", "mailto");
+	}
+
+	/**
+	 * Convert <code>style="&lt;CSS&gt;"</code> to sanitized CSS which allows
+	 * color, font-size, type-face, and other styling using the default schema;
+	 * but which does not allow content to escape its clipping context.
+	 */
+	public HtmlPolicyBuilder allowStyling() {
+		allowStyling(CssSchema.DEFAULT);
+		return this;
+	}
+
+	/**
+	 * Convert <code>style="&lt;CSS&gt;"</code> to sanitized CSS which allows
+	 * color, font-size, type-face, and other styling using the given schema.
+	 */
+	public HtmlPolicyBuilder allowStyling(CssSchema whitelist) {
+		invalidateCompiledState();
+		allowAttributesGlobally(new StylingPolicy(whitelist),
+				ImmutableList.of("style"));
+		return this;
+	}
+
+	/**
+	 * Names of attributes from HTML 4 whose values are URLs. Other attributes,
+	 * e.g. <code>style</code> may contain URLs even though there values are not
+	 * URLs.
+	 */
+	private static final Set<String> URL_ATTRIBUTE_NAMES = ImmutableSet.of(
+			"action", "archive", "background", "cite", "classid", "codebase",
+			"data", "dsync", "formaction", "href", "icon", "longdesc",
+			"manifest", "poster", "profile", "src", "srcset", "usemap");
+
+	/**
+	 * Produces a policy based on the allow and disallow calls previously made.
+	 *
+	 * @param out
+	 *            receives calls to open only tags allowed by previous calls to
+	 *            this object. Typically a {@link HtmlStreamRenderer}.
+	 */
+	public HtmlSanitizer.Policy build(HtmlStreamEventReceiver out) {
+		return toFactory().apply(out);
+	}
+
+	/**
+	 * Produces a policy based on the allow and disallow calls previously made.
+	 *
+	 * @param out
+	 *            receives calls to open only tags allowed by previous calls to
+	 *            this object. Typically a {@link HtmlStreamRenderer}.
+	 * @param listener
+	 *            is notified of dropped tags and attributes so that intrusion
+	 *            detection systems can be alerted to questionable HTML. If
+	 *            {@code null} then no notifications are sent.
+	 * @param context
+	 *            if {@code (listener != null)} then the context value passed
+	 *            with alerts. This can be used to let the listener know from
+	 *            which connection or request the questionable HTML was
+	 *            received.
+	 */
+	public <CTX> HtmlSanitizer.Policy build(HtmlStreamEventReceiver out,
+			@Nullable HtmlChangeListener<? super CTX> listener,
+			@Nullable CTX context) {
+		return toFactory().apply(out, listener, context);
+	}
+
+	/**
+	 * Like {@link #build} but can be reused to create many different policies
+	 * each backed by a different output channel.
+	 */
+	public PolicyFactory toFactory() {
+		ImmutableSet.Builder<String> textContainerSet = ImmutableSet.builder();
+		for (Map.Entry<String, Boolean> textContainer : this.textContainers
+				.entrySet()) {
+			if (Boolean.TRUE.equals(textContainer.getValue())) {
+				textContainerSet.add(textContainer.getKey());
+			}
+		}
+		return new PolicyFactory(compilePolicies(), textContainerSet.build(),
+				ImmutableMap.copyOf(globalAttrPolicies));
+	}
+
+	// Speed up subsequent builds by caching the compiled policies.
+	private transient ImmutableMap<String, ElementAndAttributePolicies> compiledPolicies;
+
+	/** Called by mutators to signal that any compiled policy is out-of-date. */
+	private void invalidateCompiledState() {
+		compiledPolicies = null;
+	}
+
+	private ImmutableMap<String, ElementAndAttributePolicies> compilePolicies() {
+		if (compiledPolicies != null) {
+			return compiledPolicies;
+		}
+
+		// Copy maps before normalizing in case builder is reused.
+		@SuppressWarnings("hiding")
+		Map<String, ElementPolicy> elPolicies = Maps
+				.newLinkedHashMap(this.elPolicies);
+		@SuppressWarnings("hiding")
+		Map<String, Map<String, AttributePolicy>> attrPolicies = Maps
+				.newLinkedHashMap(this.attrPolicies);
+		for (Map.Entry<String, Map<String, AttributePolicy>> e : attrPolicies
+				.entrySet()) {
+			e.setValue(Maps.newLinkedHashMap(e.getValue()));
+		}
+		@SuppressWarnings("hiding")
+		Map<String, AttributePolicy> globalAttrPolicies = Maps
+				.newLinkedHashMap(this.globalAttrPolicies);
+		@SuppressWarnings("hiding")
+		Set<String> allowedProtocols = ImmutableSet
+				.copyOf(this.allowedProtocols);
+
+		// Implement requireRelNofollowOnLinks
+		if (requireRelNofollowOnLinks) {
+			ElementPolicy linkPolicy = elPolicies.get("a");
+			if (linkPolicy == null) {
+				linkPolicy = ElementPolicy.REJECT_ALL_ELEMENT_POLICY;
+			}
+			elPolicies.put("a", ElementPolicy.Util.join(linkPolicy,
+					RelNofollowPolicy.INSTANCE));
+		}
+
+		// Implement protocol policies.
+		// For each URL attribute that is allowed, we further constrain it by
+		// only allowing the value through if it specifies no protocol, or if it
+		// specifies one in the allowedProtocols white-list.
+		// This is done regardless of whether any protocols have been allowed,
+		// so
+		// allowing the attribute "href" globally with the identity policy but
+		// not white-listing any protocols, effectively disallows the "href"
+		// attribute globally.
+		{
+			AttributePolicy urlAttributePolicy;
+			if (allowedProtocols.size() == 3
+					&& allowedProtocols.contains("mailto")
+					&& allowedProtocols.contains("http")
+					&& allowedProtocols.contains("https")) {
+				urlAttributePolicy = StandardUrlAttributePolicy.INSTANCE;
+			} else {
+				urlAttributePolicy = new FilterUrlByProtocolAttributePolicy(
+						allowedProtocols);
+			}
+			Set<String> toGuard = Sets.newLinkedHashSet(URL_ATTRIBUTE_NAMES);
+			for (String urlAttributeName : URL_ATTRIBUTE_NAMES) {
+				if (globalAttrPolicies.containsKey(urlAttributeName)) {
+					toGuard.remove(urlAttributeName);
+					globalAttrPolicies.put(urlAttributeName,
+							AttributePolicy.Util.join(urlAttributePolicy,
+									globalAttrPolicies.get(urlAttributeName)));
+				}
+			}
+			// Implement guards not implemented on global policies in the
+			// per-element
+			// policy maps.
+			for (Map.Entry<String, Map<String, AttributePolicy>> e : attrPolicies
+					.entrySet()) {
+				Map<String, AttributePolicy> policies = e.getValue();
+				for (String urlAttributeName : toGuard) {
+					if (policies.containsKey(urlAttributeName)) {
+						policies.put(urlAttributeName, AttributePolicy.Util
+								.join(urlAttributePolicy,
+										policies.get(urlAttributeName)));
+					}
+				}
+			}
+		}
+
+		ImmutableMap.Builder<String, ElementAndAttributePolicies> policiesBuilder = ImmutableMap
+				.builder();
+		for (Map.Entry<String, ElementPolicy> e : elPolicies.entrySet()) {
+			String elementName = e.getKey();
+			ElementPolicy elPolicy = e.getValue();
+			if (ElementPolicy.REJECT_ALL_ELEMENT_POLICY.equals(elPolicy)) {
+				continue;
+			}
+
+			Map<String, AttributePolicy> elAttrPolicies = attrPolicies
+					.get(elementName);
+			if (elAttrPolicies == null) {
+				elAttrPolicies = ImmutableMap.of();
+			}
+			ImmutableMap.Builder<String, AttributePolicy> attrs = ImmutableMap
+					.builder();
+			for (Map.Entry<String, AttributePolicy> ape : elAttrPolicies
+					.entrySet()) {
+				String attributeName = ape.getKey();
+				// Handle below so we don't end up putting the same key into the
+				// map
+				// twice. ImmutableMap.Builder hates that.
+				if (globalAttrPolicies.containsKey(attributeName)) {
+					continue;
+				}
+				AttributePolicy policy = ape.getValue();
+				if (!AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY.equals(policy)) {
+					attrs.put(attributeName, policy);
+				}
+			}
+			for (Map.Entry<String, AttributePolicy> ape : globalAttrPolicies
+					.entrySet()) {
+				String attributeName = ape.getKey();
+				AttributePolicy policy = AttributePolicy.Util.join(
+						elAttrPolicies.get(attributeName), ape.getValue());
+				if (!AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY.equals(policy)) {
+					attrs.put(attributeName, policy);
+				}
+			}
+
+			policiesBuilder.put(elementName,
+					new ElementAndAttributePolicies(elementName, elPolicy,
+							attrs.build(), skipIfEmpty.contains(elementName)));
+		}
+		return compiledPolicies = policiesBuilder.build();
+	}
+
+	/**
+	 * Builds the relationship between attributes, the values that they may
+	 * have, and the elements on which they may appear.
+	 *
+	 * @author Mike Samuel
+	 */
+	public final class AttributeBuilder {
+		private final List<String> attributeNames;
+		private AttributePolicy policy = AttributePolicy.IDENTITY_ATTRIBUTE_POLICY;
+
+		AttributeBuilder(List<? extends String> attributeNames) {
+			this.attributeNames = ImmutableList.copyOf(attributeNames);
+		}
+
+		/**
+		 * Filters and/or transforms the attribute values allowed by later
+		 * {@code allow*} calls. Multiple calls to {@code matching} are combined
+		 * so that the policies receive the value in order, each seeing the
+		 * value after any transformation by a previous policy.
+		 */
+		public AttributeBuilder matching(AttributePolicy attrPolicy) {
+			this.policy = AttributePolicy.Util.join(this.policy, attrPolicy);
+			return this;
+		}
+
+		/**
+		 * Restrict the values allowed by later {@code allow*} calls to those
+		 * matching the pattern. Multiple calls to {@code matching} are combined
+		 * to restrict to the intersection of possible matched values.
+		 */
+		public AttributeBuilder matching(final Pattern pattern) {
+			return matching(new AttributePolicy() {
+				public @Nullable String apply(String elementName,
+						String attributeName, String value) {
+					return pattern.matcher(value).matches() ? value : null;
+				}
+			});
+		}
+
+		/**
+		 * Restrict the values allowed by later {@code allow*} calls to those
+		 * NOT matching the pattern. This is a convenience method, as inverting
+		 * RegEx patterns can become quite complex. Multiple calls to
+		 * {@code matching} are combined to restrict to the intersection of
+		 * possible matched values.
+		 */
+		public AttributeBuilder notMatching(final Pattern pattern) {
+			return matching(new AttributePolicy() {
+				public @Nullable String apply(String elementName,
+						String attributeName, String value) {
+					return !pattern.matcher(value).matches() ? value : null;
+				}
+			});
+		}
+
+		/**
+		 * Restrict the values allowed by later {@code allow*} calls to ones
+		 * that are not only whitespace or an empty string. Can be combined with
+		 * calls to {@code matching} or {@code notMatching}.
+		 */
+		public AttributeBuilder notEmptyOrWhitespace() {
+			return matching(new AttributePolicy() {
+				public @Nullable String apply(String elementName,
+						String attributeName, String value) {
+					return value.trim().length() > 0 ? value : null;
+				}
+			});
+		}
+
+		/**
+		 * Restrict the values allowed by later {@code allow*} calls to those
+		 * matching the given predicate. Multiple calls to {@code matching} are
+		 * combined to restrict to the intersection of possible matched values.
+		 */
+		public AttributeBuilder matching(final Predicate<? super String> filter) {
+			return matching(new AttributePolicy() {
+				public @Nullable String apply(String elementName,
+						String attributeName, String value) {
+					return filter.apply(value) ? value : null;
+				}
+			});
+		}
+
+		/**
+		 * Restrict the values allowed by later {@code allow*} calls to those
+		 * supplied. Multiple calls to {@code matching} are combined to restrict
+		 * to the intersection of possible matched values.
+		 */
+		public AttributeBuilder matching(boolean ignoreCase,
+				String... allowedValues) {
+			return matching(ignoreCase, ImmutableSet.copyOf(allowedValues));
+		}
+
+		/**
+		 * Restrict the values allowed by later {@code allow*} calls to those
+		 * supplied. Multiple calls to {@code matching} are combined to restrict
+		 * to the intersection of possible matched values.
+		 */
+		public AttributeBuilder matching(final boolean ignoreCase,
+				Set<? extends String> allowedValues) {
+			final ImmutableSet<String> allowed = ImmutableSet
+					.copyOf(allowedValues);
+			return matching(new AttributePolicy() {
+				public @Nullable String apply(String elementName,
+						String attributeName, String uncanonValue) {
+					String value = ignoreCase ? Strings
+							.toLowerCase(uncanonValue) : uncanonValue;
+					return allowed.contains(value) ? value : null;
+				}
+			});
+		}
+
+		/**
+		 * Allows the given attributes on any elements but filters the
+		 * attributes' values based on previous calls to {@code matching(...)}.
+		 * Global attribute policies are applied after element specific
+		 * policies. Be careful of using this with attributes like
+		 * <code>type</code> which have different meanings on different
+		 * attributes. Also be careful of allowing globally attributes like
+		 * <code>href</code> which can have more far-reaching effects on tags
+		 * like <code>&lt;base&gt;</code> and <code>&lt;link&gt;</code> than on
+		 * <code>&lt;a&gt;</code> because in the former, they have an effect
+		 * without user interaction and can change the behavior of the current
+		 * page.
+		 */
+		@SuppressWarnings("synthetic-access")
+		public HtmlPolicyBuilder globally() {
+			return HtmlPolicyBuilder.this.allowAttributesGlobally(policy,
+					attributeNames);
+		}
+
+		/**
+		 * Allows the named attributes on the given elements but filters the
+		 * attributes' values based on previous calls to {@code matching(...)}.
+		 */
+		@SuppressWarnings("synthetic-access")
+		public HtmlPolicyBuilder onElements(String... elementNames) {
+			ImmutableList.Builder<String> b = ImmutableList.builder();
+			for (String elementName : elementNames) {
+				b.add(HtmlLexer.canonicalName(elementName));
+			}
+			return HtmlPolicyBuilder.this.allowAttributesOnElements(policy,
+					attributeNames, b.build());
+		}
+	}
+
+	private static final class RelNofollowPolicy implements ElementPolicy {
+		static final RelNofollowPolicy INSTANCE = new RelNofollowPolicy();
+
+		public String apply(String elementName, List<String> attrs) {
+			for (int i = 0, n = attrs.size(); i < n; i += 2) {
+				if ("href".equals(attrs.get(i))) {
+					attrs.add("rel");
+					attrs.add("nofollow");
+					break;
+				}
+			}
+			return elementName;
+		}
+	}
 }
diff --git a/src/main/java/org/owasp/html/HtmlStreamRenderer.java b/src/main/java/org/owasp/html/HtmlStreamRenderer.java
index b1e22f8d..121f2d88 100644
--- a/src/main/java/org/owasp/html/HtmlStreamRenderer.java
+++ b/src/main/java/org/owasp/html/HtmlStreamRenderer.java
@@ -74,9 +74,6 @@ public static HtmlStreamRenderer create(
     if (output instanceof Closeable) {
       return new CloseableHtmlStreamRenderer(
           output, ioExHandler, badHtmlHandler);
-    } else if (output instanceof AutoCloseable) {
-      return new AutoCloseableHtmlStreamRenderer(
-          output, ioExHandler, badHtmlHandler);
     } else {
       return new HtmlStreamRenderer(output, ioExHandler, badHtmlHandler);
     }
@@ -421,23 +418,4 @@ public void close() throws IOException {
       closeable.close();
     }
   }
-
-  static class AutoCloseableHtmlStreamRenderer extends HtmlStreamRenderer
-  implements AutoCloseable {
-    private final AutoCloseable closeable;
-
-    @SuppressWarnings("synthetic-access")
-    AutoCloseableHtmlStreamRenderer(
-        @WillCloseWhenClosed
-        Appendable output, Handler<? super IOException> errorHandler,
-        Handler<? super String> badHtmlHandler) {
-      super(output, errorHandler, badHtmlHandler);
-      this.closeable = (AutoCloseable) output;
-    }
-
-    public void close() throws Exception {
-      if (isDocumentOpen()) { closeDocument(); }
-      closeable.close();
-    }
-  }
 }

From e75d98006ab44d38f771d531d491a8385c50510e Mon Sep 17 00:00:00 2001
From: Sebastian Uecker <sebastian.uecker@forum-is.de>
Date: Fri, 9 Oct 2015 16:12:26 +0200
Subject: [PATCH 02/28] Reverted changes

---
 .../org/owasp/html/HtmlPolicyBuilder.java     | 1377 ++++++++---------
 .../org/owasp/html/HtmlStreamRenderer.java    |   22 +
 2 files changed, 684 insertions(+), 715 deletions(-)

diff --git a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
index 683ca5c2..d7a6ea76 100644
--- a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
+++ b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
@@ -43,6 +43,7 @@
 import com.google.common.collect.Maps;
 import com.google.common.collect.Sets;
 
+
 /**
  * Conveniences for configuring policies for the {@link HtmlSanitizer}.
  *
@@ -53,36 +54,39 @@
  * processing modes; and finally call <code>build(renderer)</code> or
  * <code>toFactory()</code>.
  * </p>
- * 
  * <pre class="prettyprint lang-java">
  * // Define the policy.
- * Function&lt;HtmlStreamEventReceiver, HtmlSanitizer.Policy&gt; policy = new HtmlPolicyBuilder()
- * 		.allowElements(&quot;a&quot;, &quot;p&quot;).allowAttributes(&quot;href&quot;).onElements(&quot;a&quot;)
- * 		.toFactory();
- * 
+ * Function&lt;HtmlStreamEventReceiver, HtmlSanitizer.Policy&gt; policy
+ *     = new HtmlPolicyBuilder()
+ *         .allowElements("a", "p")
+ *         .allowAttributes("href").onElements("a")
+ *         .toFactory();
+ *
  * // Sanitize your output.
  * HtmlSanitizer.sanitize(myHtml, policy.apply(myHtmlStreamRenderer));
  * </pre>
  *
  * <h3>Embedded Content</h3>
  * <p>
- * Embedded URLs are filtered by {@link HtmlPolicyBuilder#allowUrlProtocols
- * protocol}. There is a {@link HtmlPolicyBuilder#allowStandardUrlProtocols
- * canned policy} so you can easily white-list widely used policies that don't
- * violate the current pages origin. See "Customization" below for ways to do
- * further filtering. If you allow links it might be worthwhile to
+ * Embedded URLs are filtered by
+ * {@link HtmlPolicyBuilder#allowUrlProtocols protocol}.
+ * There is a {@link HtmlPolicyBuilder#allowStandardUrlProtocols canned policy}
+ * so you can easily white-list widely used policies that don't violate the
+ * current pages origin.  See "Customization" below for ways to do further
+ * filtering.  If you allow links it might be worthwhile to
  * {@link HtmlPolicyBuilder#requireRelNofollowOnLinks() require}
  * {@code rel=nofollow}.
  * </p>
  * <p>
- * This class simply throws out all embedded JS. Use a custom element or
- * attribute policy to allow through signed or otherwise known-safe code. Check
- * out the Caja project if you need a way to contain third-party JS.
+ * This class simply throws out all embedded JS.
+ * Use a custom element or attribute policy to allow through
+ * signed or otherwise known-safe code.
+ * Check out the Caja project if you need a way to contain third-party JS.
  * </p>
  * <p>
- * This class does not attempt to faithfully parse and sanitize CSS. It does
- * provide {@link HtmlPolicyBuilder#allowStyling() one} styling option that
- * allows through a few CSS properties that allow textual styling, but that
+ * This class does not attempt to faithfully parse and sanitize CSS.
+ * It does provide {@link HtmlPolicyBuilder#allowStyling() one} styling option
+ * that allows through a few CSS properties that allow textual styling, but that
  * disallow image loading, history stealing, layout breaking, code execution,
  * etc.
  * </p>
@@ -90,44 +94,51 @@
  * <h3>Customization</h3>
  * <p>
  * You can easily do custom processing on tags and attributes by supplying your
- * own {@link ElementPolicy element policy} or {@link AttributePolicy attribute
- * policy} when calling <code>allow&hellip;</code>. E.g. to convert headers into
- * {@code <div>}s, you could use an element policy
+ * own {@link ElementPolicy element policy} or
+ * {@link AttributePolicy attribute policy} when calling
+ * <code>allow&hellip;</code>.
+ * E.g. to convert headers into {@code <div>}s, you could use an element policy
  * </p>
- * 
  * <pre class="prettyprint lang-java">
- * new HtmlPolicyBuilder().allowElement(new ElementPolicy() {
- * 	public String apply(String elementName, List&lt;String&gt; attributes) {
- * 		attributes.add(&quot;class&quot;);
- * 		attributes.add(&quot;header-&quot; + elementName);
- * 		return &quot;div&quot;;
- * 	}
- * }, &quot;h1&quot;, &quot;h2&quot;, &quot;h3&quot;, &quot;h4&quot;, &quot;h5&quot;, &quot;h6&quot;).build(outputChannel)
+ * new HtmlPolicyBuilder()
+ *   .allowElement(
+ *     new ElementPolicy() {
+ *       public String apply(String elementName, List&lt;String&gt; attributes){
+ *         attributes.add("class");
+ *         attributes.add("header-" + elementName);
+ *         return "div";
+ *       }
+ *     },
+ *     "h1", "h2", "h3", "h4", "h5", "h6")
+ *   .build(outputChannel)
  * </pre>
  *
  * <h3>Rules of Thumb</h3>
  * <p>
  * Throughout this class, several rules hold:
  * <ul>
- * <li>Everything is denied by default. There are <code>disallow&hellip;</code>
- * methods, but those reverse allows instead of rolling back overly permissive
- * defaults.
- * <li>The order of allows and disallows does not matter. Disallows trump allows
- * whether they occur before or after them. The only method that needs to be
- * called in a particular place is {@link HtmlPolicyBuilder#build}. Allows or
- * disallows after {@code build} is called have no effect on the already built
- * policy.
- * <li>Element and attribute policies are applied in the following order:
- * element specific attribute policy, global attribute policy, element policy.
- * Element policies come last so they can observe all the post-processed
- * attributes, and so they can add attributes that are exempt from attribute
- * policies. Element specific policies go first, so they can normalize content
- * to a form that might be acceptable to a more simplistic global policy.
+ *   <li>Everything is denied by default.  There are
+ *     <code>disallow&hellip;</code> methods, but those reverse
+ *     allows instead of rolling back overly permissive defaults.
+ *   <li>The order of allows and disallows does not matter.
+ *     Disallows trump allows whether they occur before or after them.
+ *     The only method that needs to be called in a particular place is
+ *     {@link HtmlPolicyBuilder#build}.
+ *     Allows or disallows after {@code build} is called have no
+ *     effect on the already built policy.
+ *   <li>Element and attribute policies are applied in the following order:
+ *     element specific attribute policy, global attribute policy, element
+ *     policy.
+ *     Element policies come last so they can observe all the post-processed
+ *     attributes, and so they can add attributes that are exempt from
+ *     attribute policies.
+ *     Element specific policies go first, so they can normalize content to
+ *     a form that might be acceptable to a more simplistic global policy.
  * </ul>
  *
  * <h3>Thread safety and efficiency</h3>
  * <p>
- * This class is not thread-safe. The resulting policy will not violate its
+ * This class is not thread-safe.  The resulting policy will not violate its
  * security guarantees as a result of race conditions, but is not thread safe
  * because it maintains state to track whether text inside disallowed elements
  * should be suppressed.
@@ -142,677 +153,613 @@
 @TCB
 @NotThreadSafe
 public class HtmlPolicyBuilder {
-	/**
-	 * The default set of elements that are removed if they have no attributes.
-	 * Since {@code <img>} is in this set, by default, a policy will remove
-	 * {@code <img src=javascript:alert(1337)>} because its URL is not allowed
-	 * and it has no other attributes that would warrant it appearing in the
-	 * output.
-	 */
-	public static final ImmutableSet<String> DEFAULT_SKIP_IF_EMPTY = ImmutableSet
-			.of("a", "font", "img", "input", "span");
-
-	private final Map<String, ElementPolicy> elPolicies = Maps
-			.newLinkedHashMap();
-	private final Map<String, Map<String, AttributePolicy>> attrPolicies = Maps
-			.newLinkedHashMap();
-	private final Map<String, AttributePolicy> globalAttrPolicies = Maps
-			.newLinkedHashMap();
-	private final Set<String> allowedProtocols = Sets.newLinkedHashSet();
-	private final Set<String> skipIfEmpty = Sets
-			.newLinkedHashSet(DEFAULT_SKIP_IF_EMPTY);
-	private final Map<String, Boolean> textContainers = Maps.newLinkedHashMap();
-	private boolean requireRelNofollowOnLinks;
-
-	/**
-	 * Allows the named elements.
-	 */
-	public HtmlPolicyBuilder allowElements(String... elementNames) {
-		return allowElements(ElementPolicy.IDENTITY_ELEMENT_POLICY,
-				elementNames);
-	}
-
-	/**
-	 * Disallows the named elements. Elements are disallowed by default, so
-	 * there is no need to disallow elements, unless you are making an exception
-	 * based on an earlier allow.
-	 */
-	public HtmlPolicyBuilder disallowElements(String... elementNames) {
-		return allowElements(ElementPolicy.REJECT_ALL_ELEMENT_POLICY,
-				elementNames);
-	}
-
-	/**
-	 * Allow the given elements with the given policy.
-	 *
-	 * @param policy
-	 *            May remove or add attributes, change the element name, or deny
-	 *            the element.
-	 */
-	public HtmlPolicyBuilder allowElements(ElementPolicy policy,
-			String... elementNames) {
-		invalidateCompiledState();
-		for (String elementName : elementNames) {
-			elementName = HtmlLexer.canonicalName(elementName);
-			ElementPolicy newPolicy = ElementPolicy.Util.join(
-					elPolicies.get(elementName), policy);
-			// Don't remove if newPolicy is the always reject policy since we
-			// want
-			// that to infect later allowElement calls for this particular
-			// element
-			// name. rejects should have higher priority than allows.
-			elPolicies.put(elementName, newPolicy);
-			if (!textContainers.containsKey(elementName)
-					&& TagBalancingHtmlStreamEventReceiver
-							.allowsPlainTextualContent(elementName)) {
-				textContainers.put(elementName, true);
-			}
-		}
-		return this;
-	}
-
-	/**
-	 * A canned policy that allows a number of common formatting elements.
-	 */
-	public HtmlPolicyBuilder allowCommonInlineFormattingElements() {
-		return allowElements("b", "i", "font", "s", "u", "o", "sup", "sub",
-				"ins", "del", "strong", "strike", "tt", "code", "big", "small",
-				"br", "span", "em");
-	}
-
-	/**
-	 * A canned policy that allows a number of common block elements.
-	 */
-	public HtmlPolicyBuilder allowCommonBlockElements() {
-		return allowElements("p", "div", "h1", "h2", "h3", "h4", "h5", "h6",
-				"ul", "ol", "li", "blockquote");
-	}
-
-	/**
-	 * Allows text content in the named elements. By default, text content is
-	 * allowed in any {@link #allowElements allowed elements} that can contain
-	 * character data per the HTML5 spec, but text content is not allowed by
-	 * default in elements that contain content of other kinds (like JavaScript
-	 * in {@code <script>} elements.
-	 * <p>
-	 * To write a policy that whitelists {@code <script>} or {@code <style>}
-	 * elements, first {@code allowTextIn("script")}.
-	 */
-	public HtmlPolicyBuilder allowTextIn(String... elementNames) {
-		invalidateCompiledState();
-		for (String elementName : elementNames) {
-			elementName = HtmlLexer.canonicalName(elementName);
-			textContainers.put(elementName, true);
-		}
-		return this;
-	}
-
-	/**
-	 * Disallows text in elements with the given name.
-	 * <p>
-	 * This is useful when an element contains text that is not meant to be
-	 * displayed to the end-user. Typically these elements are styled
-	 * {@code display:none} in browsers' default stylesheets, or, like
-	 * {@code <template>} contain text nodes that are eventually for human
-	 * consumption, but which are created in a separate document fragment.
-	 */
-	public HtmlPolicyBuilder disallowTextIn(String... elementNames) {
-		invalidateCompiledState();
-		for (String elementName : elementNames) {
-			elementName = HtmlLexer.canonicalName(elementName);
-			textContainers.put(elementName, false);
-		}
-		return this;
-	}
-
-	/**
-	 * Assuming the given elements are allowed, allows them to appear without
-	 * attributes.
-	 *
-	 * @see #DEFAULT_SKIP_IF_EMPTY
-	 * @see #disallowWithoutAttributes
-	 */
-	public HtmlPolicyBuilder allowWithoutAttributes(String... elementNames) {
-		invalidateCompiledState();
-		for (String elementName : elementNames) {
-			elementName = HtmlLexer.canonicalName(elementName);
-			skipIfEmpty.remove(elementName);
-		}
-		return this;
-	}
-
-	/**
-	 * Disallows the given elements from appearing without attributes.
-	 *
-	 * @see #DEFAULT_SKIP_IF_EMPTY
-	 * @see #allowWithoutAttributes
-	 */
-	public HtmlPolicyBuilder disallowWithoutAttribute(String elementName, final String attributeName) {
-		invalidateCompiledState();
-			elementName = HtmlLexer.canonicalName(elementName);
-			ElementPolicy policy = new ElementPolicy() {
-				public @Nullable String apply(String elementName, List<String> attrs) {
-					for(int i=0; i<attrs.size(); i+=2) {
-						if(attrs.get(i).equals(attributeName)){
-							return elementName;
-						}
-					}
-					return null;
-				}
-			};
-			ElementPolicy newPolicy = ElementPolicy.Util.join(
-					elPolicies.get(elementName), policy);
-			elPolicies.put(elementName, newPolicy);
-		return this;
-	}
-
-	/**
-	 * Disallows the given elements from appearing without attributes.
-	 *
-	 * @see #DEFAULT_SKIP_IF_EMPTY
-	 * @see #allowWithoutAttributes
-	 */
-	public HtmlPolicyBuilder disallowWithoutAttributes(String... elementNames) {
-		invalidateCompiledState();
-		for (String elementName : elementNames) {
-			elementName = HtmlLexer.canonicalName(elementName);
-			skipIfEmpty.add(elementName);
-		}
-		return this;
-	}
-
-	/**
-	 * Returns an object that lets you associate policies with the given
-	 * attributes, and allow them globally or on specific elements.
-	 */
-	public AttributeBuilder allowAttributes(String... attributeNames) {
-		ImmutableList.Builder<String> b = ImmutableList.builder();
-		for (String attributeName : attributeNames) {
-			b.add(HtmlLexer.canonicalName(attributeName));
-		}
-		return new AttributeBuilder(b.build());
-	}
-
-	/**
-	 * Reverse an earlier attribute {@link #allowAttributes allow}.
-	 * <p>
-	 * For this to have an effect you must call at least one of
-	 * {@link AttributeBuilder#globally} and {@link AttributeBuilder#onElements}.
-	 * <p>
-	 * Attributes are disallowed by default, so there is no need to call this
-	 * with a laundry list of attribute/element pairs.
-	 */
-	public AttributeBuilder disallowAttributes(String... attributeNames) {
-		return this.allowAttributes(attributeNames).matching(
-				AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY);
-	}
-
-	private HtmlPolicyBuilder allowAttributesGlobally(AttributePolicy policy,
-			List<String> attributeNames) {
-		invalidateCompiledState();
-		for (String attributeName : attributeNames) {
-			// We reinterpret the identity policy later via policy joining since
-			// its
-			// the default passed from the policy-less method, but we don't do
-			// anything here since we don't know until build() is called whether
-			// the
-			// policy author wants to allow certain URL protocols or wants to
-			// deal
-			// with styles.
-			AttributePolicy oldPolicy = globalAttrPolicies.get(attributeName);
-			globalAttrPolicies.put(attributeName,
-					AttributePolicy.Util.join(oldPolicy, policy));
-		}
-		return this;
-	}
-
-	private HtmlPolicyBuilder allowAttributesOnElements(AttributePolicy policy,
-			List<String> attributeNames, List<String> elementNames) {
-		invalidateCompiledState();
-		for (String elementName : elementNames) {
-			Map<String, AttributePolicy> policies = attrPolicies
-					.get(elementName);
-			if (policies == null) {
-				policies = Maps.newLinkedHashMap();
-				attrPolicies.put(elementName, policies);
-			}
-			for (String attributeName : attributeNames) {
-				AttributePolicy oldPolicy = policies.get(attributeName);
-				policies.put(attributeName,
-						AttributePolicy.Util.join(oldPolicy, policy));
-			}
-		}
-		return this;
-	}
-
-	/**
-	 * Adds <a href="http://en.wikipedia.org/wiki/Nofollow">
-	 * <code>rel=nofollow</code></a> to links.
-	 */
-	public HtmlPolicyBuilder requireRelNofollowOnLinks() {
-		invalidateCompiledState();
-		this.requireRelNofollowOnLinks = true;
-		return this;
-	}
-
-	/**
-	 * Adds to the set of protocols that are allowed in URL attributes. For each
-	 * URL attribute that is allowed, we further constrain it by only allowing
-	 * the value through if it specifies no protocol, or if it specifies one in
-	 * the allowedProtocols white-list. This is done regardless of whether any
-	 * protocols have been allowed, so allowing the attribute "href" globally
-	 * with the identity policy but not white-listing any protocols, effectively
-	 * disallows the "href" attribute globally.
-	 * <p>
-	 * Do not allow any <code>*script</code> such as <code>javascript</code>
-	 * protocols if you might use this policy with untrusted code.
-	 */
-	public HtmlPolicyBuilder allowUrlProtocols(String... protocols) {
-		invalidateCompiledState();
-		// If there is at least one allowed protocol, then allow URLs and
-		// add a filter that checks href and src values.
-
-		// Do not allow href and srcs through otherwise, and only allow on
-		// images
-		// and links.
-		for (String protocol : protocols) {
-			protocol = Strings.toLowerCase(protocol);
-			allowedProtocols.add(protocol);
-		}
-		return this;
-	}
-
-	/**
-	 * Reverses a decision made by {@link #allowUrlProtocols}.
-	 */
-	public HtmlPolicyBuilder disallowUrlProtocols(String... protocols) {
-		invalidateCompiledState();
-		for (String protocol : protocols) {
-			protocol = Strings.toLowerCase(protocol);
-			allowedProtocols.remove(protocol);
-		}
-		return this;
-	}
-
-	/**
-	 * A canned URL protocol policy that allows <code>http</code>,
-	 * <code>https</code>, and <code>mailto</code>.
-	 */
-	public HtmlPolicyBuilder allowStandardUrlProtocols() {
-		return allowUrlProtocols("http", "https", "mailto");
-	}
-
-	/**
-	 * Convert <code>style="&lt;CSS&gt;"</code> to sanitized CSS which allows
-	 * color, font-size, type-face, and other styling using the default schema;
-	 * but which does not allow content to escape its clipping context.
-	 */
-	public HtmlPolicyBuilder allowStyling() {
-		allowStyling(CssSchema.DEFAULT);
-		return this;
-	}
-
-	/**
-	 * Convert <code>style="&lt;CSS&gt;"</code> to sanitized CSS which allows
-	 * color, font-size, type-face, and other styling using the given schema.
-	 */
-	public HtmlPolicyBuilder allowStyling(CssSchema whitelist) {
-		invalidateCompiledState();
-		allowAttributesGlobally(new StylingPolicy(whitelist),
-				ImmutableList.of("style"));
-		return this;
-	}
-
-	/**
-	 * Names of attributes from HTML 4 whose values are URLs. Other attributes,
-	 * e.g. <code>style</code> may contain URLs even though there values are not
-	 * URLs.
-	 */
-	private static final Set<String> URL_ATTRIBUTE_NAMES = ImmutableSet.of(
-			"action", "archive", "background", "cite", "classid", "codebase",
-			"data", "dsync", "formaction", "href", "icon", "longdesc",
-			"manifest", "poster", "profile", "src", "srcset", "usemap");
-
-	/**
-	 * Produces a policy based on the allow and disallow calls previously made.
-	 *
-	 * @param out
-	 *            receives calls to open only tags allowed by previous calls to
-	 *            this object. Typically a {@link HtmlStreamRenderer}.
-	 */
-	public HtmlSanitizer.Policy build(HtmlStreamEventReceiver out) {
-		return toFactory().apply(out);
-	}
-
-	/**
-	 * Produces a policy based on the allow and disallow calls previously made.
-	 *
-	 * @param out
-	 *            receives calls to open only tags allowed by previous calls to
-	 *            this object. Typically a {@link HtmlStreamRenderer}.
-	 * @param listener
-	 *            is notified of dropped tags and attributes so that intrusion
-	 *            detection systems can be alerted to questionable HTML. If
-	 *            {@code null} then no notifications are sent.
-	 * @param context
-	 *            if {@code (listener != null)} then the context value passed
-	 *            with alerts. This can be used to let the listener know from
-	 *            which connection or request the questionable HTML was
-	 *            received.
-	 */
-	public <CTX> HtmlSanitizer.Policy build(HtmlStreamEventReceiver out,
-			@Nullable HtmlChangeListener<? super CTX> listener,
-			@Nullable CTX context) {
-		return toFactory().apply(out, listener, context);
-	}
-
-	/**
-	 * Like {@link #build} but can be reused to create many different policies
-	 * each backed by a different output channel.
-	 */
-	public PolicyFactory toFactory() {
-		ImmutableSet.Builder<String> textContainerSet = ImmutableSet.builder();
-		for (Map.Entry<String, Boolean> textContainer : this.textContainers
-				.entrySet()) {
-			if (Boolean.TRUE.equals(textContainer.getValue())) {
-				textContainerSet.add(textContainer.getKey());
-			}
-		}
-		return new PolicyFactory(compilePolicies(), textContainerSet.build(),
-				ImmutableMap.copyOf(globalAttrPolicies));
-	}
-
-	// Speed up subsequent builds by caching the compiled policies.
-	private transient ImmutableMap<String, ElementAndAttributePolicies> compiledPolicies;
-
-	/** Called by mutators to signal that any compiled policy is out-of-date. */
-	private void invalidateCompiledState() {
-		compiledPolicies = null;
-	}
-
-	private ImmutableMap<String, ElementAndAttributePolicies> compilePolicies() {
-		if (compiledPolicies != null) {
-			return compiledPolicies;
-		}
-
-		// Copy maps before normalizing in case builder is reused.
-		@SuppressWarnings("hiding")
-		Map<String, ElementPolicy> elPolicies = Maps
-				.newLinkedHashMap(this.elPolicies);
-		@SuppressWarnings("hiding")
-		Map<String, Map<String, AttributePolicy>> attrPolicies = Maps
-				.newLinkedHashMap(this.attrPolicies);
-		for (Map.Entry<String, Map<String, AttributePolicy>> e : attrPolicies
-				.entrySet()) {
-			e.setValue(Maps.newLinkedHashMap(e.getValue()));
-		}
-		@SuppressWarnings("hiding")
-		Map<String, AttributePolicy> globalAttrPolicies = Maps
-				.newLinkedHashMap(this.globalAttrPolicies);
-		@SuppressWarnings("hiding")
-		Set<String> allowedProtocols = ImmutableSet
-				.copyOf(this.allowedProtocols);
-
-		// Implement requireRelNofollowOnLinks
-		if (requireRelNofollowOnLinks) {
-			ElementPolicy linkPolicy = elPolicies.get("a");
-			if (linkPolicy == null) {
-				linkPolicy = ElementPolicy.REJECT_ALL_ELEMENT_POLICY;
-			}
-			elPolicies.put("a", ElementPolicy.Util.join(linkPolicy,
-					RelNofollowPolicy.INSTANCE));
-		}
-
-		// Implement protocol policies.
-		// For each URL attribute that is allowed, we further constrain it by
-		// only allowing the value through if it specifies no protocol, or if it
-		// specifies one in the allowedProtocols white-list.
-		// This is done regardless of whether any protocols have been allowed,
-		// so
-		// allowing the attribute "href" globally with the identity policy but
-		// not white-listing any protocols, effectively disallows the "href"
-		// attribute globally.
-		{
-			AttributePolicy urlAttributePolicy;
-			if (allowedProtocols.size() == 3
-					&& allowedProtocols.contains("mailto")
-					&& allowedProtocols.contains("http")
-					&& allowedProtocols.contains("https")) {
-				urlAttributePolicy = StandardUrlAttributePolicy.INSTANCE;
-			} else {
-				urlAttributePolicy = new FilterUrlByProtocolAttributePolicy(
-						allowedProtocols);
-			}
-			Set<String> toGuard = Sets.newLinkedHashSet(URL_ATTRIBUTE_NAMES);
-			for (String urlAttributeName : URL_ATTRIBUTE_NAMES) {
-				if (globalAttrPolicies.containsKey(urlAttributeName)) {
-					toGuard.remove(urlAttributeName);
-					globalAttrPolicies.put(urlAttributeName,
-							AttributePolicy.Util.join(urlAttributePolicy,
-									globalAttrPolicies.get(urlAttributeName)));
-				}
-			}
-			// Implement guards not implemented on global policies in the
-			// per-element
-			// policy maps.
-			for (Map.Entry<String, Map<String, AttributePolicy>> e : attrPolicies
-					.entrySet()) {
-				Map<String, AttributePolicy> policies = e.getValue();
-				for (String urlAttributeName : toGuard) {
-					if (policies.containsKey(urlAttributeName)) {
-						policies.put(urlAttributeName, AttributePolicy.Util
-								.join(urlAttributePolicy,
-										policies.get(urlAttributeName)));
-					}
-				}
-			}
-		}
-
-		ImmutableMap.Builder<String, ElementAndAttributePolicies> policiesBuilder = ImmutableMap
-				.builder();
-		for (Map.Entry<String, ElementPolicy> e : elPolicies.entrySet()) {
-			String elementName = e.getKey();
-			ElementPolicy elPolicy = e.getValue();
-			if (ElementPolicy.REJECT_ALL_ELEMENT_POLICY.equals(elPolicy)) {
-				continue;
-			}
-
-			Map<String, AttributePolicy> elAttrPolicies = attrPolicies
-					.get(elementName);
-			if (elAttrPolicies == null) {
-				elAttrPolicies = ImmutableMap.of();
-			}
-			ImmutableMap.Builder<String, AttributePolicy> attrs = ImmutableMap
-					.builder();
-			for (Map.Entry<String, AttributePolicy> ape : elAttrPolicies
-					.entrySet()) {
-				String attributeName = ape.getKey();
-				// Handle below so we don't end up putting the same key into the
-				// map
-				// twice. ImmutableMap.Builder hates that.
-				if (globalAttrPolicies.containsKey(attributeName)) {
-					continue;
-				}
-				AttributePolicy policy = ape.getValue();
-				if (!AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY.equals(policy)) {
-					attrs.put(attributeName, policy);
-				}
-			}
-			for (Map.Entry<String, AttributePolicy> ape : globalAttrPolicies
-					.entrySet()) {
-				String attributeName = ape.getKey();
-				AttributePolicy policy = AttributePolicy.Util.join(
-						elAttrPolicies.get(attributeName), ape.getValue());
-				if (!AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY.equals(policy)) {
-					attrs.put(attributeName, policy);
-				}
-			}
-
-			policiesBuilder.put(elementName,
-					new ElementAndAttributePolicies(elementName, elPolicy,
-							attrs.build(), skipIfEmpty.contains(elementName)));
-		}
-		return compiledPolicies = policiesBuilder.build();
-	}
-
-	/**
-	 * Builds the relationship between attributes, the values that they may
-	 * have, and the elements on which they may appear.
-	 *
-	 * @author Mike Samuel
-	 */
-	public final class AttributeBuilder {
-		private final List<String> attributeNames;
-		private AttributePolicy policy = AttributePolicy.IDENTITY_ATTRIBUTE_POLICY;
-
-		AttributeBuilder(List<? extends String> attributeNames) {
-			this.attributeNames = ImmutableList.copyOf(attributeNames);
-		}
-
-		/**
-		 * Filters and/or transforms the attribute values allowed by later
-		 * {@code allow*} calls. Multiple calls to {@code matching} are combined
-		 * so that the policies receive the value in order, each seeing the
-		 * value after any transformation by a previous policy.
-		 */
-		public AttributeBuilder matching(AttributePolicy attrPolicy) {
-			this.policy = AttributePolicy.Util.join(this.policy, attrPolicy);
-			return this;
-		}
-
-		/**
-		 * Restrict the values allowed by later {@code allow*} calls to those
-		 * matching the pattern. Multiple calls to {@code matching} are combined
-		 * to restrict to the intersection of possible matched values.
-		 */
-		public AttributeBuilder matching(final Pattern pattern) {
-			return matching(new AttributePolicy() {
-				public @Nullable String apply(String elementName,
-						String attributeName, String value) {
-					return pattern.matcher(value).matches() ? value : null;
-				}
-			});
-		}
-
-		/**
-		 * Restrict the values allowed by later {@code allow*} calls to those
-		 * NOT matching the pattern. This is a convenience method, as inverting
-		 * RegEx patterns can become quite complex. Multiple calls to
-		 * {@code matching} are combined to restrict to the intersection of
-		 * possible matched values.
-		 */
-		public AttributeBuilder notMatching(final Pattern pattern) {
-			return matching(new AttributePolicy() {
-				public @Nullable String apply(String elementName,
-						String attributeName, String value) {
-					return !pattern.matcher(value).matches() ? value : null;
-				}
-			});
-		}
-
-		/**
-		 * Restrict the values allowed by later {@code allow*} calls to ones
-		 * that are not only whitespace or an empty string. Can be combined with
-		 * calls to {@code matching} or {@code notMatching}.
-		 */
-		public AttributeBuilder notEmptyOrWhitespace() {
-			return matching(new AttributePolicy() {
-				public @Nullable String apply(String elementName,
-						String attributeName, String value) {
-					return value.trim().length() > 0 ? value : null;
-				}
-			});
-		}
-
-		/**
-		 * Restrict the values allowed by later {@code allow*} calls to those
-		 * matching the given predicate. Multiple calls to {@code matching} are
-		 * combined to restrict to the intersection of possible matched values.
-		 */
-		public AttributeBuilder matching(final Predicate<? super String> filter) {
-			return matching(new AttributePolicy() {
-				public @Nullable String apply(String elementName,
-						String attributeName, String value) {
-					return filter.apply(value) ? value : null;
-				}
-			});
-		}
-
-		/**
-		 * Restrict the values allowed by later {@code allow*} calls to those
-		 * supplied. Multiple calls to {@code matching} are combined to restrict
-		 * to the intersection of possible matched values.
-		 */
-		public AttributeBuilder matching(boolean ignoreCase,
-				String... allowedValues) {
-			return matching(ignoreCase, ImmutableSet.copyOf(allowedValues));
-		}
-
-		/**
-		 * Restrict the values allowed by later {@code allow*} calls to those
-		 * supplied. Multiple calls to {@code matching} are combined to restrict
-		 * to the intersection of possible matched values.
-		 */
-		public AttributeBuilder matching(final boolean ignoreCase,
-				Set<? extends String> allowedValues) {
-			final ImmutableSet<String> allowed = ImmutableSet
-					.copyOf(allowedValues);
-			return matching(new AttributePolicy() {
-				public @Nullable String apply(String elementName,
-						String attributeName, String uncanonValue) {
-					String value = ignoreCase ? Strings
-							.toLowerCase(uncanonValue) : uncanonValue;
-					return allowed.contains(value) ? value : null;
-				}
-			});
-		}
-
-		/**
-		 * Allows the given attributes on any elements but filters the
-		 * attributes' values based on previous calls to {@code matching(...)}.
-		 * Global attribute policies are applied after element specific
-		 * policies. Be careful of using this with attributes like
-		 * <code>type</code> which have different meanings on different
-		 * attributes. Also be careful of allowing globally attributes like
-		 * <code>href</code> which can have more far-reaching effects on tags
-		 * like <code>&lt;base&gt;</code> and <code>&lt;link&gt;</code> than on
-		 * <code>&lt;a&gt;</code> because in the former, they have an effect
-		 * without user interaction and can change the behavior of the current
-		 * page.
-		 */
-		@SuppressWarnings("synthetic-access")
-		public HtmlPolicyBuilder globally() {
-			return HtmlPolicyBuilder.this.allowAttributesGlobally(policy,
-					attributeNames);
-		}
-
-		/**
-		 * Allows the named attributes on the given elements but filters the
-		 * attributes' values based on previous calls to {@code matching(...)}.
-		 */
-		@SuppressWarnings("synthetic-access")
-		public HtmlPolicyBuilder onElements(String... elementNames) {
-			ImmutableList.Builder<String> b = ImmutableList.builder();
-			for (String elementName : elementNames) {
-				b.add(HtmlLexer.canonicalName(elementName));
-			}
-			return HtmlPolicyBuilder.this.allowAttributesOnElements(policy,
-					attributeNames, b.build());
-		}
-	}
-
-	private static final class RelNofollowPolicy implements ElementPolicy {
-		static final RelNofollowPolicy INSTANCE = new RelNofollowPolicy();
-
-		public String apply(String elementName, List<String> attrs) {
-			for (int i = 0, n = attrs.size(); i < n; i += 2) {
-				if ("href".equals(attrs.get(i))) {
-					attrs.add("rel");
-					attrs.add("nofollow");
-					break;
-				}
-			}
-			return elementName;
-		}
-	}
+  /**
+   * The default set of elements that are removed if they have no attributes.
+   * Since {@code <img>} is in this set, by default, a policy will remove
+   * {@code <img src=javascript:alert(1337)>} because its URL is not allowed
+   * and it has no other attributes that would warrant it appearing in the
+   * output.
+   */
+  public static final ImmutableSet<String> DEFAULT_SKIP_IF_EMPTY
+      = ImmutableSet.of("a", "font", "img", "input", "span");
+
+  private final Map<String, ElementPolicy> elPolicies = Maps.newLinkedHashMap();
+  private final Map<String, Map<String, AttributePolicy>> attrPolicies
+      = Maps.newLinkedHashMap();
+  private final Map<String, AttributePolicy> globalAttrPolicies
+      = Maps.newLinkedHashMap();
+  private final Set<String> allowedProtocols = Sets.newLinkedHashSet();
+  private final Set<String> skipIfEmpty = Sets.newLinkedHashSet(
+      DEFAULT_SKIP_IF_EMPTY);
+  private final Map<String, Boolean> textContainers = Maps.newLinkedHashMap();
+  private boolean requireRelNofollowOnLinks;
+
+  /**
+   * Allows the named elements.
+   */
+  public HtmlPolicyBuilder allowElements(String... elementNames) {
+    return allowElements(ElementPolicy.IDENTITY_ELEMENT_POLICY, elementNames);
+  }
+
+  /**
+   * Disallows the named elements.  Elements are disallowed by default, so
+   * there is no need to disallow elements, unless you are making an exception
+   * based on an earlier allow.
+   */
+  public HtmlPolicyBuilder disallowElements(String... elementNames) {
+    return allowElements(ElementPolicy.REJECT_ALL_ELEMENT_POLICY, elementNames);
+  }
+
+  /**
+   * Allow the given elements with the given policy.
+   *
+   * @param policy May remove or add attributes, change the element name, or
+   *    deny the element.
+   */
+  public HtmlPolicyBuilder allowElements(
+      ElementPolicy policy, String... elementNames) {
+    invalidateCompiledState();
+    for (String elementName : elementNames) {
+      elementName = HtmlLexer.canonicalName(elementName);
+      ElementPolicy newPolicy = ElementPolicy.Util.join(
+          elPolicies.get(elementName), policy);
+      // Don't remove if newPolicy is the always reject policy since we want
+      // that to infect later allowElement calls for this particular element
+      // name.  rejects should have higher priority than allows.
+      elPolicies.put(elementName, newPolicy);
+      if (!textContainers.containsKey(elementName)
+          && TagBalancingHtmlStreamEventReceiver
+              .allowsPlainTextualContent(elementName)) {
+        textContainers.put(elementName, true);
+      }
+    }
+    return this;
+  }
+
+  /**
+   * A canned policy that allows a number of common formatting elements.
+   */
+  public HtmlPolicyBuilder allowCommonInlineFormattingElements() {
+    return allowElements(
+        "b", "i", "font", "s", "u", "o", "sup", "sub", "ins", "del", "strong",
+        "strike", "tt", "code", "big", "small", "br", "span", "em");
+  }
+
+  /**
+   * A canned policy that allows a number of common block elements.
+   */
+  public HtmlPolicyBuilder allowCommonBlockElements() {
+    return allowElements(
+        "p", "div", "h1", "h2", "h3", "h4", "h5", "h6", "ul", "ol", "li",
+        "blockquote");
+  }
+
+  /**
+   * Allows text content in the named elements.
+   * By default, text content is allowed in any
+   * {@link #allowElements allowed elements} that can contain character data per
+   * the HTML5 spec, but text content is not allowed by default in elements that
+   * contain content of other kinds (like JavaScript in {@code <script>}
+   * elements.
+   * <p>
+   * To write a policy that whitelists {@code <script>} or {@code <style>}
+   * elements, first {@code allowTextIn("script")}.
+   */
+  public HtmlPolicyBuilder allowTextIn(String... elementNames) {
+    invalidateCompiledState();
+    for (String elementName : elementNames) {
+      elementName = HtmlLexer.canonicalName(elementName);
+      textContainers.put(elementName, true);
+    }
+    return this;
+  }
+
+  /**
+   * Disallows text in elements with the given name.
+   * <p>
+   * This is useful when an element contains text that is not meant to be
+   * displayed to the end-user.
+   * Typically these elements are styled {@code display:none} in browsers'
+   * default stylesheets, or, like {@code <template>} contain text nodes that
+   * are eventually for human consumption, but which are created in a separate
+   * document fragment.
+   */
+  public HtmlPolicyBuilder disallowTextIn(String... elementNames) {
+    invalidateCompiledState();
+    for (String elementName : elementNames) {
+      elementName = HtmlLexer.canonicalName(elementName);
+      textContainers.put(elementName, false);
+    }
+    return this;
+  }
+
+  /**
+   * Assuming the given elements are allowed, allows them to appear without
+   * attributes.
+   *
+   * @see #DEFAULT_SKIP_IF_EMPTY
+   * @see #disallowWithoutAttributes
+   */
+  public HtmlPolicyBuilder allowWithoutAttributes(String... elementNames) {
+    invalidateCompiledState();
+    for (String elementName : elementNames) {
+      elementName = HtmlLexer.canonicalName(elementName);
+      skipIfEmpty.remove(elementName);
+    }
+    return this;
+  }
+
+  /**
+   * Disallows the given elements from appearing without attributes.
+   *
+   * @see #DEFAULT_SKIP_IF_EMPTY
+   * @see #allowWithoutAttributes
+   */
+  public HtmlPolicyBuilder disallowWithoutAttributes(String... elementNames) {
+    invalidateCompiledState();
+    for (String elementName : elementNames) {
+      elementName = HtmlLexer.canonicalName(elementName);
+      skipIfEmpty.add(elementName);
+    }
+    return this;
+  }
+
+  /**
+   * Returns an object that lets you associate policies with the given
+   * attributes, and allow them globally or on specific elements.
+   */
+  public AttributeBuilder allowAttributes(String... attributeNames) {
+    ImmutableList.Builder<String> b = ImmutableList.builder();
+    for (String attributeName : attributeNames) {
+      b.add(HtmlLexer.canonicalName(attributeName));
+    }
+    return new AttributeBuilder(b.build());
+  }
+
+  /**
+   * Reverse an earlier attribute {@link #allowAttributes allow}.
+   * <p>
+   * For this to have an effect you must call at least one of
+   * {@link AttributeBuilder#globally} and {@link AttributeBuilder#onElements}.
+   * <p>
+   * Attributes are disallowed by default, so there is no need to call this
+   * with a laundry list of attribute/element pairs.
+   */
+  public AttributeBuilder disallowAttributes(String... attributeNames) {
+    return this.allowAttributes(attributeNames)
+        .matching(AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY);
+  }
+
+
+  private HtmlPolicyBuilder allowAttributesGlobally(
+      AttributePolicy policy, List<String> attributeNames) {
+    invalidateCompiledState();
+    for (String attributeName : attributeNames) {
+      // We reinterpret the identity policy later via policy joining since its
+      // the default passed from the policy-less method, but we don't do
+      // anything here since we don't know until build() is called whether the
+      // policy author wants to allow certain URL protocols or wants to deal
+      // with styles.
+      AttributePolicy oldPolicy = globalAttrPolicies.get(attributeName);
+      globalAttrPolicies.put(
+          attributeName, AttributePolicy.Util.join(oldPolicy, policy));
+    }
+    return this;
+  }
+
+  private HtmlPolicyBuilder allowAttributesOnElements(
+      AttributePolicy policy, List<String> attributeNames,
+      List<String> elementNames) {
+    invalidateCompiledState();
+    for (String elementName : elementNames) {
+      Map<String, AttributePolicy> policies = attrPolicies.get(elementName);
+      if (policies == null) {
+        policies = Maps.newLinkedHashMap();
+        attrPolicies.put(elementName, policies);
+      }
+      for (String attributeName : attributeNames) {
+        AttributePolicy oldPolicy = policies.get(attributeName);
+        policies.put(
+            attributeName,
+            AttributePolicy.Util.join(oldPolicy, policy));
+      }
+    }
+    return this;
+  }
+
+  /**
+   * Adds <a href="http://en.wikipedia.org/wiki/Nofollow"><code>rel=nofollow</code></a>
+   * to links.
+   */
+  public HtmlPolicyBuilder requireRelNofollowOnLinks() {
+    invalidateCompiledState();
+    this.requireRelNofollowOnLinks = true;
+    return this;
+  }
+
+  /**
+   * Adds to the set of protocols that are allowed in URL attributes.
+   * For each URL attribute that is allowed, we further constrain it by
+   * only allowing the value through if it specifies no protocol, or if it
+   * specifies one in the allowedProtocols white-list.
+   * This is done regardless of whether any protocols have been allowed, so
+   * allowing the attribute "href" globally with the identity policy but
+   * not white-listing any protocols, effectively disallows the "href"
+   * attribute globally.
+   * <p>
+   * Do not allow any <code>*script</code> such as <code>javascript</code>
+   * protocols if you might use this policy with untrusted code.
+   */
+  public HtmlPolicyBuilder allowUrlProtocols(String... protocols) {
+    invalidateCompiledState();
+    // If there is at least one allowed protocol, then allow URLs and
+    // add a filter that checks href and src values.
+
+    // Do not allow href and srcs through otherwise, and only allow on images
+    // and links.
+    for (String protocol : protocols) {
+      protocol = Strings.toLowerCase(protocol);
+      allowedProtocols.add(protocol);
+    }
+    return this;
+  }
+
+  /**
+   * Reverses a decision made by {@link #allowUrlProtocols}.
+   */
+  public HtmlPolicyBuilder disallowUrlProtocols(String... protocols) {
+    invalidateCompiledState();
+    for (String protocol : protocols) {
+      protocol = Strings.toLowerCase(protocol);
+      allowedProtocols.remove(protocol);
+    }
+    return this;
+  }
+
+  /**
+   * A canned URL protocol policy that allows <code>http</code>,
+   * <code>https</code>, and <code>mailto</code>.
+   */
+  public HtmlPolicyBuilder allowStandardUrlProtocols() {
+    return allowUrlProtocols("http", "https", "mailto");
+  }
+
+  /**
+   * Convert <code>style="&lt;CSS&gt;"</code> to sanitized CSS which allows
+   * color, font-size, type-face, and other styling using the default schema;
+   * but which does not allow content to escape its clipping context.
+   */
+  public HtmlPolicyBuilder allowStyling() {
+    allowStyling(CssSchema.DEFAULT);
+    return this;
+  }
+
+  /**
+   * Convert <code>style="&lt;CSS&gt;"</code> to sanitized CSS which allows
+   * color, font-size, type-face, and other styling using the given schema.
+   */
+  public HtmlPolicyBuilder allowStyling(CssSchema whitelist) {
+    invalidateCompiledState();
+    allowAttributesGlobally(
+        new StylingPolicy(whitelist), ImmutableList.of("style"));
+    return this;
+  }
+
+  /**
+   * Names of attributes from HTML 4 whose values are URLs.
+   * Other attributes, e.g. <code>style</code> may contain URLs even though
+   * there values are not URLs.
+   */
+  private static final Set<String> URL_ATTRIBUTE_NAMES = ImmutableSet.of(
+      "action", "archive", "background", "cite", "classid", "codebase", "data",
+      "dsync", "formaction", "href", "icon", "longdesc", "manifest", "poster",
+      "profile", "src", "srcset", "usemap");
+
+  /**
+   * Produces a policy based on the allow and disallow calls previously made.
+   *
+   * @param out receives calls to open only tags allowed by
+   *      previous calls to this object.
+   *      Typically a {@link HtmlStreamRenderer}.
+   */
+  public HtmlSanitizer.Policy build(HtmlStreamEventReceiver out) {
+    return toFactory().apply(out);
+  }
+
+  /**
+   * Produces a policy based on the allow and disallow calls previously made.
+   *
+   * @param out receives calls to open only tags allowed by
+   *      previous calls to this object.
+   *      Typically a {@link HtmlStreamRenderer}.
+   * @param listener is notified of dropped tags and attributes so that
+   *      intrusion detection systems can be alerted to questionable HTML.
+   *      If {@code null} then no notifications are sent.
+   * @param context if {@code (listener != null)} then the context value passed
+   *      with alerts.  This can be used to let the listener know from which
+   *      connection or request the questionable HTML was received.
+   */
+  public <CTX> HtmlSanitizer.Policy build(
+      HtmlStreamEventReceiver out,
+      @Nullable HtmlChangeListener<? super CTX> listener,
+      @Nullable CTX context) {
+    return toFactory().apply(out, listener, context);
+  }
+
+  /**
+   * Like {@link #build} but can be reused to create many different policies
+   * each backed by a different output channel.
+   */
+  public PolicyFactory toFactory() {
+    ImmutableSet.Builder<String> textContainerSet = ImmutableSet.builder();
+    for (Map.Entry<String, Boolean> textContainer
+         : this.textContainers.entrySet()) {
+      if (Boolean.TRUE.equals(textContainer.getValue())) {
+        textContainerSet.add(textContainer.getKey());
+      }
+    }
+    return new PolicyFactory(compilePolicies(), textContainerSet.build(),
+                             ImmutableMap.copyOf(globalAttrPolicies));
+  }
+
+  // Speed up subsequent builds by caching the compiled policies.
+  private transient ImmutableMap<String, ElementAndAttributePolicies>
+      compiledPolicies;
+
+  /** Called by mutators to signal that any compiled policy is out-of-date. */
+  private void invalidateCompiledState() {
+    compiledPolicies = null;
+  }
+
+  private ImmutableMap<String, ElementAndAttributePolicies> compilePolicies() {
+    if (compiledPolicies != null) { return compiledPolicies; }
+
+    // Copy maps before normalizing in case builder is reused.
+    @SuppressWarnings("hiding")
+    Map<String, ElementPolicy> elPolicies
+        = Maps.newLinkedHashMap(this.elPolicies);
+    @SuppressWarnings("hiding")
+    Map<String, Map<String, AttributePolicy>> attrPolicies
+        = Maps.newLinkedHashMap(this.attrPolicies);
+    for (Map.Entry<String, Map<String, AttributePolicy>> e :
+         attrPolicies.entrySet()) {
+      e.setValue(Maps.newLinkedHashMap(e.getValue()));
+    }
+    @SuppressWarnings("hiding")
+    Map<String, AttributePolicy> globalAttrPolicies
+        = Maps.newLinkedHashMap(this.globalAttrPolicies);
+    @SuppressWarnings("hiding")
+    Set<String> allowedProtocols = ImmutableSet.copyOf(this.allowedProtocols);
+
+    // Implement requireRelNofollowOnLinks
+    if (requireRelNofollowOnLinks) {
+      ElementPolicy linkPolicy = elPolicies.get("a");
+      if (linkPolicy == null) {
+        linkPolicy = ElementPolicy.REJECT_ALL_ELEMENT_POLICY;
+      }
+      elPolicies.put(
+          "a",
+          ElementPolicy.Util.join(linkPolicy, RelNofollowPolicy.INSTANCE));
+    }
+
+    // Implement protocol policies.
+    // For each URL attribute that is allowed, we further constrain it by
+    // only allowing the value through if it specifies no protocol, or if it
+    // specifies one in the allowedProtocols white-list.
+    // This is done regardless of whether any protocols have been allowed, so
+    // allowing the attribute "href" globally with the identity policy but
+    // not white-listing any protocols, effectively disallows the "href"
+    // attribute globally.
+    {
+      AttributePolicy urlAttributePolicy;
+      if (allowedProtocols.size() == 3
+          && allowedProtocols.contains("mailto")
+          && allowedProtocols.contains("http")
+          && allowedProtocols.contains("https")) {
+        urlAttributePolicy = StandardUrlAttributePolicy.INSTANCE;
+      } else {
+        urlAttributePolicy = new FilterUrlByProtocolAttributePolicy(
+            allowedProtocols);
+      }
+      Set<String> toGuard = Sets.newLinkedHashSet(URL_ATTRIBUTE_NAMES);
+      for (String urlAttributeName : URL_ATTRIBUTE_NAMES) {
+        if (globalAttrPolicies.containsKey(urlAttributeName)) {
+          toGuard.remove(urlAttributeName);
+          globalAttrPolicies.put(urlAttributeName, AttributePolicy.Util.join(
+              urlAttributePolicy, globalAttrPolicies.get(urlAttributeName)));
+        }
+      }
+      // Implement guards not implemented on global policies in the per-element
+      // policy maps.
+      for (Map.Entry<String, Map<String, AttributePolicy>> e
+           : attrPolicies.entrySet()) {
+        Map<String, AttributePolicy> policies = e.getValue();
+        for (String urlAttributeName : toGuard) {
+          if (policies.containsKey(urlAttributeName)) {
+            policies.put(urlAttributeName, AttributePolicy.Util.join(
+                urlAttributePolicy, policies.get(urlAttributeName)));
+          }
+        }
+      }
+    }
+
+    ImmutableMap.Builder<String, ElementAndAttributePolicies> policiesBuilder
+        = ImmutableMap.builder();
+    for (Map.Entry<String, ElementPolicy> e : elPolicies.entrySet()) {
+      String elementName = e.getKey();
+      ElementPolicy elPolicy = e.getValue();
+      if (ElementPolicy.REJECT_ALL_ELEMENT_POLICY.equals(elPolicy)) {
+        continue;
+      }
+
+      Map<String, AttributePolicy> elAttrPolicies
+          = attrPolicies.get(elementName);
+      if (elAttrPolicies == null) { elAttrPolicies = ImmutableMap.of(); }
+      ImmutableMap.Builder<String, AttributePolicy> attrs
+          = ImmutableMap.builder();
+      for (Map.Entry<String, AttributePolicy> ape : elAttrPolicies.entrySet()) {
+        String attributeName = ape.getKey();
+        // Handle below so we don't end up putting the same key into the map
+        // twice.  ImmutableMap.Builder hates that.
+        if (globalAttrPolicies.containsKey(attributeName)) { continue; }
+        AttributePolicy policy = ape.getValue();
+        if (!AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY.equals(policy)) {
+          attrs.put(attributeName, policy);
+        }
+      }
+      for (Map.Entry<String, AttributePolicy> ape
+           : globalAttrPolicies.entrySet()) {
+        String attributeName = ape.getKey();
+        AttributePolicy policy = AttributePolicy.Util.join(
+            elAttrPolicies.get(attributeName), ape.getValue());
+        if (!AttributePolicy.REJECT_ALL_ATTRIBUTE_POLICY.equals(policy)) {
+          attrs.put(attributeName, policy);
+        }
+      }
+
+      policiesBuilder.put(
+          elementName,
+          new ElementAndAttributePolicies(
+              elementName,
+              elPolicy, attrs.build(), skipIfEmpty.contains(elementName)));
+    }
+    return compiledPolicies = policiesBuilder.build();
+  }
+
+  /**
+   * Builds the relationship between attributes, the values that they may have,
+   * and the elements on which they may appear.
+   *
+   * @author Mike Samuel
+   */
+  public final class AttributeBuilder {
+    private final List<String> attributeNames;
+    private AttributePolicy policy = AttributePolicy.IDENTITY_ATTRIBUTE_POLICY;
+
+    AttributeBuilder(List<? extends String> attributeNames) {
+      this.attributeNames = ImmutableList.copyOf(attributeNames);
+    }
+
+    /**
+     * Filters and/or transforms the attribute values
+     * allowed by later {@code allow*} calls.
+     * Multiple calls to {@code matching} are combined so that the policies
+     * receive the value in order, each seeing the value after any
+     * transformation by a previous policy.
+     */
+    public AttributeBuilder matching(AttributePolicy attrPolicy) {
+      this.policy = AttributePolicy.Util.join(this.policy, attrPolicy);
+      return this;
+    }
+
+    /**
+     * Restrict the values allowed by later {@code allow*} calls to those
+     * matching the pattern.
+     * Multiple calls to {@code matching} are combined to restrict to the
+     * intersection of possible matched values.
+     */
+    public AttributeBuilder matching(final Pattern pattern) {
+      return matching(new AttributePolicy() {
+        public @Nullable String apply(
+            String elementName, String attributeName, String value) {
+          return pattern.matcher(value).matches() ? value : null;
+        }
+      });
+    }
+
+    /**
+     * Restrict the values allowed by later {@code allow*} calls to those
+     * matching the given predicate.
+     * Multiple calls to {@code matching} are combined to restrict to the
+     * intersection of possible matched values.
+     */
+    public AttributeBuilder matching(
+        final Predicate<? super String> filter) {
+      return matching(new AttributePolicy() {
+        public @Nullable String apply(
+            String elementName, String attributeName, String value) {
+          return filter.apply(value) ? value : null;
+        }
+      });
+    }
+
+    /**
+     * Restrict the values allowed by later {@code allow*} calls to those
+     * supplied.
+     * Multiple calls to {@code matching} are combined to restrict to the
+     * intersection of possible matched values.
+     */
+    public AttributeBuilder matching(
+        boolean ignoreCase, String... allowedValues) {
+      return matching(ignoreCase, ImmutableSet.copyOf(allowedValues));
+    }
+
+    /**
+     * Restrict the values allowed by later {@code allow*} calls to those
+     * supplied.
+     * Multiple calls to {@code matching} are combined to restrict to the
+     * intersection of possible matched values.
+     */
+    public AttributeBuilder matching(
+        final boolean ignoreCase, Set<? extends String> allowedValues) {
+      final ImmutableSet<String> allowed = ImmutableSet.copyOf(allowedValues);
+      return matching(new AttributePolicy() {
+        public @Nullable String apply(
+            String elementName, String attributeName, String uncanonValue) {
+          String value = ignoreCase
+              ? Strings.toLowerCase(uncanonValue)
+              : uncanonValue;
+          return allowed.contains(value) ? value : null;
+        }
+      });
+    }
+
+    /**
+     * Allows the given attributes on any elements but filters the
+     * attributes' values based on previous calls to {@code matching(...)}.
+     * Global attribute policies are applied after element specific policies.
+     * Be careful of using this with attributes like <code>type</code> which
+     * have different meanings on different attributes.
+     * Also be careful of allowing globally attributes like <code>href</code>
+     * which can have more far-reaching effects on tags like
+     * <code>&lt;base&gt;</code> and <code>&lt;link&gt;</code> than on
+     * <code>&lt;a&gt;</code> because in the former, they have an effect without
+     * user interaction and can change the behavior of the current page.
+     */
+    @SuppressWarnings("synthetic-access")
+    public HtmlPolicyBuilder globally() {
+      return HtmlPolicyBuilder.this.allowAttributesGlobally(
+          policy, attributeNames);
+    }
+
+    /**
+     * Allows the named attributes on the given elements but filters the
+     * attributes' values based on previous calls to {@code matching(...)}.
+     */
+    @SuppressWarnings("synthetic-access")
+    public HtmlPolicyBuilder onElements(String... elementNames) {
+      ImmutableList.Builder<String> b = ImmutableList.builder();
+      for (String elementName : elementNames) {
+        b.add(HtmlLexer.canonicalName(elementName));
+      }
+      return HtmlPolicyBuilder.this.allowAttributesOnElements(
+          policy, attributeNames, b.build());
+    }
+  }
+
+
+  private static final class RelNofollowPolicy implements ElementPolicy {
+    static final RelNofollowPolicy INSTANCE = new RelNofollowPolicy();
+
+    public String apply(String elementName, List<String> attrs) {
+      for (int i = 0, n = attrs.size(); i < n; i += 2) {
+        if ("href".equals(attrs.get(i))) {
+          attrs.add("rel");
+          attrs.add("nofollow");
+          break;
+        }
+      }
+      return elementName;
+    }
+  }
 }
diff --git a/src/main/java/org/owasp/html/HtmlStreamRenderer.java b/src/main/java/org/owasp/html/HtmlStreamRenderer.java
index 121f2d88..b1e22f8d 100644
--- a/src/main/java/org/owasp/html/HtmlStreamRenderer.java
+++ b/src/main/java/org/owasp/html/HtmlStreamRenderer.java
@@ -74,6 +74,9 @@ public static HtmlStreamRenderer create(
     if (output instanceof Closeable) {
       return new CloseableHtmlStreamRenderer(
           output, ioExHandler, badHtmlHandler);
+    } else if (output instanceof AutoCloseable) {
+      return new AutoCloseableHtmlStreamRenderer(
+          output, ioExHandler, badHtmlHandler);
     } else {
       return new HtmlStreamRenderer(output, ioExHandler, badHtmlHandler);
     }
@@ -418,4 +421,23 @@ public void close() throws IOException {
       closeable.close();
     }
   }
+
+  static class AutoCloseableHtmlStreamRenderer extends HtmlStreamRenderer
+  implements AutoCloseable {
+    private final AutoCloseable closeable;
+
+    @SuppressWarnings("synthetic-access")
+    AutoCloseableHtmlStreamRenderer(
+        @WillCloseWhenClosed
+        Appendable output, Handler<? super IOException> errorHandler,
+        Handler<? super String> badHtmlHandler) {
+      super(output, errorHandler, badHtmlHandler);
+      this.closeable = (AutoCloseable) output;
+    }
+
+    public void close() throws Exception {
+      if (isDocumentOpen()) { closeDocument(); }
+      closeable.close();
+    }
+  }
 }

From ea02e71d267e104398e306a67d6246ce511e1930 Mon Sep 17 00:00:00 2001
From: Sebastian Uecker <sebastian.uecker@forum-is.de>
Date: Fri, 9 Oct 2015 16:33:13 +0200
Subject: [PATCH 03/28] added methods for excluding elements with specific
 empty or missing attributes or elements that do NOT match a pattern

---
 .../org/owasp/html/HtmlPolicyBuilder.java     | 49 ++++++++++++++++++-
 1 file changed, 48 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
index d7a6ea76..9e349c35 100644
--- a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
+++ b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
@@ -288,7 +288,28 @@ public HtmlPolicyBuilder allowWithoutAttributes(String... elementNames) {
     }
     return this;
   }
-
+  	
+  /**
+   * Disallows the given element from appearing without the given attribute.
+   */
+  public HtmlPolicyBuilder disallowWithoutAttribute(String elementName, final String attributeName) {
+    invalidateCompiledState();
+    elementName = HtmlLexer.canonicalName(elementName);
+    ElementPolicy policy = new ElementPolicy() {
+      public @Nullable String apply(String elementName, List<String> attrs) {
+        for(int i=0; i<attrs.size(); i+=2) {
+          if(attrs.get(i).equals(attributeName)){
+            return elementName;
+          }
+        }
+        return null;
+      }
+    };
+    ElementPolicy newPolicy = ElementPolicy.Util.join(elPolicies.get(elementName), policy);
+    elPolicies.put(elementName, newPolicy);
+    return this;
+  }
+	
   /**
    * Disallows the given elements from appearing without attributes.
    *
@@ -714,6 +735,32 @@ public AttributeBuilder matching(
       });
     }
 
+	/**
+     * Restrict the values allowed by later {@code allow*} calls to those
+     * NOT matching the pattern. This is a convenience method, as inverting
+     * certain patterns can otherwise be quite complex.
+     */
+    public AttributeBuilder notMatching(final Pattern pattern) {
+      return matching(new AttributePolicy() {
+        public @Nullable String apply(String elementName, String attributeName, String value) {
+          return !pattern.matcher(value).matches() ? value : null;
+        }
+      });
+    }
+
+    /**
+     * Restrict the values allowed by later {@code allow*} calls to those
+     * that are not only whitespace or an empty string. Can be combined 
+	 * with calls to {@code matching} or {@code notMatching}.
+     */
+    public AttributeBuilder notEmptyOrWhitespace() {
+      return matching(new AttributePolicy() {
+        public @Nullable String apply(String elementName, String attributeName, String value) {
+          return value.trim().length() > 0 ? value : null;
+        }
+      });
+    }
+	
     /**
      * Allows the given attributes on any elements but filters the
      * attributes' values based on previous calls to {@code matching(...)}.

From 2537933bebc7b07ff05317accde0d4af012b4269 Mon Sep 17 00:00:00 2001
From: Sebastian Uecker <sebastian.uecker@forum-is.de>
Date: Mon, 9 Nov 2015 15:25:07 +0100
Subject: [PATCH 04/28] Added TestCase for disallowWithoutAttribute()

---
 .../org/owasp/html/HtmlPolicyBuilderTest.java | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
index 7250d0bf..4c253d25 100644
--- a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
+++ b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
@@ -46,6 +46,7 @@ public class HtmlPolicyBuilderTest extends TestCase {
        + " <a href='http://outside.org/'>out</a></p>"),
       ("<p><img src=canary.png alt=local-canary>" +
        "<img src='http://canaries.org/canary.png'></p>"),
+       "<p><img alt='' /></p>",
       "<p><b style=font-size:bigger>Fancy</b> with <i><b>soupy</i> tags</b>.",
       "<p style='color: expression(foo()); text-align: center;",
       "          /* direction: ltr */; font-weight: bold'>Stylish Para 1</p>",
@@ -61,6 +62,7 @@ public static final void testTextFilter() {
             "Paragraph 1",
             "Click me out",
             "",
+            "",
             "Fancy with soupy tags.",
             "Stylish Para 1",
             "Stylish Para 2",
@@ -76,6 +78,7 @@ public static final void testCannedFormattingTagFilter() {
             "Paragraph 1",
             "Click me out",
             "",
+            "",
             "<b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
             "Stylish Para 1",
             "Stylish Para 2",
@@ -92,6 +95,7 @@ public static final void testCannedFormattingTagFilterNoItalics() {
             "Paragraph 1",
             "Click me out",
             "",
+            "",
             "<b>Fancy</b> with <b>soupy</b><b> tags</b>.",
             "Stylish Para 1",
             "Stylish Para 2",
@@ -109,6 +113,7 @@ public static final void testSimpleTagFilter() {
             "Paragraph 1",
             "Click me out",
             "",
+            "",
             "Fancy with <i>soupy</i> tags.",
             "Stylish Para 1",
             "Stylish Para 2",
@@ -126,6 +131,7 @@ public static final void testLinksAllowed() {
             // We haven't allowed any protocols so only relative URLs are OK.
             "Click <a href=\"foo.html\">me</a> out",
             "",
+            "",
             "Fancy with soupy tags.",
             "Stylish Para 1",
             "Stylish Para 2",
@@ -144,6 +150,7 @@ public static final void testExternalLinksAllowed() {
             "Click <a href=\"foo.html\">me</a>"
             + " <a href=\"http://outside.org/\">out</a>",
             "",
+            "",
             "Fancy with soupy tags.",
             "Stylish Para 1",
             "Stylish Para 2",
@@ -163,6 +170,7 @@ public static final void testLinksWithNofollow() {
             "Paragraph 1",
             "Click <a href=\"foo.html\" rel=\"nofollow\">me</a> out",
             "",
+            "",
             "Fancy with soupy tags.",
             "Stylish Para 1",
             "Stylish Para 2",
@@ -182,6 +190,7 @@ public static final void testImagesAllowed() {
             "Paragraph 1",
             "Click me out",
             "<img src=\"canary.png\" alt=\"local-canary\" />",
+            "<img alt=\"\" />",
             // HTTP img not output because only HTTPS allowed.
             "Fancy with soupy tags.",
             "Stylish Para 1",
@@ -201,6 +210,7 @@ public static final void testStyleFiltering() {
             "<p>Paragraph 1</p>",
             "<p>Click me out</p>",
             "<p></p>",
+            "<p></p>",
             "<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
             ("</p><p style=\"text-align:center;font-weight:bold\">"
              + "Stylish Para 1</p>"),
@@ -222,6 +232,7 @@ public static final void testElementTransforming() {
             "<p>Paragraph 1</p>",
             "<p>Click me out</p>",
             "<p></p>",
+            "<p></p>",
             "<p>Fancy with soupy tags.",
             "</p><p>Stylish Para 1</p>",
             "<p>Stylish Para 2</p>",
@@ -248,6 +259,7 @@ public static final void testAllowUrlProtocols() {
             "Click me out",
             "<img src=\"canary.png\" alt=\"local-canary\" />"
             + "<img src=\"http://canaries.org/canary.png\" />",
+            "<img alt=\"\" />",
             "Fancy with soupy tags.",
             "Stylish Para 1",
             "Stylish Para 2",
@@ -258,6 +270,27 @@ public static final void testAllowUrlProtocols() {
             .allowUrlProtocols("http")));
   }
 
+  @Test
+  public static final void testImgDisallowMissingSrc() {
+    assertEquals(
+        Joiner.on('\n').join(
+            "Header",
+            "Paragraph 1",
+            "Click me out",
+            "<img src=\"canary.png\" alt=\"local-canary\" />"
+            + "<img src=\"http://canaries.org/canary.png\" />",
+            "",
+            "Fancy with soupy tags.",
+            "Stylish Para 1",
+            "Stylish Para 2",
+            ""),
+            apply(new HtmlPolicyBuilder()
+            .allowElements("img")
+	        .allowAttributes("src", "alt").onElements("img")
+            .allowUrlProtocols("http")
+	        .disallowWithoutAttribute("img", "src")));
+  }
+
   @Test
   public static final void testPossibleFalloutFromIssue5() {
     assertEquals(

From e6dd2eabcaa0934b226d69cbbda3958be106361a Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 15 Jun 2020 11:44:51 -0400
Subject: [PATCH 05/28] s/master/main/ for default branch

---
 RELEASE-checklist.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/RELEASE-checklist.sh b/RELEASE-checklist.sh
index 9315800d..c871ccf8 100644
--- a/RELEASE-checklist.sh
+++ b/RELEASE-checklist.sh
@@ -92,7 +92,7 @@ find . -name pom.xml \
 
 git commit -am "Bumped dev version"
 
-git push origin master --tags
+git push origin main --tags
 
 # Now Release
 echo '1. Go to oss.sonatype.org'

From f3f56d4d2555f55f46af39b0c074eb0888b43900 Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 15 Jun 2020 12:04:58 -0400
Subject: [PATCH 06/28] Release candidate 20200615.1

---
 README.md               | 10 +++++-----
 aggregate/pom.xml       |  4 ++--
 change_log.md           |  7 +++++--
 docs/getting_started.md | 10 +++++-----
 docs/maven.md           |  2 +-
 empiricism/pom.xml      |  4 ++--
 html-types/pom.xml      |  4 ++--
 parent/pom.xml          |  2 +-
 pom.xml                 |  2 +-
 9 files changed, 24 insertions(+), 21 deletions(-)

diff --git a/README.md b/README.md
index abdf69b0..dd2b3533 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ how to get started with or without Maven.
 ## Prepackaged Policies
 
 You can use
-[prepackaged policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/org/owasp/html/Sanitizers.html):
+[prepackaged policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/Sanitizers.html):
 
 ```Java
 PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
@@ -47,7 +47,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
 The
 [tests](https://github.com/OWASP/java-html-sanitizer/blob/master/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java)
 show how to configure your own
-[policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/org/owasp/html/HtmlPolicyBuilder.html):
+[policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlPolicyBuilder.html):
 
 ```Java
 PolicyFactory policy = new HtmlPolicyBuilder()
@@ -62,7 +62,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
 ## Custom Policies
 
 You can write
-[custom policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/org/owasp/html/ElementPolicy.html)
+[custom policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/ElementPolicy.html)
 to do things like changing `h1`s to `div`s with a certain class:
 
 ```Java
@@ -85,7 +85,7 @@ need to be explicitly whitelisted using the `allowWithoutAttributes()`
 method if you want them to be allowed through the filter when these
 elements do not include any attributes.
 
-[Attribute policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/org/owasp/html/AttributePolicy.html) allow running custom code too.  Adding an attribute policy will not water down any default policy like `style` or URL attribute checks.
+[Attribute policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/AttributePolicy.html) allow running custom code too.  Adding an attribute policy will not water down any default policy like `style` or URL attribute checks.
 
 ```Java
 new HtmlPolicyBuilder = new HtmlPolicyBuilder()
@@ -153,7 +153,7 @@ of the output.
 
 ## Telemetry
 
-When a policy rejects an element or attribute it notifies an [HtmlChangeListener](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/org/owasp/html/HtmlChangeListener.html).
+When a policy rejects an element or attribute it notifies an [HtmlChangeListener](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlChangeListener.html).
 
 You can use this to keep track of policy violation trends and find out when someone
 is making an effort to breach your security.
diff --git a/aggregate/pom.xml b/aggregate/pom.xml
index 2673aa37..f41ff770 100644
--- a/aggregate/pom.xml
+++ b/aggregate/pom.xml
@@ -3,12 +3,12 @@
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>aggregate</artifactId>
   <packaging>pom</packaging>
-  <version>20191001.2-SNAPSHOT</version>
+  <version>20200615.1</version>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20191001.2-SNAPSHOT</version>
+    <version>20200615.1</version>
   </parent>
 
   <modules>
diff --git a/change_log.md b/change_log.md
index 8cd2b6a4..ce66fe97 100644
--- a/change_log.md
+++ b/change_log.md
@@ -1,8 +1,11 @@
 # OWASP Java HTML Sanitizer Change Log
 
 Most recent at top.
-  * Pending
-    * Fix table formatting
+  * Release 20200615.1
+    * Change `.and` when combining two policies to respect explicit `skipIfEmpty` decisions.
+    * HTML entity decoding now follows HTML standard rules about when a semicolon is optional.
+      [Fixes #193](https://github.com/OWASP/java-html-sanitizer/issues/193)
+    * Fix table formatting [#137](https://github.com/OWASP/java-html-sanitizer/issues/137)
   * Release 20191001.1
     * Package as an OSGI bundle
   * Release 20190610.1
diff --git a/docs/getting_started.md b/docs/getting_started.md
index a46f254d..103b4e01 100644
--- a/docs/getting_started.md
+++ b/docs/getting_started.md
@@ -30,16 +30,16 @@ it to HTML.
 The
 [javadoc](http://javadoc.io/doc/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/)
 covers more detailed topics, including
-[customization](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/org/owasp/html/HtmlPolicyBuilder.html).
+[customization](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlPolicyBuilder.html).
 
 Important classes are:
 
-  * [Sanitizers](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
-  * [HtmlPolicyBuilder](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
+  * [Sanitizers](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
+  * [HtmlPolicyBuilder](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
 
 For advanced use, see:
-  * [AttributePolicy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20180219.1/org/owasp/html/ElementPolicy.html) allow complex customization.
-  * [HtmlStreamEventReceiver](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
+  * [AttributePolicy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20180219.1/org/owasp/html/ElementPolicy.html) allow complex customization.
+  * [HtmlStreamEventReceiver](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
 
 ## Asking Questions
 
diff --git a/docs/maven.md b/docs/maven.md
index 4f2ad1bd..192db266 100644
--- a/docs/maven.md
+++ b/docs/maven.md
@@ -23,7 +23,7 @@ Bigger numbers are more recent and the [change log](../change_log.md)
 can shed light on the salient differences.
 
 You should be able to build with the HTML sanitizer.  You can read the
-[javadoc](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20191001.1/index.html),
+[javadoc](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/index.html),
 and if you have questions that aren't answered by these wiki pages,
 you can ask on the
 [mailing list](http://groups.google.com/group/owasp-java-html-sanitizer-support).
diff --git a/empiricism/pom.xml b/empiricism/pom.xml
index f62386e0..ce286f65 100644
--- a/empiricism/pom.xml
+++ b/empiricism/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20191001.2-SNAPSHOT</version>
+  <version>20200615.1</version>
   <packaging>jar</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20191001.2-SNAPSHOT</version>
+    <version>20200615.1</version>
   </parent>
 
   <name>empiricism</name>
diff --git a/html-types/pom.xml b/html-types/pom.xml
index 2e454f9b..3637bf64 100644
--- a/html-types/pom.xml
+++ b/html-types/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20191001.2-SNAPSHOT</version>
+  <version>20200615.1</version>
   <packaging>bundle</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20191001.2-SNAPSHOT</version>
+    <version>20200615.1</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
diff --git a/parent/pom.xml b/parent/pom.xml
index e98cf6ad..6c2d68be 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -2,7 +2,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>parent</artifactId>
-  <version>20191001.2-SNAPSHOT</version>
+  <version>20200615.1</version>
 
   <packaging>pom</packaging>
 
diff --git a/pom.xml b/pom.xml
index c9c25d82..ccb740c0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <relativePath>parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20191001.2-SNAPSHOT</version>
+    <version>20200615.1</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer</name>

From fd6b2ddbf7ded2ba4fc1d718e450dc701368cdba Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 15 Jun 2020 12:11:49 -0400
Subject: [PATCH 07/28] Bumped dev version

---
 aggregate/pom.xml  | 4 ++--
 empiricism/pom.xml | 4 ++--
 html-types/pom.xml | 4 ++--
 parent/pom.xml     | 2 +-
 pom.xml            | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/aggregate/pom.xml b/aggregate/pom.xml
index f41ff770..1dac6b95 100644
--- a/aggregate/pom.xml
+++ b/aggregate/pom.xml
@@ -3,12 +3,12 @@
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>aggregate</artifactId>
   <packaging>pom</packaging>
-  <version>20200615.1</version>
+  <version>20200615.2-SNAPSHOT</version>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200615.1</version>
+    <version>20200615.2-SNAPSHOT</version>
   </parent>
 
   <modules>
diff --git a/empiricism/pom.xml b/empiricism/pom.xml
index ce286f65..2468149c 100644
--- a/empiricism/pom.xml
+++ b/empiricism/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20200615.1</version>
+  <version>20200615.2-SNAPSHOT</version>
   <packaging>jar</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200615.1</version>
+    <version>20200615.2-SNAPSHOT</version>
   </parent>
 
   <name>empiricism</name>
diff --git a/html-types/pom.xml b/html-types/pom.xml
index 3637bf64..36b14d8f 100644
--- a/html-types/pom.xml
+++ b/html-types/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20200615.1</version>
+  <version>20200615.2-SNAPSHOT</version>
   <packaging>bundle</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200615.1</version>
+    <version>20200615.2-SNAPSHOT</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
diff --git a/parent/pom.xml b/parent/pom.xml
index 6c2d68be..95f95bd7 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -2,7 +2,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>parent</artifactId>
-  <version>20200615.1</version>
+  <version>20200615.2-SNAPSHOT</version>
 
   <packaging>pom</packaging>
 
diff --git a/pom.xml b/pom.xml
index ccb740c0..c15a5c02 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <relativePath>parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200615.1</version>
+    <version>20200615.2-SNAPSHOT</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer</name>

From eb6ef0297b5a960ac25a85a6d8a56803ccc11a0c Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 13 Jul 2020 11:27:08 -0400
Subject: [PATCH 08/28] =?UTF-8?q?Do=20not=20lcase=20element=20or=20attribu?=
 =?UTF-8?q?te=20names=20that=20match=20SVG=20or=20MathML=20name=E2=80=A6?=
 =?UTF-8?q?=20(#206)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Do not lcase element or attribute names that match SVG or MathML names exactly

> Currently all names are converted to lowercase which is ok when
> you're using it for HTML only, but if there is an SVG image nested
> inside the HTML it breaks.  For example, when `viewBox` attribute is
> converted to `viewbox` the image is not displayed correctly.

This commit splits *HtmlLexer*.*canonicalName* into variants which preserve
items on whitelists derived from the SVG and MathML specifications, and
adjusts callers of *canonicalName* to use the appropriate variant.

Fixes #182

* add unittests for mixed-case SVG names
---
 .../html/ElementAndAttributePolicies.java     |   2 +-
 ...ndAttributePolicyBasedSanitizerPolicy.java |   2 +-
 src/main/java/org/owasp/html/HtmlLexer.java   | 155 ++++++++++++++++--
 .../org/owasp/html/HtmlPolicyBuilder.java     |  18 +-
 .../java/org/owasp/html/HtmlSanitizer.java    |   6 +-
 .../org/owasp/html/HtmlStreamRenderer.java    |   6 +-
 .../TagBalancingHtmlStreamEventReceiver.java  |   4 +-
 .../org/owasp/html/HtmlPolicyBuilderTest.java |  19 +++
 8 files changed, 182 insertions(+), 30 deletions(-)

diff --git a/src/main/java/org/owasp/html/ElementAndAttributePolicies.java b/src/main/java/org/owasp/html/ElementAndAttributePolicies.java
index 219a3d80..8f2cdca6 100644
--- a/src/main/java/org/owasp/html/ElementAndAttributePolicies.java
+++ b/src/main/java/org/owasp/html/ElementAndAttributePolicies.java
@@ -35,7 +35,7 @@
 
 /**
  * Encapsulates all the information needed by the
- * {@link ElementAndAttributePolicySanitizerPolicy} to sanitize one kind
+ * {@link ElementAndAttributePolicyBasedSanitizerPolicy} to sanitize one kind
  * of element.
  */
 @Immutable
diff --git a/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java b/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java
index d578221f..c8da4617 100644
--- a/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java
+++ b/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java
@@ -144,7 +144,7 @@ public void openTag(String elementName, List<String> attrs) {
 
       adjustedElementName = policies.elPolicy.apply(elementName, attrs);
       if (adjustedElementName != null) {
-        adjustedElementName = HtmlLexer.canonicalName(adjustedElementName);
+        adjustedElementName = HtmlLexer.canonicalElementName(adjustedElementName);
       }
     } else {
       adjustedElementName = null;
diff --git a/src/main/java/org/owasp/html/HtmlLexer.java b/src/main/java/org/owasp/html/HtmlLexer.java
index ed326b15..00fcc7dc 100644
--- a/src/main/java/org/owasp/html/HtmlLexer.java
+++ b/src/main/java/org/owasp/html/HtmlLexer.java
@@ -55,11 +55,27 @@ public HtmlLexer(String input) {
 
   /**
    * Normalize case of names that are not name-spaced.  This lower-cases HTML
-   * element and attribute names, but not ones for embedded SVG or MATHML.
+   * element names, but not ones for embedded SVG or MathML.
    */
-  static String canonicalName(String elementOrAttribName) {
-    return elementOrAttribName.indexOf(':') >= 0
-        ? elementOrAttribName : Strings.toLowerCase(elementOrAttribName);
+  static String canonicalElementName(String elementName) {
+    return elementName.indexOf(':') >= 0 || mixedCaseForeignElementNames.contains(elementName)
+            ? elementName : Strings.toLowerCase(elementName);
+  }
+
+  /**
+   * Normalize case of names that are not name-spaced.  This lower-cases HTML
+   * attribute names, but not ones for embedded SVG or MathML.
+   */
+  static String canonicalAttributeName(String attribName) {
+    return attribName.indexOf(':') >= 0 || mixedCaseForeignAttributeNames.contains(attribName)
+            ? attribName : Strings.toLowerCase(attribName);
+  }
+
+  /**
+   * Normalize case of keywords in attribute values.
+   */
+  public static String canonicalKeywordAttributeValue(String keywordValue) {
+    return Strings.toLowerCase(keywordValue);
   }
 
   /**
@@ -243,9 +259,7 @@ private void pushbackToken(HtmlToken token) {
 
   /** Can the attribute appear in HTML without a value. */
   private static boolean isValuelessAttribute(String attribName) {
-    boolean valueless = VALUELESS_ATTRIB_NAMES.contains(
-        Strings.toLowerCase(attribName));
-    return valueless;
+    return VALUELESS_ATTRIB_NAMES.contains(canonicalAttributeName(attribName));
   }
 
   // From http://issues.apache.org/jira/browse/XALANC-519
@@ -253,6 +267,125 @@ private static boolean isValuelessAttribute(String attribName) {
       "checked", "compact", "declare", "defer", "disabled",
       "ismap", "multiple", "nohref", "noresize", "noshade",
       "nowrap", "readonly", "selected");
+
+  private static final ImmutableSet<String> mixedCaseForeignAttributeNames = ImmutableSet.of(
+          "attributeName",
+          "attributeType",
+          "baseFrequency",
+          "baseProfile",
+          "calcMode",
+          "clipPathUnits",
+          "contentScriptType",
+          "defaultAction",
+          "definitionURL",
+          "diffuseConstant",
+          "edgeMode",
+          "externalResourcesRequired",
+          "filterUnits",
+          "focusHighlight",
+          "gradientTransform",
+          "gradientUnits",
+          "initialVisibility",
+          "kernelMatrix",
+          "kernelUnitLength",
+          "keyPoints",
+          "keySplines",
+          "keyTimes",
+          "lengthAdjust",
+          "limitingConeAngle",
+          "markerHeight",
+          "markerUnits",
+          "markerWidth",
+          "maskContentUnits",
+          "maskUnits",
+          "mediaCharacterEncoding",
+          "mediaContentEncodings",
+          "mediaSize",
+          "mediaTime",
+          "numOctaves",
+          "pathLength",
+          "patternContentUnits",
+          "patternTransform",
+          "patternUnits",
+          "playbackOrder",
+          "pointsAtX",
+          "pointsAtY",
+          "pointsAtZ",
+          "preserveAlpha",
+          "preserveAspectRatio",
+          "primitiveUnits",
+          "refX",
+          "refY",
+          "repeatCount",
+          "repeatDur",
+          "requiredExtensions",
+          "requiredFeatures",
+          "requiredFonts",
+          "requiredFormats",
+          "schemaLocation",
+          "snapshotTime",
+          "specularConstant",
+          "specularExponent",
+          "spreadMethod",
+          "startOffset",
+          "stdDeviation",
+          "stitchTiles",
+          "surfaceScale",
+          "syncBehavior",
+          "syncBehaviorDefault",
+          "syncMaster",
+          "syncTolerance",
+          "syncToleranceDefault",
+          "systemLanguage",
+          "tableValues",
+          "targetX",
+          "targetY",
+          "textLength",
+          "timelineBegin",
+          "transformBehavior",
+          "viewBox",
+          "xChannelSelector",
+          "yChannelSelector",
+          "zoomAndPan"
+  );
+
+  private static final ImmutableSet<String> mixedCaseForeignElementNames = ImmutableSet.of(
+          "animateColor",
+          "animateMotion",
+          "animateTransform",
+          "clipPath",
+          "feBlend",
+          "feColorMatrix",
+          "feComponentTransfer",
+          "feComposite",
+          "feConvolveMatrix",
+          "feDiffuseLighting",
+          "feDisplacementMap",
+          "feDistantLight",
+          "feDropShadow",
+          "feFlood",
+          "feFuncA",
+          "feFuncB",
+          "feFuncG",
+          "feFuncR",
+          "feGaussianBlur",
+          "feImage",
+          "feMerge",
+          "feMergeNode",
+          "feMorphology",
+          "feOffset",
+          "fePointLight",
+          "feSpecularLighting",
+          "feSpotLight",
+          "feTile",
+          "feTurbulence",
+          "foreignObject",
+          "linearGradient",
+          "radialGradient",
+          "solidColor",
+          "textArea",
+          "textPath"
+  );
 }
 
 /**
@@ -311,7 +444,7 @@ protected HtmlToken produce() {
       switch (token.type) {
         case TAGBEGIN:
           {
-            String canonTagName = canonicalName(
+            String canonTagName = canonicalElementName(
                 token.start + 1, token.end);
             if (HtmlTextEscapingMode.isTagFollowedByLiteralContent(
                     canonTagName)) {
@@ -478,7 +611,7 @@ private HtmlToken parseToken() {
                     if (this.inEscapeExemptBlock
                         && '/' == input.charAt(start + 1)
                         && textEscapingMode != HtmlTextEscapingMode.PLAIN_TEXT
-                        && canonicalName(start + 2, end)
+                        && canonicalElementName(start + 2, end)
                             .equals(escapeExemptTagName)) {
                       this.inEscapeExemptBlock = false;
                       this.escapeExemptTagName = null;
@@ -612,8 +745,8 @@ && canonicalName(start + 2, end)
     return result;
   }
 
-  private String canonicalName(int start, int end) {
-    return HtmlLexer.canonicalName(input.substring(start, end));
+  private String canonicalElementName(int start, int end) {
+    return HtmlLexer.canonicalElementName(input.substring(start, end));
   }
 
   private static boolean isIdentStart(char ch) {
diff --git a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
index 46b42230..aa1b51a5 100644
--- a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
+++ b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
@@ -238,7 +238,7 @@ public HtmlPolicyBuilder allowElements(
       ElementPolicy policy, String... elementNames) {
     invalidateCompiledState();
     for (String elementName : elementNames) {
-      elementName = HtmlLexer.canonicalName(elementName);
+      elementName = HtmlLexer.canonicalElementName(elementName);
       ElementPolicy newPolicy = ElementPolicy.Util.join(
           elPolicies.get(elementName), policy);
       // Don't remove if newPolicy is the always reject policy since we want
@@ -286,7 +286,7 @@ public HtmlPolicyBuilder allowCommonBlockElements() {
   public HtmlPolicyBuilder allowTextIn(String... elementNames) {
     invalidateCompiledState();
     for (String elementName : elementNames) {
-      elementName = HtmlLexer.canonicalName(elementName);
+      elementName = HtmlLexer.canonicalElementName(elementName);
       textContainers.put(elementName, true);
     }
     return this;
@@ -305,7 +305,7 @@ public HtmlPolicyBuilder allowTextIn(String... elementNames) {
   public HtmlPolicyBuilder disallowTextIn(String... elementNames) {
     invalidateCompiledState();
     for (String elementName : elementNames) {
-      elementName = HtmlLexer.canonicalName(elementName);
+      elementName = HtmlLexer.canonicalElementName(elementName);
       textContainers.put(elementName, false);
     }
     return this;
@@ -321,7 +321,7 @@ public HtmlPolicyBuilder disallowTextIn(String... elementNames) {
   public HtmlPolicyBuilder allowWithoutAttributes(String... elementNames) {
     invalidateCompiledState();
     for (String elementName : elementNames) {
-      elementName = HtmlLexer.canonicalName(elementName);
+      elementName = HtmlLexer.canonicalElementName(elementName);
       skipIssueTagMap.put(elementName, HtmlTagSkipType.DO_NOT_SKIP);
     }
     return this;
@@ -336,7 +336,7 @@ public HtmlPolicyBuilder allowWithoutAttributes(String... elementNames) {
   public HtmlPolicyBuilder disallowWithoutAttributes(String... elementNames) {
     invalidateCompiledState();
     for (String elementName : elementNames) {
-      elementName = HtmlLexer.canonicalName(elementName);
+      elementName = HtmlLexer.canonicalElementName(elementName);
       skipIssueTagMap.put(elementName, HtmlTagSkipType.SKIP);
     }
     return this;
@@ -349,7 +349,7 @@ public HtmlPolicyBuilder disallowWithoutAttributes(String... elementNames) {
   public AttributeBuilder allowAttributes(String... attributeNames) {
     ImmutableList.Builder<String> b = ImmutableList.builder();
     for (String attributeName : attributeNames) {
-      b.add(HtmlLexer.canonicalName(attributeName));
+      b.add(HtmlLexer.canonicalAttributeName(attributeName));
     }
     return new AttributeBuilder(b.build());
   }
@@ -432,7 +432,7 @@ public HtmlPolicyBuilder requireRelsOnLinks(String... linkValues) {
       this.extraRelsForLinks = Sets.newLinkedHashSet();
     }
     for (String linkValue : linkValues) {
-      linkValue = HtmlLexer.canonicalName(linkValue);
+      linkValue = HtmlLexer.canonicalKeywordAttributeValue(linkValue);
       Preconditions.checkArgument(
           !Strings.containsHtmlSpace(linkValue),
           "spaces in input.  use f(\"foo\", \"bar\") not f(\"foo bar\")");
@@ -456,7 +456,7 @@ public HtmlPolicyBuilder skipRelsOnLinks(String... linkValues) {
       this.skipRelsForLinks = Sets.newLinkedHashSet();
     }
     for (String linkValue : linkValues) {
-      linkValue = HtmlLexer.canonicalName(linkValue);
+      linkValue = HtmlLexer.canonicalKeywordAttributeValue(linkValue);
       Preconditions.checkArgument(
           !Strings.containsHtmlSpace(linkValue),
           "spaces in input.  use f(\"foo\", \"bar\") not f(\"foo bar\")");
@@ -980,7 +980,7 @@ public HtmlPolicyBuilder globally() {
     public HtmlPolicyBuilder onElements(String... elementNames) {
       ImmutableList.Builder<String> b = ImmutableList.builder();
       for (String elementName : elementNames) {
-        b.add(HtmlLexer.canonicalName(elementName));
+        b.add(HtmlLexer.canonicalElementName(elementName));
       }
       return HtmlPolicyBuilder.this.allowAttributesOnElements(
           policy, attributeNames, b.build());
diff --git a/src/main/java/org/owasp/html/HtmlSanitizer.java b/src/main/java/org/owasp/html/HtmlSanitizer.java
index f9e932e8..63d7ae95 100644
--- a/src/main/java/org/owasp/html/HtmlSanitizer.java
+++ b/src/main/java/org/owasp/html/HtmlSanitizer.java
@@ -152,7 +152,7 @@ public static void sanitize(
           break;
         case TAGBEGIN:
           if (htmlContent.charAt(token.start + 1) == '/') {  // A close tag.
-            receiver.closeTag(HtmlLexer.canonicalName(
+            receiver.closeTag(HtmlLexer.canonicalElementName(
                 htmlContent.substring(token.start + 2, token.end)));
             while (lexer.hasNext()
                    && lexer.next().type != HtmlTokenType.TAGEND) {
@@ -173,7 +173,7 @@ public static void sanitize(
                   } else {
                     attrsReadyForName = false;
                   }
-                  attrs.add(HtmlLexer.canonicalName(
+                  attrs.add(HtmlLexer.canonicalAttributeName(
                       htmlContent.substring(tagBodyToken.start, tagBodyToken.end)));
                   break;
                 case ATTRVALUE:
@@ -191,7 +191,7 @@ public static void sanitize(
               attrs.add(attrs.getLast());
             }
             receiver.openTag(
-                HtmlLexer.canonicalName(
+                HtmlLexer.canonicalElementName(
                     htmlContent.substring(token.start + 1, token.end)),
                 attrs);
           }
diff --git a/src/main/java/org/owasp/html/HtmlStreamRenderer.java b/src/main/java/org/owasp/html/HtmlStreamRenderer.java
index 019895a5..16645531 100644
--- a/src/main/java/org/owasp/html/HtmlStreamRenderer.java
+++ b/src/main/java/org/owasp/html/HtmlStreamRenderer.java
@@ -187,7 +187,7 @@ private void writeOpenTag(
          attrIt.hasNext();) {
       String name = attrIt.next();
       String value = attrIt.next();
-      name = HtmlLexer.canonicalName(name);
+      name = HtmlLexer.canonicalAttributeName(name);
       if (!isValidHtmlName(name)) {
         error("Invalid attr name", name);
         continue;
@@ -234,7 +234,7 @@ public final void closeTag(String elementName) {
   private final void writeCloseTag(String uncanonElementName)
       throws IOException {
     if (!open) { throw new IllegalStateException(); }
-    String elementName = HtmlLexer.canonicalName(uncanonElementName);
+    String elementName = HtmlLexer.canonicalElementName(uncanonElementName);
     if (!isValidHtmlName(elementName)) {
       error("Invalid element name", elementName);
       return;
@@ -386,7 +386,7 @@ static boolean isValidHtmlName(String name) {
    * that has more consistent semantics.
    */
   static String safeName(String unsafeElementName) {
-    String elementName = HtmlLexer.canonicalName(unsafeElementName);
+    String elementName = HtmlLexer.canonicalElementName(unsafeElementName);
 
     // Substitute a reliably non-raw-text element for raw-text and
     // plain-text elements.
diff --git a/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java b/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
index c94d5735..aa2eb075 100644
--- a/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
+++ b/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
@@ -97,7 +97,7 @@ public void openTag(String elementName, List<String> attrs) {
     if (DEBUG) {
       dumpState("open " + elementName);
     }
-    String canonElementName = HtmlLexer.canonicalName(elementName);
+    String canonElementName = HtmlLexer.canonicalElementName(elementName);
 
     int elIndex = METADATA.indexForName(canonElementName);
     // Treat unrecognized tags as void, but emit closing tags in closeTag().
@@ -238,7 +238,7 @@ public void closeTag(String elementName) {
     if (DEBUG) {
       dumpState("close " + elementName);
     }
-    String canonElementName = HtmlLexer.canonicalName(elementName);
+    String canonElementName = HtmlLexer.canonicalElementName(elementName);
 
     int elIndex = METADATA.indexForName(canonElementName);
     if (elIndex == UNRECOGNIZED_TAG) {  // Allow unrecognized end tags through.
diff --git a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
index a06fafee..db75e4c7 100644
--- a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
+++ b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
@@ -975,6 +975,25 @@ public static final void testTableStructure() {
         sanitized);
   }
 
+  @Test
+  public static final void testSvgNames() {
+    PolicyFactory policyFactory = new HtmlPolicyBuilder()
+            .allowElements("svg", "animateColor")
+            .allowAttributes("viewBox").onElements("svg")
+            .toFactory();
+    String svg = "<svg viewBox=\"0 0 0 0\"><animateColor></animateColor></svg>";
+    assertEquals(svg, policyFactory.sanitize(svg));
+  }
+
+  @Test
+  public static final void testTextareaIsNotTextArea() {
+    String input = "<textarea>x</textarea><textArea>y</textArea>";
+    PolicyFactory textareaPolicy = new HtmlPolicyBuilder().allowElements("textarea").toFactory();
+    PolicyFactory textAreaPolicy = new HtmlPolicyBuilder().allowElements("textArea").toFactory();
+    assertEquals("<textarea>x</textarea>y", textareaPolicy.sanitize(input));
+    assertEquals("x<textArea>y</textArea>", textAreaPolicy.sanitize(input));
+  }
+
   private static String apply(HtmlPolicyBuilder b) {
     return apply(b, EXAMPLE);
   }

From 25c3d64c4c0764d86792a2e23b8f5498a449b9de Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 13 Jul 2020 11:37:22 -0400
Subject: [PATCH 09/28] Release candidate 20200713.1

---
 README.md               | 10 +++++-----
 aggregate/pom.xml       |  4 ++--
 change_log.md           |  4 ++++
 docs/getting_started.md | 10 +++++-----
 docs/maven.md           |  2 +-
 empiricism/pom.xml      |  4 ++--
 html-types/pom.xml      |  4 ++--
 parent/pom.xml          |  2 +-
 pom.xml                 |  2 +-
 9 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/README.md b/README.md
index dd2b3533..2f9708a2 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ how to get started with or without Maven.
 ## Prepackaged Policies
 
 You can use
-[prepackaged policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/Sanitizers.html):
+[prepackaged policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/Sanitizers.html):
 
 ```Java
 PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
@@ -47,7 +47,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
 The
 [tests](https://github.com/OWASP/java-html-sanitizer/blob/master/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java)
 show how to configure your own
-[policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlPolicyBuilder.html):
+[policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlPolicyBuilder.html):
 
 ```Java
 PolicyFactory policy = new HtmlPolicyBuilder()
@@ -62,7 +62,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
 ## Custom Policies
 
 You can write
-[custom policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/ElementPolicy.html)
+[custom policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/ElementPolicy.html)
 to do things like changing `h1`s to `div`s with a certain class:
 
 ```Java
@@ -85,7 +85,7 @@ need to be explicitly whitelisted using the `allowWithoutAttributes()`
 method if you want them to be allowed through the filter when these
 elements do not include any attributes.
 
-[Attribute policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/AttributePolicy.html) allow running custom code too.  Adding an attribute policy will not water down any default policy like `style` or URL attribute checks.
+[Attribute policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/AttributePolicy.html) allow running custom code too.  Adding an attribute policy will not water down any default policy like `style` or URL attribute checks.
 
 ```Java
 new HtmlPolicyBuilder = new HtmlPolicyBuilder()
@@ -153,7 +153,7 @@ of the output.
 
 ## Telemetry
 
-When a policy rejects an element or attribute it notifies an [HtmlChangeListener](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlChangeListener.html).
+When a policy rejects an element or attribute it notifies an [HtmlChangeListener](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlChangeListener.html).
 
 You can use this to keep track of policy violation trends and find out when someone
 is making an effort to breach your security.
diff --git a/aggregate/pom.xml b/aggregate/pom.xml
index 1dac6b95..c41fc9a5 100644
--- a/aggregate/pom.xml
+++ b/aggregate/pom.xml
@@ -3,12 +3,12 @@
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>aggregate</artifactId>
   <packaging>pom</packaging>
-  <version>20200615.2-SNAPSHOT</version>
+  <version>20200713.1</version>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200615.2-SNAPSHOT</version>
+    <version>20200713.1</version>
   </parent>
 
   <modules>
diff --git a/change_log.md b/change_log.md
index ce66fe97..9619abc5 100644
--- a/change_log.md
+++ b/change_log.md
@@ -1,6 +1,10 @@
 # OWASP Java HTML Sanitizer Change Log
 
 Most recent at top.
+  * Release 20200713.1
+    * Do not lower-case SVG/MathML names.
+      This shouldn't cause problems since it was hard to write policies for
+      SBG, but be aware that SVG's `<textArea>` is now distinct from HTML's `<textarea>`.
   * Release 20200615.1
     * Change `.and` when combining two policies to respect explicit `skipIfEmpty` decisions.
     * HTML entity decoding now follows HTML standard rules about when a semicolon is optional.
diff --git a/docs/getting_started.md b/docs/getting_started.md
index 103b4e01..b7fbf687 100644
--- a/docs/getting_started.md
+++ b/docs/getting_started.md
@@ -30,16 +30,16 @@ it to HTML.
 The
 [javadoc](http://javadoc.io/doc/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/)
 covers more detailed topics, including
-[customization](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlPolicyBuilder.html).
+[customization](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlPolicyBuilder.html).
 
 Important classes are:
 
-  * [Sanitizers](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
-  * [HtmlPolicyBuilder](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
+  * [Sanitizers](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
+  * [HtmlPolicyBuilder](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
 
 For advanced use, see:
-  * [AttributePolicy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20180219.1/org/owasp/html/ElementPolicy.html) allow complex customization.
-  * [HtmlStreamEventReceiver](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
+  * [AttributePolicy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20180219.1/org/owasp/html/ElementPolicy.html) allow complex customization.
+  * [HtmlStreamEventReceiver](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
 
 ## Asking Questions
 
diff --git a/docs/maven.md b/docs/maven.md
index 192db266..13f5936e 100644
--- a/docs/maven.md
+++ b/docs/maven.md
@@ -23,7 +23,7 @@ Bigger numbers are more recent and the [change log](../change_log.md)
 can shed light on the salient differences.
 
 You should be able to build with the HTML sanitizer.  You can read the
-[javadoc](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200615.1/index.html),
+[javadoc](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/index.html),
 and if you have questions that aren't answered by these wiki pages,
 you can ask on the
 [mailing list](http://groups.google.com/group/owasp-java-html-sanitizer-support).
diff --git a/empiricism/pom.xml b/empiricism/pom.xml
index 2468149c..050fcc64 100644
--- a/empiricism/pom.xml
+++ b/empiricism/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20200615.2-SNAPSHOT</version>
+  <version>20200713.1</version>
   <packaging>jar</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200615.2-SNAPSHOT</version>
+    <version>20200713.1</version>
   </parent>
 
   <name>empiricism</name>
diff --git a/html-types/pom.xml b/html-types/pom.xml
index 36b14d8f..032c71b0 100644
--- a/html-types/pom.xml
+++ b/html-types/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20200615.2-SNAPSHOT</version>
+  <version>20200713.1</version>
   <packaging>bundle</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200615.2-SNAPSHOT</version>
+    <version>20200713.1</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
diff --git a/parent/pom.xml b/parent/pom.xml
index 95f95bd7..fd150b69 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -2,7 +2,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>parent</artifactId>
-  <version>20200615.2-SNAPSHOT</version>
+  <version>20200713.1</version>
 
   <packaging>pom</packaging>
 
diff --git a/pom.xml b/pom.xml
index c15a5c02..c73b5a9a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <relativePath>parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200615.2-SNAPSHOT</version>
+    <version>20200713.1</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer</name>

From ffe5cfa452d2992400b2bf86ccf947ca56ac6496 Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 13 Jul 2020 11:49:09 -0400
Subject: [PATCH 10/28] Bumped dev version

---
 aggregate/pom.xml  | 4 ++--
 empiricism/pom.xml | 4 ++--
 html-types/pom.xml | 4 ++--
 parent/pom.xml     | 2 +-
 pom.xml            | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/aggregate/pom.xml b/aggregate/pom.xml
index c41fc9a5..5bbfc0ae 100644
--- a/aggregate/pom.xml
+++ b/aggregate/pom.xml
@@ -3,12 +3,12 @@
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>aggregate</artifactId>
   <packaging>pom</packaging>
-  <version>20200713.1</version>
+  <version>20200713.2-SNAPSHOT</version>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200713.1</version>
+    <version>20200713.2-SNAPSHOT</version>
   </parent>
 
   <modules>
diff --git a/empiricism/pom.xml b/empiricism/pom.xml
index 050fcc64..a31e7e82 100644
--- a/empiricism/pom.xml
+++ b/empiricism/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20200713.1</version>
+  <version>20200713.2-SNAPSHOT</version>
   <packaging>jar</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200713.1</version>
+    <version>20200713.2-SNAPSHOT</version>
   </parent>
 
   <name>empiricism</name>
diff --git a/html-types/pom.xml b/html-types/pom.xml
index 032c71b0..4d8ab41a 100644
--- a/html-types/pom.xml
+++ b/html-types/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20200713.1</version>
+  <version>20200713.2-SNAPSHOT</version>
   <packaging>bundle</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200713.1</version>
+    <version>20200713.2-SNAPSHOT</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
diff --git a/parent/pom.xml b/parent/pom.xml
index fd150b69..444a7ed6 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -2,7 +2,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>parent</artifactId>
-  <version>20200713.1</version>
+  <version>20200713.2-SNAPSHOT</version>
 
   <packaging>pom</packaging>
 
diff --git a/pom.xml b/pom.xml
index c73b5a9a..0bb532db 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <relativePath>parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200713.1</version>
+    <version>20200713.2-SNAPSHOT</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer</name>

From c7db2d46a334c4f942e0739c4c9ca4c98088547d Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 13 Jul 2020 12:10:56 -0400
Subject: [PATCH 11/28] we use spotbugs now instead of findbugs

---
 RELEASE-checklist.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/RELEASE-checklist.sh b/RELEASE-checklist.sh
index c871ccf8..57e611ba 100644
--- a/RELEASE-checklist.sh
+++ b/RELEASE-checklist.sh
@@ -16,7 +16,7 @@ mvn org.sonatype.ossindex.maven:ossindex-maven-plugin:audit -f aggregate
 echo
 echo Browse to
 echo "file://$PWD/target/site"
-echo and check the findbugs and jacoco reports.
+echo and check the spotbugs and jacoco reports.
 
 echo
 echo Check https://central.sonatype.org/pages/apache-maven.html#nexus-staging-maven-plugin-for-deployment-and-release

From ca406970b74abd03ec045713b3c9f53963b716ff Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 13 Jul 2020 12:11:20 -0400
Subject: [PATCH 12/28] s/master/main/ in doc URLs

---
 README.md                                                 | 8 ++++----
 docs/getting_started.md                                   | 2 +-
 .../main/java/org/owasp/html/htmltypes/SafeHtmlMint.java  | 2 +-
 .../main/java/org/owasp/html/htmltypes/package-info.java  | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 2f9708a2..df20f4f6 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # OWASP Java HTML Sanitizer
 
-[<img src="https://travis-ci.org/OWASP/java-html-sanitizer.svg">](https://travis-ci.org/OWASP/java-html-sanitizer) [![Coverage Status](https://coveralls.io/repos/github/OWASP/java-html-sanitizer/badge.svg?branch=master)](https://coveralls.io/github/OWASP/java-html-sanitizer?branch=master) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/2602/badge)](https://bestpractices.coreinfrastructure.org/projects/2602) [![Maven Central](https://maven-badges.herokuapp.com/maven-central/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/badge.png?style=plastic)](https://search.maven.org/artifact/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer)
+[<img src="https://travis-ci.org/OWASP/java-html-sanitizer.svg">](https://travis-ci.org/OWASP/java-html-sanitizer) [![Coverage Status](https://coveralls.io/repos/github/OWASP/java-html-sanitizer/badge.svg?branch=main)](https://coveralls.io/github/OWASP/java-html-sanitizer?branch=main) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/2602/badge)](https://bestpractices.coreinfrastructure.org/projects/2602) [![Maven Central](https://maven-badges.herokuapp.com/maven-central/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/badge.png?style=plastic)](https://search.maven.org/artifact/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer)
 
 
 A fast and easy to configure HTML Sanitizer written in Java which lets
@@ -45,7 +45,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
 ## Crafting a policy
 
 The
-[tests](https://github.com/OWASP/java-html-sanitizer/blob/master/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java)
+[tests](https://github.com/OWASP/java-html-sanitizer/blob/main/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java)
 show how to configure your own
 [policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlPolicyBuilder.html):
 
@@ -187,7 +187,7 @@ used HTML parsers will agree on the meaning of, but the absence of
 notifications does not mean that the input is in such a sub-set,
 only that it does not contain elements or attributes that were removed.
 
-See ["Why sanitize when you can validate"](https://github.com/OWASP/java-html-sanitizer/blob/master/docs/html-validation.md) for more on this topic.
+See ["Why sanitize when you can validate"](https://github.com/OWASP/java-html-sanitizer/blob/main/docs/html-validation.md) for more on this topic.
 
 ## Questions?
 
@@ -206,7 +206,7 @@ We welcome [issue reports](https://github.com/OWASP/java-html-sanitizer/issues)
 PRs that change behavior or that add functionality should include both positive and
 [negative tests](https://www.guru99.com/negative-testing.html).
 
-Please be aware that contributions fall under the [Apache 2.0 License](https://github.com/OWASP/java-html-sanitizer/blob/master/COPYING).
+Please be aware that contributions fall under the [Apache 2.0 License](https://github.com/OWASP/java-html-sanitizer/blob/main/COPYING).
 
 ## Credits
 
diff --git a/docs/getting_started.md b/docs/getting_started.md
index b7fbf687..1908eb55 100644
--- a/docs/getting_started.md
+++ b/docs/getting_started.md
@@ -23,7 +23,7 @@ to one of your project's `.java` files and compile it.
 ## Using the APIs
 
 The
-[examples](https://github.com/OWASP/java-html-sanitizer/tree/master/src/main/java/org/owasp/html/examples)
+[examples](https://github.com/OWASP/java-html-sanitizer/tree/main/src/main/java/org/owasp/html/examples)
 include source code which defines a sanitization policy, and applies
 it to HTML.
 
diff --git a/html-types/src/main/java/org/owasp/html/htmltypes/SafeHtmlMint.java b/html-types/src/main/java/org/owasp/html/htmltypes/SafeHtmlMint.java
index 1027da03..cfba285c 100644
--- a/html-types/src/main/java/org/owasp/html/htmltypes/SafeHtmlMint.java
+++ b/html-types/src/main/java/org/owasp/html/htmltypes/SafeHtmlMint.java
@@ -45,7 +45,7 @@
  * This class is safe when the policy factories passed to it are safe.
  * <a href="https://github.com/mikesamuel/fences-maven-enforcer-rule">Fences</a>
  * can be used to control access to {@link SafeHtmlMint#fromPolicyFactory}
- * as needed, and <a href="https://github.com/mikesamuel/fences-maven-enforcer-rule/blob/master/src/site/markdown/caveats.md">the plausible deniability</a>
+ * as needed, and <a href="https://github.com/mikesamuel/fences-maven-enforcer-rule/blob/main/src/site/markdown/caveats.md">the plausible deniability</a>
  * standard can be extended to writing policies that white-list known-unsafe
  * content.
  */
diff --git a/html-types/src/main/java/org/owasp/html/htmltypes/package-info.java b/html-types/src/main/java/org/owasp/html/htmltypes/package-info.java
index 3fc34081..452e79c4 100644
--- a/html-types/src/main/java/org/owasp/html/htmltypes/package-info.java
+++ b/html-types/src/main/java/org/owasp/html/htmltypes/package-info.java
@@ -28,9 +28,9 @@
 
 /**
  * Wraps HTML policy builders to produce
- * <a href="https://github.com/google/safe-html-types/blob/master/doc/safehtml-types.md">Safe HTML</a>.
+ * <a href="https://github.com/google/safe-html-types/blob/main/doc/safehtml-types.md">Safe HTML</a>.
  * <p>
- * @see <a href="https://github.com/OWASP/java-html-sanitizer/blob/master/docs/credits.md">usage</a>
+ * @see <a href="https://github.com/OWASP/java-html-sanitizer/blob/main/docs/credits.md">usage</a>
  * @author Mike Samuel (mikesamuel@gmail.com)
  */
 @javax.annotation.ParametersAreNonnullByDefault

From af0ca83caf4010ee0e5b2c3fe3cb1991f6d731d6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 7 Dec 2020 14:30:12 -0500
Subject: [PATCH 13/28] Bump junit from 4.12 to 4.13.1 in /parent (#215)

Bumps [junit](https://github.com/junit-team/junit4) from 4.12 to 4.13.1.
- [Release notes](https://github.com/junit-team/junit4/releases)
- [Changelog](https://github.com/junit-team/junit4/blob/main/doc/ReleaseNotes4.12.md)
- [Commits](https://github.com/junit-team/junit4/compare/r4.12...r4.13.1)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 parent/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/parent/pom.xml b/parent/pom.xml
index 444a7ed6..7ef44a68 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -265,7 +265,7 @@ application while protecting against XSS.
       <dependency>
         <groupId>junit</groupId>
         <artifactId>junit</artifactId>
-        <version>4.12</version>
+        <version>4.13.1</version>
         <scope>test</scope>
       </dependency>
     </dependencies>

From acaf3f21c69e73744a4906884e2ab8bd2b91fec5 Mon Sep 17 00:00:00 2001
From: aakritisi <aakritisi1997@gmail.com>
Date: Wed, 9 Dec 2020 10:09:06 -0500
Subject: [PATCH 14/28] hsl and hsla (#216)

---
 src/main/java/org/owasp/html/CssSchema.java | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/owasp/html/CssSchema.java b/src/main/java/org/owasp/html/CssSchema.java
index 38e61326..c9e8a2ad 100644
--- a/src/main/java/org/owasp/html/CssSchema.java
+++ b/src/main/java/org/owasp/html/CssSchema.java
@@ -293,7 +293,7 @@ Property forKey(String propertyName) {
     ImmutableSet<String> mozOutlineLiterals3 = ImmutableSet.of(
         "hidden", "inherit", "inset", "invert", "medium", "none");
     ImmutableMap<String, String> mozOutlineFunctions =
-      ImmutableMap.<String, String>of("rgb(", "rgb()", "rgba(", "rgba()");
+      ImmutableMap.<String, String>of("rgb(", "rgb()", "rgba(", "rgba()","hsl(","hsl()","hsla(","hsla()");
     ImmutableSet<String> mozOutlineColorLiterals0 =
       ImmutableSet.of("inherit", "invert");
     ImmutableSet<String> mozOutlineStyleLiterals0 =
@@ -323,7 +323,7 @@ Property forKey(String propertyName) {
       .put("radial-gradient(", "radial-gradient()")
       .put("repeating-linear-gradient(", "repeating-linear-gradient()")
       .put("repeating-radial-gradient(", "repeating-radial-gradient()")
-      .put("rgb(", "rgb()").put("rgba(", "rgba()")
+      .put("rgb(", "rgb()").put("rgba(", "rgba()").put("hsl(", "hsl()").put("hsla(","hsla()")
       .build();
     ImmutableSet<String> backgroundAttachmentLiterals0 =
       ImmutableSet.of(",", "fixed", "local", "scroll");
@@ -467,6 +467,8 @@ Property forKey(String propertyName) {
     ImmutableSet<String> wordWrapLiterals0 = ImmutableSet.of(
         "break-word", "normal");
     ImmutableSet<String> rgb$FunLiterals0 = ImmutableSet.of(",");
+   
+    
     ImmutableSet<String> linearGradient$FunLiterals0 = ImmutableSet.of(
         ",", "to");
     ImmutableSet<String> radialGradient$FunLiterals0 = ImmutableSet.of(
@@ -742,6 +744,9 @@ Property forKey(String propertyName) {
     builder.put("zoom", new Property(1, fontStretchLiterals1, zeroFns));
     Property rgb$Fun = new Property(1, rgb$FunLiterals0, zeroFns);
     builder.put("rgb()", rgb$Fun);
+   
+    builder.put("hsl()", rgb$Fun);
+    builder.put("hsla()", rgb$Fun);
     @SuppressWarnings("unchecked")
     Property image$Fun = new Property(
         18, union(mozOutlineLiterals0, rgb$FunLiterals0), mozOutlineFunctions);
@@ -961,6 +966,8 @@ private static <T> ImmutableSet<T> union(
       "repeating-radial-gradient()",
       "rgb()",
       "rgba()",
+      "hsl()",
+      "hsla()",
       "richness",
       "speak",
       "speak-header",

From 33d319f876abbb35cb95eddf9705c46bd96822bd Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 14 Dec 2020 16:48:01 -0500
Subject: [PATCH 15/28] Fix code formatting lint checks (#217)

---
 src/main/java/org/owasp/html/CssSchema.java | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/main/java/org/owasp/html/CssSchema.java b/src/main/java/org/owasp/html/CssSchema.java
index c9e8a2ad..8438628b 100644
--- a/src/main/java/org/owasp/html/CssSchema.java
+++ b/src/main/java/org/owasp/html/CssSchema.java
@@ -293,7 +293,9 @@ Property forKey(String propertyName) {
     ImmutableSet<String> mozOutlineLiterals3 = ImmutableSet.of(
         "hidden", "inherit", "inset", "invert", "medium", "none");
     ImmutableMap<String, String> mozOutlineFunctions =
-      ImmutableMap.<String, String>of("rgb(", "rgb()", "rgba(", "rgba()","hsl(","hsl()","hsla(","hsla()");
+      ImmutableMap.<String, String>of(
+        "rgb(", "rgb()", "rgba(", "rgba()",
+        "hsl(", "hsl()", "hsla(", "hsla()");
     ImmutableSet<String> mozOutlineColorLiterals0 =
       ImmutableSet.of("inherit", "invert");
     ImmutableSet<String> mozOutlineStyleLiterals0 =
@@ -323,7 +325,8 @@ Property forKey(String propertyName) {
       .put("radial-gradient(", "radial-gradient()")
       .put("repeating-linear-gradient(", "repeating-linear-gradient()")
       .put("repeating-radial-gradient(", "repeating-radial-gradient()")
-      .put("rgb(", "rgb()").put("rgba(", "rgba()").put("hsl(", "hsl()").put("hsla(","hsla()")
+      .put("rgb(", "rgb()").put("rgba(", "rgba()")
+      .put("hsl(", "hsl()").put("hsla(", "hsla()")
       .build();
     ImmutableSet<String> backgroundAttachmentLiterals0 =
       ImmutableSet.of(",", "fixed", "local", "scroll");
@@ -467,8 +470,6 @@ Property forKey(String propertyName) {
     ImmutableSet<String> wordWrapLiterals0 = ImmutableSet.of(
         "break-word", "normal");
     ImmutableSet<String> rgb$FunLiterals0 = ImmutableSet.of(",");
-   
-    
     ImmutableSet<String> linearGradient$FunLiterals0 = ImmutableSet.of(
         ",", "to");
     ImmutableSet<String> radialGradient$FunLiterals0 = ImmutableSet.of(
@@ -744,7 +745,7 @@ Property forKey(String propertyName) {
     builder.put("zoom", new Property(1, fontStretchLiterals1, zeroFns));
     Property rgb$Fun = new Property(1, rgb$FunLiterals0, zeroFns);
     builder.put("rgb()", rgb$Fun);
-   
+    builder.put("rgba()", rgb$Fun);
     builder.put("hsl()", rgb$Fun);
     builder.put("hsla()", rgb$Fun);
     @SuppressWarnings("unchecked")
@@ -840,7 +841,6 @@ Property forKey(String propertyName) {
     builder.put("width", margin);
     builder.put("word-spacing", letterSpacing);
     builder.put("z-index", bottom);
-    builder.put("rgba()", rgb$Fun);
     builder.put("repeating-linear-gradient()", linearGradient$Fun);
     builder.put("repeating-radial-gradient()", radialGradient$Fun);
     DEFINITIONS = builder.build();

From 020d5d0d7b8e985be32d3608612a9889135ef060 Mon Sep 17 00:00:00 2001
From: aakritisi <aakritisi1997@gmail.com>
Date: Mon, 21 Dec 2020 10:52:47 -0500
Subject: [PATCH 16/28] Fixed allowAtributes("style").globally() (#218)

* allowAtributes("style")

* Global style test
---
 src/main/java/org/owasp/html/HtmlPolicyBuilder.java | 10 +++++++---
 src/test/java/org/owasp/html/SanitizersTest.java    | 11 +++++++++++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
index aa1b51a5..c43bfb86 100644
--- a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
+++ b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
@@ -968,8 +968,12 @@ public AttributeBuilder matching(
      */
     @SuppressWarnings("synthetic-access")
     public HtmlPolicyBuilder globally() {
-      return HtmlPolicyBuilder.this.allowAttributesGlobally(
-          policy, attributeNames);
+      if(attributeNames.get(0).equals("style")) {
+        return allowStyling();
+      } else {
+        return HtmlPolicyBuilder.this.allowAttributesGlobally(
+            policy, attributeNames);
+      }
     }
 
     /**
@@ -1142,4 +1146,4 @@ final class AttributeGuardIntermediates {
     this.styleUrlPolicy = styleUrlPolicy;
     this.cssSchema = cssSchema;
   }
-}
\ No newline at end of file
+}
diff --git a/src/test/java/org/owasp/html/SanitizersTest.java b/src/test/java/org/owasp/html/SanitizersTest.java
index 5841adad..c75fbcb4 100644
--- a/src/test/java/org/owasp/html/SanitizersTest.java
+++ b/src/test/java/org/owasp/html/SanitizersTest.java
@@ -434,6 +434,17 @@ public static final void testStyleTagInTable() {
         pf.sanitize(input));
   }
 
+  @Test
+  public static final void testStyleGlobally() {
+    PolicyFactory policyBuilder = new HtmlPolicyBuilder()
+        .allowAttributes("style").globally()
+        .allowElements("a", "label", "h1", "h2", "h3", "h4", "h5", "h6")
+        .toFactory();
+    String input = "<h1 style=\"color:green ;name:user ;\">This is some green text</h1>";
+    String want = "<h1 style=\"color:green\">This is some green text</h1>";
+    assertEquals(want, policyBuilder.sanitize(input));
+  }
+  
   static int fac(int n) {
     int ifac = 1;
     for (int i = 1; i <= n; ++i) {

From ad287c39f6102d875ad55ecab3094389bb3036d4 Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Thu, 13 May 2021 12:23:26 -0400
Subject: [PATCH 17/28] Upgrade to a modern guava dependency

This may still be overridden with `-Dguava-version=...`.
---
 parent/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/parent/pom.xml b/parent/pom.xml
index 7ef44a68..e80abc22 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -88,7 +88,7 @@ application while protecting against XSS.
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-    <guava.version>27.1-jre</guava.version>
+    <guava.version>30.1-jre</guava.version>
   </properties>
 
   <build>

From be33ec6962fa3938ec028873e269632d5d8fa55a Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 18 Oct 2021 09:23:39 -0400
Subject: [PATCH 18/28] Render style tag content more strictly.

This addresses a vulnerability where policies that allow `<style>`
elements with text in `<option>` elements are vulnerable to XSS as
disclosed in

https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/edit?usp=sharing

This changes behavior for rendering of `<style>` element text so may
change behavior.

Specifically, `<style>` element text that includes the strings `-->`
or `]]>` will no longer sanitize.
---
 docs/credits.md                               |  1 +
 docs/cve202142575.md                          |  5 ++
 docs/vulnerabilities.md                       |  3 +-
 .../org/owasp/html/HtmlStreamRenderer.java    | 29 ++++++++++-
 .../java/org/owasp/html/SanitizersTest.java   | 49 ++++++++++++++++++-
 .../TagBalancingHtmlStreamRendererTest.java   |  4 +-
 6 files changed, 87 insertions(+), 4 deletions(-)
 create mode 100644 docs/cve202142575.md

diff --git a/docs/credits.md b/docs/credits.md
index ed129d43..cad3b048 100644
--- a/docs/credits.md
+++ b/docs/credits.md
@@ -14,6 +14,7 @@
  * rfamilya
  * robinhouston
  * sneha patil
+ * tomanthony
  * vytah
  * willikins_bear
  * yangbongsoo
diff --git a/docs/cve202142575.md b/docs/cve202142575.md
new file mode 100644
index 00000000..241c5180
--- /dev/null
+++ b/docs/cve202142575.md
@@ -0,0 +1,5 @@
+# CVE-2021-42575
+
+Policies that allow `<style>` tags inside `<option>` elements are vulnerable to RCE
+
+See https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/edit?usp=sharing for mitigations.
diff --git a/docs/vulnerabilities.md b/docs/vulnerabilities.md
index 67b34649..80e5fb85 100644
--- a/docs/vulnerabilities.md
+++ b/docs/vulnerabilities.md
@@ -1,3 +1,4 @@
-# Known & public vulnerabilities in this project 
+# Known & public vulnerabilities in this project
 
+  * [CVE-2021-42575](cve202142575.md) - 18 Oct. 2021 - Recommend upgrade to latest version.
   * [CVE-2011-4457](cve20114457.md) - 17 Nov. 2011 - Recommend upgrade to r88 or later.
diff --git a/src/main/java/org/owasp/html/HtmlStreamRenderer.java b/src/main/java/org/owasp/html/HtmlStreamRenderer.java
index 16645531..23d94d06 100644
--- a/src/main/java/org/owasp/html/HtmlStreamRenderer.java
+++ b/src/main/java/org/owasp/html/HtmlStreamRenderer.java
@@ -29,11 +29,15 @@
 package org.owasp.html;
 
 import com.google.common.annotations.VisibleForTesting;
+import com.google.common.collect.ImmutableSet;
+
 import java.io.Closeable;
 import java.io.Flushable;
 import java.io.IOException;
+import java.util.Collections;
 import java.util.Iterator;
 import java.util.List;
+import java.util.Set;
 import javax.annotation.WillCloseWhenClosed;
 import javax.annotation.concurrent.NotThreadSafe;
 
@@ -250,7 +254,26 @@ private final void writeCloseTag(String uncanonElementName)
         Encoding.stripBannedCodeunits(cdataContent);
         int problemIndex = checkHtmlCdataCloseable(lastTagOpened, cdataContent);
         if (problemIndex == -1) {
-          output.append(cdataContent);
+          String prefix = "";
+          String suffix = "";
+          Set<String> bannedSubstrings = Collections.emptySet();
+          if ("style".equals(elementName)) {
+            prefix = "/*<![CDATA[<!--*/\n";
+            suffix = "\n/*-->]]>*/";
+            bannedSubstrings = BANNED_IN_STYLE_ELEMENTS;
+          }
+
+          for (String bannedSubstring : bannedSubstrings) {
+            if (cdataContent.indexOf(bannedSubstring) >= 0) {
+              cdataContent.setLength(0);
+            }
+          }
+
+          if (cdataContent.length() != 0) {
+            output.append(prefix);
+            output.append(cdataContent);
+            output.append(suffix);
+          }
         } else {
           error(
               "Invalid CDATA text content",
@@ -434,4 +457,8 @@ public void close() throws IOException {
   private static boolean isTagEnd(char ch) {
     return ch < 63 && 0 != (TAG_ENDS & (1L << ch));
   }
+
+  private static Set<String> BANNED_IN_STYLE_ELEMENTS = ImmutableSet.of(
+    "<![CDATA[", "]]>", "<!--", "-->"
+  );
 }
diff --git a/src/test/java/org/owasp/html/SanitizersTest.java b/src/test/java/org/owasp/html/SanitizersTest.java
index c75fbcb4..db522309 100644
--- a/src/test/java/org/owasp/html/SanitizersTest.java
+++ b/src/test/java/org/owasp/html/SanitizersTest.java
@@ -434,6 +434,53 @@ public static final void testStyleTagInTable() {
         pf.sanitize(input));
   }
 
+  @Test
+  public static final void testStyleTagsInAllTheWrongPlaces() {
+    String input = ""
+      + "<select><option><style><script>alert(1)</script></style></option></select>"
+      + "<svg><style>.r { color: red }</style></svg>"
+      + "<style>.b { color: blue }</style>"
+      + "<style>#a { content: \"<!--\" }</style>"
+      + "<style>#a { content: \"<![CDATA[\" }</style>"
+      + "<style>#a { content: \"-->\" }</style>"
+      + "<style>#a { content: \"]]>\" }</style>";
+    PolicyFactory pf = new HtmlPolicyBuilder()
+        .allowElements("option", "select", "style", "svg")
+        .allowTextIn("style")
+        .toFactory();
+    assertEquals(
+        ""
+        + "<select><option>"
+        + "<style>/*<![CDATA[<!--*/\n<script>alert(1)</script>\n/*-->]]>*/</style>"
+        + "</option></select>"
+        + "<svg>"
+        + "<style>/*<![CDATA[<!--*/\n.r { color: red }\n/*-->]]>*/</style>"
+        + "</svg>"
+        + "<style>/*<![CDATA[<!--*/\n.b { color: blue }\n/*-->]]>*/</style>"
+        + "<style></style>"
+        + "<style></style>"
+        + "<style></style>"
+        + "<style></style>",
+        pf.sanitize(input)
+    );
+  }
+
+  @Test
+  public static final void testSelectIsOdd() {
+    String input = "<select><option><xmp><script>alert(1)</script></xmp></option></select>";
+    PolicyFactory pf = new HtmlPolicyBuilder()
+        .allowElements("option", "select", "xmp")
+        .allowTextIn("xmp")
+        .toFactory();
+    assertEquals(
+        ""
+        + "<select><option>"
+        + "<pre>&lt;script&gt;alert(1)&lt;/script&gt;</pre>"
+        + "</option></select>",
+        pf.sanitize(input)
+    );
+  }
+
   @Test
   public static final void testStyleGlobally() {
     PolicyFactory policyBuilder = new HtmlPolicyBuilder()
@@ -449,7 +496,7 @@ static int fac(int n) {
     int ifac = 1;
     for (int i = 1; i <= n; ++i) {
       int ifacp = ifac * i;
-      if (ifacp < ifac) { throw new IllegalArgumentException("undeflow"); }
+      if (ifacp < ifac) { throw new IllegalArgumentException("underflow"); }
       ifac = ifacp;
     }
     return ifac;
diff --git a/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java b/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java
index 004e95cd..5195fde9 100644
--- a/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java
+++ b/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java
@@ -158,7 +158,9 @@ public final void testTextContent() {
         + "<p>Hello, <textarea>World!</textarea></p>"
         + "<h1>Hello"
         // Text allowed in special style tag.
-        + "<style type=\"text/css\">\n.World {\n  color: blue\n}\n</style></h1>"
+        + "<style type=\"text/css\">/*<![CDATA[<!--*/\n"
+        + "\n.World {\n  color: blue\n}\n"
+        + "\n/*-->]]>*/</style></h1>"
         // Whitespace allowed inside <ul> but non-whitespace text nodes are
         // moved inside <li>.
         + "<ul><li>Hello,</li><li>World!</li></ul>",

From 374ea2f4f9c2d8c0a7f42b76146b4953898cfcc0 Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 18 Oct 2021 09:35:19 -0400
Subject: [PATCH 19/28] Release candidate 20211018.1

---
 README.md               | 10 +++++-----
 aggregate/pom.xml       |  4 ++--
 change_log.md           |  6 ++++++
 docs/getting_started.md | 10 +++++-----
 docs/maven.md           |  2 +-
 empiricism/pom.xml      |  4 ++--
 html-types/pom.xml      |  4 ++--
 parent/pom.xml          |  2 +-
 pom.xml                 |  2 +-
 9 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/README.md b/README.md
index df20f4f6..caab4b2e 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ how to get started with or without Maven.
 ## Prepackaged Policies
 
 You can use
-[prepackaged policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/Sanitizers.html):
+[prepackaged policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/Sanitizers.html):
 
 ```Java
 PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
@@ -47,7 +47,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
 The
 [tests](https://github.com/OWASP/java-html-sanitizer/blob/main/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java)
 show how to configure your own
-[policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlPolicyBuilder.html):
+[policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/HtmlPolicyBuilder.html):
 
 ```Java
 PolicyFactory policy = new HtmlPolicyBuilder()
@@ -62,7 +62,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
 ## Custom Policies
 
 You can write
-[custom policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/ElementPolicy.html)
+[custom policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/ElementPolicy.html)
 to do things like changing `h1`s to `div`s with a certain class:
 
 ```Java
@@ -85,7 +85,7 @@ need to be explicitly whitelisted using the `allowWithoutAttributes()`
 method if you want them to be allowed through the filter when these
 elements do not include any attributes.
 
-[Attribute policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/AttributePolicy.html) allow running custom code too.  Adding an attribute policy will not water down any default policy like `style` or URL attribute checks.
+[Attribute policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/AttributePolicy.html) allow running custom code too.  Adding an attribute policy will not water down any default policy like `style` or URL attribute checks.
 
 ```Java
 new HtmlPolicyBuilder = new HtmlPolicyBuilder()
@@ -153,7 +153,7 @@ of the output.
 
 ## Telemetry
 
-When a policy rejects an element or attribute it notifies an [HtmlChangeListener](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlChangeListener.html).
+When a policy rejects an element or attribute it notifies an [HtmlChangeListener](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/HtmlChangeListener.html).
 
 You can use this to keep track of policy violation trends and find out when someone
 is making an effort to breach your security.
diff --git a/aggregate/pom.xml b/aggregate/pom.xml
index 5bbfc0ae..f637b0a7 100644
--- a/aggregate/pom.xml
+++ b/aggregate/pom.xml
@@ -3,12 +3,12 @@
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>aggregate</artifactId>
   <packaging>pom</packaging>
-  <version>20200713.2-SNAPSHOT</version>
+  <version>20211018.1</version>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200713.2-SNAPSHOT</version>
+    <version>20211018.1</version>
   </parent>
 
   <modules>
diff --git a/change_log.md b/change_log.md
index 9619abc5..712e97d1 100644
--- a/change_log.md
+++ b/change_log.md
@@ -1,6 +1,12 @@
 # OWASP Java HTML Sanitizer Change Log
 
 Most recent at top.
+  * Release 20211018.1
+    * Fix [CVE-2021-42575](https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/edit#)
+    * Changes rendering of `<style>` elements by wrapping text content
+      in HTML comments and CDATA section tags so that even when
+      content is not treated as CDATA, it will not be treated as
+      active content.
   * Release 20200713.1
     * Do not lower-case SVG/MathML names.
       This shouldn't cause problems since it was hard to write policies for
diff --git a/docs/getting_started.md b/docs/getting_started.md
index 1908eb55..6f5909b1 100644
--- a/docs/getting_started.md
+++ b/docs/getting_started.md
@@ -30,16 +30,16 @@ it to HTML.
 The
 [javadoc](http://javadoc.io/doc/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/)
 covers more detailed topics, including
-[customization](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlPolicyBuilder.html).
+[customization](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/HtmlPolicyBuilder.html).
 
 Important classes are:
 
-  * [Sanitizers](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
-  * [HtmlPolicyBuilder](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
+  * [Sanitizers](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
+  * [HtmlPolicyBuilder](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
 
 For advanced use, see:
-  * [AttributePolicy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20180219.1/org/owasp/html/ElementPolicy.html) allow complex customization.
-  * [HtmlStreamEventReceiver](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
+  * [AttributePolicy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20180219.1/org/owasp/html/ElementPolicy.html) allow complex customization.
+  * [HtmlStreamEventReceiver](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
 
 ## Asking Questions
 
diff --git a/docs/maven.md b/docs/maven.md
index 13f5936e..25c62755 100644
--- a/docs/maven.md
+++ b/docs/maven.md
@@ -23,7 +23,7 @@ Bigger numbers are more recent and the [change log](../change_log.md)
 can shed light on the salient differences.
 
 You should be able to build with the HTML sanitizer.  You can read the
-[javadoc](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20200713.1/index.html),
+[javadoc](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/index.html),
 and if you have questions that aren't answered by these wiki pages,
 you can ask on the
 [mailing list](http://groups.google.com/group/owasp-java-html-sanitizer-support).
diff --git a/empiricism/pom.xml b/empiricism/pom.xml
index a31e7e82..5c6a18b4 100644
--- a/empiricism/pom.xml
+++ b/empiricism/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20200713.2-SNAPSHOT</version>
+  <version>20211018.1</version>
   <packaging>jar</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200713.2-SNAPSHOT</version>
+    <version>20211018.1</version>
   </parent>
 
   <name>empiricism</name>
diff --git a/html-types/pom.xml b/html-types/pom.xml
index 4d8ab41a..121f70b9 100644
--- a/html-types/pom.xml
+++ b/html-types/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20200713.2-SNAPSHOT</version>
+  <version>20211018.1</version>
   <packaging>bundle</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200713.2-SNAPSHOT</version>
+    <version>20211018.1</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
diff --git a/parent/pom.xml b/parent/pom.xml
index e80abc22..04a54cbf 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -2,7 +2,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>parent</artifactId>
-  <version>20200713.2-SNAPSHOT</version>
+  <version>20211018.1</version>
 
   <packaging>pom</packaging>
 
diff --git a/pom.xml b/pom.xml
index 0bb532db..85b355f6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <relativePath>parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20200713.2-SNAPSHOT</version>
+    <version>20211018.1</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer</name>

From 7d76ba9b7461749878ee8f04c63af7f994690b7c Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 18 Oct 2021 09:38:11 -0400
Subject: [PATCH 20/28] Bumped dev version

---
 aggregate/pom.xml  | 4 ++--
 empiricism/pom.xml | 4 ++--
 html-types/pom.xml | 4 ++--
 parent/pom.xml     | 2 +-
 pom.xml            | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/aggregate/pom.xml b/aggregate/pom.xml
index f637b0a7..c178bb33 100644
--- a/aggregate/pom.xml
+++ b/aggregate/pom.xml
@@ -3,12 +3,12 @@
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>aggregate</artifactId>
   <packaging>pom</packaging>
-  <version>20211018.1</version>
+  <version>20211018.2-SNAPSHOT</version>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.1</version>
+    <version>20211018.2-SNAPSHOT</version>
   </parent>
 
   <modules>
diff --git a/empiricism/pom.xml b/empiricism/pom.xml
index 5c6a18b4..ddba80b9 100644
--- a/empiricism/pom.xml
+++ b/empiricism/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20211018.1</version>
+  <version>20211018.2-SNAPSHOT</version>
   <packaging>jar</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.1</version>
+    <version>20211018.2-SNAPSHOT</version>
   </parent>
 
   <name>empiricism</name>
diff --git a/html-types/pom.xml b/html-types/pom.xml
index 121f70b9..01d804c0 100644
--- a/html-types/pom.xml
+++ b/html-types/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20211018.1</version>
+  <version>20211018.2-SNAPSHOT</version>
   <packaging>bundle</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.1</version>
+    <version>20211018.2-SNAPSHOT</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
diff --git a/parent/pom.xml b/parent/pom.xml
index 04a54cbf..0ee62065 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -2,7 +2,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>parent</artifactId>
-  <version>20211018.1</version>
+  <version>20211018.2-SNAPSHOT</version>
 
   <packaging>pom</packaging>
 
diff --git a/pom.xml b/pom.xml
index 85b355f6..ad941049 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <relativePath>parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.1</version>
+    <version>20211018.2-SNAPSHOT</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer</name>

From e2b29e803c4f7ea225f569d18b3b1356d8e5bf3d Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 18 Oct 2021 11:19:40 -0400
Subject: [PATCH 21/28] Update vulnerabilities.md

---
 docs/vulnerabilities.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/vulnerabilities.md b/docs/vulnerabilities.md
index 80e5fb85..844ef855 100644
--- a/docs/vulnerabilities.md
+++ b/docs/vulnerabilities.md
@@ -1,4 +1,4 @@
 # Known & public vulnerabilities in this project
 
-  * [CVE-2021-42575](cve202142575.md) - 18 Oct. 2021 - Recommend upgrade to latest version.
+  * [CVE-2021-42575](cve202142575.md) - 18 Oct. 2021 - Recommend upgrade to v20211018.1 or later.
   * [CVE-2011-4457](cve20114457.md) - 17 Nov. 2011 - Recommend upgrade to r88 or later.

From 14f84fd49ebe68918b3aa0944a6a658674a39e6b Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 18 Oct 2021 15:35:14 -0400
Subject: [PATCH 22/28] Recognize that `<style>` is not really workable inside
 `<select>`

Rather than mucking with `<style>` tag content in all cases, this is a more
tailored fix to the recent vulnerability that just closes `<style>` elements
when we realize they're in a dodgy parsing context.
---
 .../org/owasp/html/HtmlStreamRenderer.java    | 21 ----------
 .../TagBalancingHtmlStreamEventReceiver.java  | 20 ++++++++++
 .../java/org/owasp/html/SanitizersTest.java   | 39 ++++++++++++-------
 .../TagBalancingHtmlStreamRendererTest.java   |  6 +--
 4 files changed, 47 insertions(+), 39 deletions(-)

diff --git a/src/main/java/org/owasp/html/HtmlStreamRenderer.java b/src/main/java/org/owasp/html/HtmlStreamRenderer.java
index 23d94d06..9c079d1c 100644
--- a/src/main/java/org/owasp/html/HtmlStreamRenderer.java
+++ b/src/main/java/org/owasp/html/HtmlStreamRenderer.java
@@ -254,25 +254,8 @@ private final void writeCloseTag(String uncanonElementName)
         Encoding.stripBannedCodeunits(cdataContent);
         int problemIndex = checkHtmlCdataCloseable(lastTagOpened, cdataContent);
         if (problemIndex == -1) {
-          String prefix = "";
-          String suffix = "";
-          Set<String> bannedSubstrings = Collections.emptySet();
-          if ("style".equals(elementName)) {
-            prefix = "/*<![CDATA[<!--*/\n";
-            suffix = "\n/*-->]]>*/";
-            bannedSubstrings = BANNED_IN_STYLE_ELEMENTS;
-          }
-
-          for (String bannedSubstring : bannedSubstrings) {
-            if (cdataContent.indexOf(bannedSubstring) >= 0) {
-              cdataContent.setLength(0);
-            }
-          }
-
           if (cdataContent.length() != 0) {
-            output.append(prefix);
             output.append(cdataContent);
-            output.append(suffix);
           }
         } else {
           error(
@@ -457,8 +440,4 @@ public void close() throws IOException {
   private static boolean isTagEnd(char ch) {
     return ch < 63 && 0 != (TAG_ENDS & (1L << ch));
   }
-
-  private static Set<String> BANNED_IN_STYLE_ELEMENTS = ImmutableSet.of(
-    "<![CDATA[", "]]>", "<!--", "-->"
-  );
 }
diff --git a/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java b/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
index aa2eb075..6df2a286 100644
--- a/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
+++ b/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
@@ -217,6 +217,15 @@ && canContain(elIndex, toResume, nOpen)) {
   private boolean canContain(
       int child, int container, int containerIndexOnStack) {
     Preconditions.checkArgument(containerIndexOnStack >= 0);
+    if (child == HtmlElementTables.TEXT_NODE && hasSpecialTextMode(container)) {
+      // If there's a select element on the stack, then we need to be extra careful.
+      int selectElementIndex = METADATA.indexForName("select");
+      for (int i = containerIndexOnStack; --i >= 0;) {
+        if (selectElementIndex == openElements.get(i)) {
+          return false;
+        }
+      }
+    }
     int anc = container;
     int ancIndexOnStack = containerIndexOnStack;
     while (true) {
@@ -363,6 +372,17 @@ private static boolean isHeaderElementName(String canonElementName) {
         && canonElementName.charAt(1) <= '9';
   }
 
+  private static boolean hasSpecialTextMode(int elementIndex) {
+    String name = METADATA.canonNameForIndex(elementIndex);
+    switch (HtmlTextEscapingMode.getModeForTag(name)) {
+      case PCDATA: case VOID:
+        return false;
+      case CDATA: case CDATA_SOMETIMES: case RCDATA: case PLAIN_TEXT:
+        return true;
+    }
+    throw new IllegalArgumentException(name);
+  }
+
   private static final byte ALL_SCOPES;
   private static final byte[] SCOPES_BY_ELEMENT;
   private static final byte[] SCOPE_FOR_END_TAG;
diff --git a/src/test/java/org/owasp/html/SanitizersTest.java b/src/test/java/org/owasp/html/SanitizersTest.java
index db522309..4cb7bbca 100644
--- a/src/test/java/org/owasp/html/SanitizersTest.java
+++ b/src/test/java/org/owasp/html/SanitizersTest.java
@@ -439,11 +439,7 @@ public static final void testStyleTagsInAllTheWrongPlaces() {
     String input = ""
       + "<select><option><style><script>alert(1)</script></style></option></select>"
       + "<svg><style>.r { color: red }</style></svg>"
-      + "<style>.b { color: blue }</style>"
-      + "<style>#a { content: \"<!--\" }</style>"
-      + "<style>#a { content: \"<![CDATA[\" }</style>"
-      + "<style>#a { content: \"-->\" }</style>"
-      + "<style>#a { content: \"]]>\" }</style>";
+      + "<style>.b { color: blue }</style>";
     PolicyFactory pf = new HtmlPolicyBuilder()
         .allowElements("option", "select", "style", "svg")
         .allowTextIn("style")
@@ -451,36 +447,49 @@ public static final void testStyleTagsInAllTheWrongPlaces() {
     assertEquals(
         ""
         + "<select><option>"
-        + "<style>/*<![CDATA[<!--*/\n<script>alert(1)</script>\n/*-->]]>*/</style>"
+        + "<style></style>&lt;script&gt;alert(1)&lt;/script&gt;"
         + "</option></select>"
         + "<svg>"
-        + "<style>/*<![CDATA[<!--*/\n.r { color: red }\n/*-->]]>*/</style>"
+        + "<style>.r { color: red }</style>"
         + "</svg>"
-        + "<style>/*<![CDATA[<!--*/\n.b { color: blue }\n/*-->]]>*/</style>"
-        + "<style></style>"
-        + "<style></style>"
-        + "<style></style>"
-        + "<style></style>",
+        + "<style>.b { color: blue }</style>",
         pf.sanitize(input)
     );
   }
 
   @Test
   public static final void testSelectIsOdd() {
+    // Special text modes interact badly with select and option
     String input = "<select><option><xmp><script>alert(1)</script></xmp></option></select>";
     PolicyFactory pf = new HtmlPolicyBuilder()
         .allowElements("option", "select", "xmp")
-        .allowTextIn("xmp")
+        .allowTextIn("xmp", "option")
         .toFactory();
     assertEquals(
         ""
-        + "<select><option>"
-        + "<pre>&lt;script&gt;alert(1)&lt;/script&gt;</pre>"
+        + "<select><option><pre></pre>"
+        + "&lt;script&gt;alert(1)&lt;/script&gt;"
         + "</option></select>",
         pf.sanitize(input)
     );
   }
 
+  @Test
+  public static final void testOptionAllowsText() {
+    String input = "<select><option><pre>code goes here</pre></option></select>";
+    PolicyFactory pf = new HtmlPolicyBuilder()
+            .allowElements("option", "select", "pre")
+            .allowTextIn("pre", "option")
+            .toFactory();
+    assertEquals(
+            ""
+                    + "<select><option>"
+                    + "<pre>code goes here</pre>"
+                    + "</option></select>",
+            pf.sanitize(input)
+    );
+  }
+
   @Test
   public static final void testStyleGlobally() {
     PolicyFactory policyBuilder = new HtmlPolicyBuilder()
diff --git a/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java b/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java
index 5195fde9..38a854ef 100644
--- a/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java
+++ b/src/test/java/org/owasp/html/TagBalancingHtmlStreamRendererTest.java
@@ -158,9 +158,9 @@ public final void testTextContent() {
         + "<p>Hello, <textarea>World!</textarea></p>"
         + "<h1>Hello"
         // Text allowed in special style tag.
-        + "<style type=\"text/css\">/*<![CDATA[<!--*/\n"
-        + "\n.World {\n  color: blue\n}\n"
-        + "\n/*-->]]>*/</style></h1>"
+        + "<style type=\"text/css\">\n"
+        + ".World {\n  color: blue\n}\n"
+        + "</style></h1>"
         // Whitespace allowed inside <ul> but non-whitespace text nodes are
         // moved inside <li>.
         + "<ul><li>Hello,</li><li>World!</li></ul>",

From 62a0715666b5101303ee828f26e71a07afaad974 Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 18 Oct 2021 15:51:41 -0400
Subject: [PATCH 23/28] Release candidate 20211018.2

---
 aggregate/pom.xml  | 4 ++--
 change_log.md      | 4 ++++
 empiricism/pom.xml | 4 ++--
 html-types/pom.xml | 4 ++--
 parent/pom.xml     | 2 +-
 pom.xml            | 2 +-
 6 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/aggregate/pom.xml b/aggregate/pom.xml
index c178bb33..535f4a76 100644
--- a/aggregate/pom.xml
+++ b/aggregate/pom.xml
@@ -3,12 +3,12 @@
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>aggregate</artifactId>
   <packaging>pom</packaging>
-  <version>20211018.2-SNAPSHOT</version>
+  <version>20211018.2</version>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.2-SNAPSHOT</version>
+    <version>20211018.2</version>
   </parent>
 
   <modules>
diff --git a/change_log.md b/change_log.md
index 712e97d1..549e2046 100644
--- a/change_log.md
+++ b/change_log.md
@@ -1,6 +1,10 @@
 # OWASP Java HTML Sanitizer Change Log
 
 Most recent at top.
+  * Release 20211018.2
+    * Tweak how we address CVE-2021-42575 to be more tailored and to
+      interfere less with `<style>` element content in general.  We
+      still advise not allowing attacker controlled `<style>` content.
   * Release 20211018.1
     * Fix [CVE-2021-42575](https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/edit#)
     * Changes rendering of `<style>` elements by wrapping text content
diff --git a/empiricism/pom.xml b/empiricism/pom.xml
index ddba80b9..c360855a 100644
--- a/empiricism/pom.xml
+++ b/empiricism/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20211018.2-SNAPSHOT</version>
+  <version>20211018.2</version>
   <packaging>jar</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.2-SNAPSHOT</version>
+    <version>20211018.2</version>
   </parent>
 
   <name>empiricism</name>
diff --git a/html-types/pom.xml b/html-types/pom.xml
index 01d804c0..1e829f65 100644
--- a/html-types/pom.xml
+++ b/html-types/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20211018.2-SNAPSHOT</version>
+  <version>20211018.2</version>
   <packaging>bundle</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.2-SNAPSHOT</version>
+    <version>20211018.2</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
diff --git a/parent/pom.xml b/parent/pom.xml
index 0ee62065..a2a71a64 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -2,7 +2,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>parent</artifactId>
-  <version>20211018.2-SNAPSHOT</version>
+  <version>20211018.2</version>
 
   <packaging>pom</packaging>
 
diff --git a/pom.xml b/pom.xml
index ad941049..945b43cd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <relativePath>parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.2-SNAPSHOT</version>
+    <version>20211018.2</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer</name>

From 06b299cf815052f6ca62ebc62077bb79857fd0a3 Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Mon, 18 Oct 2021 15:53:03 -0400
Subject: [PATCH 24/28] Bumped dev version

---
 aggregate/pom.xml  | 4 ++--
 empiricism/pom.xml | 4 ++--
 html-types/pom.xml | 4 ++--
 parent/pom.xml     | 2 +-
 pom.xml            | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/aggregate/pom.xml b/aggregate/pom.xml
index 535f4a76..c03a6bb3 100644
--- a/aggregate/pom.xml
+++ b/aggregate/pom.xml
@@ -3,12 +3,12 @@
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>aggregate</artifactId>
   <packaging>pom</packaging>
-  <version>20211018.2</version>
+  <version>20211018.3-SNAPSHOT</version>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.2</version>
+    <version>20211018.3-SNAPSHOT</version>
   </parent>
 
   <modules>
diff --git a/empiricism/pom.xml b/empiricism/pom.xml
index c360855a..d9953b5d 100644
--- a/empiricism/pom.xml
+++ b/empiricism/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20211018.2</version>
+  <version>20211018.3-SNAPSHOT</version>
   <packaging>jar</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.2</version>
+    <version>20211018.3-SNAPSHOT</version>
   </parent>
 
   <name>empiricism</name>
diff --git a/html-types/pom.xml b/html-types/pom.xml
index 1e829f65..0acdcccf 100644
--- a/html-types/pom.xml
+++ b/html-types/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20211018.2</version>
+  <version>20211018.3-SNAPSHOT</version>
   <packaging>bundle</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.2</version>
+    <version>20211018.3-SNAPSHOT</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
diff --git a/parent/pom.xml b/parent/pom.xml
index a2a71a64..52c41fd5 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -2,7 +2,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>parent</artifactId>
-  <version>20211018.2</version>
+  <version>20211018.3-SNAPSHOT</version>
 
   <packaging>pom</packaging>
 
diff --git a/pom.xml b/pom.xml
index 945b43cd..ef48410d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <relativePath>parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.2</version>
+    <version>20211018.3-SNAPSHOT</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer</name>

From 5372c747173f312b9342fac2ea6bc7445d3abeee Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Wed, 8 Jun 2022 10:43:14 -0600
Subject: [PATCH 25/28] Decode attribute content differently from text node
 content (#255)

As described in issue #254 `&para` is a full complete character
reference when decoding text node content, but not when
decoding attribute content which causes problems for URL attribute
values like

    /test?param1=foo&param2=bar

As shown via JS test code in that issue, a small set of
next characters prevent a character reference name match
from being considered complete.

This commit:
- modifies the decode functions to take an extra parameter
  `boolean inAttribute`, and modifies the Trie traversal
  loops to not store a longest match so far based on that
  parameter and some next character tests
- modifies the HTML lexer to pass that attribute appropriately
- for backwards compat, leaves the old APIs in place but `@deprecated`
- adds unit tests for the decode functions
- adds a unit test for the specific input from the issue

This change should make us more conformant with observed
browser behaviour so is not expected to cause compatibility
problems for existing users.

Fixes #254
---
 src/main/java/org/owasp/html/Encoding.java    |  15 +-
 .../java/org/owasp/html/HtmlEntities.java     |  50 +++-
 .../java/org/owasp/html/HtmlSanitizer.java    |   7 +-
 .../java/org/owasp/html/EncodingTest.java     | 252 +++++++-----------
 .../org/owasp/html/HtmlSanitizerTest.java     |   7 +
 5 files changed, 166 insertions(+), 165 deletions(-)

diff --git a/src/main/java/org/owasp/html/Encoding.java b/src/main/java/org/owasp/html/Encoding.java
index 4a2a601f..20dbed99 100644
--- a/src/main/java/org/owasp/html/Encoding.java
+++ b/src/main/java/org/owasp/html/Encoding.java
@@ -41,8 +41,21 @@ public final class Encoding {
    *
    * @param s text/html
    * @return text/plain
+   * @deprecated specify whether s is in an attribute value
    */
   public static String decodeHtml(String s) {
+    return decodeHtml(s, false);
+  }
+
+  /**
+   * Decodes HTML entities to produce a string containing only valid
+   * Unicode scalar values.
+   *
+   * @param s text/html
+   * @param inAttribute is s in an attribute value?
+   * @return text/plain
+   */
+  public static String decodeHtml(String s, boolean inAttribute) {
     int firstAmp = s.indexOf('&');
     int safeLimit = longestPrefixOfGoodCodeunits(s);
     if ((firstAmp & safeLimit) < 0) { return s; }
@@ -55,7 +68,7 @@ public static String decodeHtml(String s) {
       int amp = firstAmp;
       while (amp >= 0) {
         sb.append(s, pos, amp);
-        int end = HtmlEntities.appendDecodedEntity(s, amp, n, sb);
+        int end = HtmlEntities.appendDecodedEntity(s, amp, n, inAttribute, sb);
         pos = end;
         amp = s.indexOf('&', end);
       }
diff --git a/src/main/java/org/owasp/html/HtmlEntities.java b/src/main/java/org/owasp/html/HtmlEntities.java
index fc015776..774108cf 100644
--- a/src/main/java/org/owasp/html/HtmlEntities.java
+++ b/src/main/java/org/owasp/html/HtmlEntities.java
@@ -2307,9 +2307,26 @@ final class HtmlEntities {
    *    in {@code html}.
    * @param sb string builder to append to.
    * @return The offset after the end of the decoded sequence in {@code html}.
+   * @deprecated specify whether html is in an attribute value.
    */
   public static int appendDecodedEntity(
-      String html, int offset, int limit, StringBuilder sb) {
+     String html, int offset, int limit, StringBuilder sb) {
+    return appendDecodedEntity(html, offset, limit, false, sb);
+  }
+
+  /**
+   * Decodes any HTML entity at the given location and appends it to a string
+   * builder.  This handles both named and numeric entities.
+   *
+   * @param html HTML text.
+   * @param offset the position of the sequence to decode in {@code html}.
+   * @param limit the last position that could be part of the sequence to decode
+   *    in {@code html}.
+   * @param sb string builder to append to.
+   * @return The offset after the end of the decoded sequence in {@code html}.
+   */
+  public static int appendDecodedEntity(
+      String html, int offset, int limit, boolean inAttribute, StringBuilder sb) {
     char ch = html.charAt(offset);
     if ('&' != ch) {
       sb.append(ch);
@@ -2422,11 +2439,12 @@ public static int appendDecodedEntity(
         char nameChar = html.charAt(i);
         t = t.lookup(nameChar);
         if (t == null) { break; }
-        if (t.isTerminal()) {
+        if (t.isTerminal() && mayComplete(inAttribute, html, i, limit)) {
           longestDecode = t;
           tail = i + 1;
         }
       }
+      // Try again, case insensitively.
       if (longestDecode == null) {
         t = ENTITY_TRIE;
         for (int i = offset + 1; i < limit; ++i) {
@@ -2434,7 +2452,7 @@ public static int appendDecodedEntity(
           if ('Z' >= nameChar && nameChar >= 'A') { nameChar |= 32; }
           t = t.lookup(nameChar);
           if (t == null) { break; }
-          if (t.isTerminal()) {
+          if (t.isTerminal() && mayComplete(inAttribute, html, i, limit)) {
             longestDecode = t;
             tail = i + 1;
           }
@@ -2456,11 +2474,35 @@ public static int appendDecodedEntity(
 
   private static boolean isHtmlIdContinueChar(char ch) {
     int chLower = ch | 32;
-    return ('0' <= chLower && chLower <= '9')
+    return ('0' <= ch && ch <= '9')
             || ('a' <= chLower && chLower <= 'z')
             || ('-' == ch);
   }
 
+  /** True if the character at i in html may complete a named character reference */
+  private static boolean mayComplete(boolean inAttribute, String html, int i, int limit) {
+    if (inAttribute && html.charAt(i) != ';' && i + 1 < limit) {
+      // See if the next character blocks treating this as a full match.
+      // This avoids problems like "&para" being treated as a decoding in
+      //     <a href="?foo&param=1">
+      if (continuesCharacterReferenceName(html.charAt(i + 1))) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  /**
+   * @see <a href="https://github.com/OWASP/java-html-sanitizer/issues/254#issuecomment-1080864368"
+   * >comments in issue 254</a>
+   */
+  private static boolean continuesCharacterReferenceName(char ch) {
+    int chLower = ch | 32;
+    return ('0' <= ch && ch <= '9')
+            || ('a' <= chLower && chLower <= 'z')
+            || (ch == '=');
+  }
+
 //  /** A possible entity name like "amp" or "gt". */
 //  public static boolean isEntityName(String name) {
 //    Trie t = ENTITY_TRIE;
diff --git a/src/main/java/org/owasp/html/HtmlSanitizer.java b/src/main/java/org/owasp/html/HtmlSanitizer.java
index 63d7ae95..d5f8750c 100644
--- a/src/main/java/org/owasp/html/HtmlSanitizer.java
+++ b/src/main/java/org/owasp/html/HtmlSanitizer.java
@@ -144,7 +144,7 @@ public static void sanitize(
       switch (token.type) {
         case TEXT:
           receiver.text(
-              Encoding.decodeHtml(htmlContent.substring(token.start, token.end)));
+              Encoding.decodeHtml(htmlContent.substring(token.start, token.end), false));
           break;
         case UNESCAPED:
           receiver.text(Encoding.stripBannedCodeunits(
@@ -177,8 +177,9 @@ public static void sanitize(
                       htmlContent.substring(tagBodyToken.start, tagBodyToken.end)));
                   break;
                 case ATTRVALUE:
-                  attrs.add(Encoding.decodeHtml(stripQuotes(
-                      htmlContent.substring(tagBodyToken.start, tagBodyToken.end))));
+                  String attributeContentRaw =
+                          stripQuotes(htmlContent.substring(tagBodyToken.start, tagBodyToken.end));
+                  attrs.add(Encoding.decodeHtml(attributeContentRaw, true));
                   attrsReadyForName = true;
                   break;
                 case TAGEND:
diff --git a/src/test/java/org/owasp/html/EncodingTest.java b/src/test/java/org/owasp/html/EncodingTest.java
index eea7769a..54ff0b45 100644
--- a/src/test/java/org/owasp/html/EncodingTest.java
+++ b/src/test/java/org/owasp/html/EncodingTest.java
@@ -34,6 +34,24 @@
 
 @SuppressWarnings("javadoc")
 public final class EncodingTest extends TestCase {
+  private static void assertDecodedHtml(String want, String inputHtml) {
+    assertDecodedHtml(want, want, inputHtml);
+  }
+
+  private static void assertDecodedHtml(
+      String wantText, String wantAttr, String inputHtml
+  ) {
+    assertEquals(
+        "!inAttribute: " + inputHtml,
+        wantText,
+        Encoding.decodeHtml(inputHtml, false)
+    );
+    assertEquals(
+        "inAttribute: " + inputHtml,
+        wantAttr,
+        Encoding.decodeHtml(inputHtml, true)
+    );
+  }
 
   @Test
   public static final void testDecodeHtml() {
@@ -43,170 +61,90 @@ public static final void testDecodeHtml() {
     // 123456789012345678901234567890123456789012345678901234567890123456789
     String golden =
       "The quick\u00a0brown fox\njumps over\r\nthe lazy dog\n";
-    assertEquals(golden, Encoding.decodeHtml(html));
+    assertDecodedHtml(golden, html);
 
     // Don't allocate a new string when no entities.
-    assertSame(golden, Encoding.decodeHtml(golden));
+    assertSame(golden, golden);
 
     // test interrupted escapes and escapes at end of file handled gracefully
-    assertEquals(
-        "\\\\u000a",
-        Encoding.decodeHtml("\\\\u000a"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#x000a;"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#x00a;"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#x0a;"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#xa;"));
-    assertEquals(
+    assertDecodedHtml("\\\\u000a", "\\\\u000a");
+    assertDecodedHtml("\n", "&#x000a;");
+    assertDecodedHtml("\n", "&#x00a;");
+    assertDecodedHtml("\n", "&#x0a;");
+    assertDecodedHtml("\n", "&#xa;");
+    assertDecodedHtml(
         String.valueOf(Character.toChars(0x10000)),
-        Encoding.decodeHtml("&#x10000;"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#xa"));
-    assertEquals(
-        "&#x00ziggy",
-        Encoding.decodeHtml("&#x00ziggy"));
-    assertEquals(
-        "&#xa00z;",
-        Encoding.decodeHtml("&#xa00z;"));
-    assertEquals(
-        "&#\n",
-        Encoding.decodeHtml("&#&#x000a;"));
-    assertEquals(
-        "&#x\n",
-        Encoding.decodeHtml("&#x&#x000a;"));
-    assertEquals(
-        "\n\n",
-        Encoding.decodeHtml("&#xa&#x000a;"));
-    assertEquals(
-        "&#\n",
-        Encoding.decodeHtml("&#&#xa;"));
-    assertEquals(
-        "&#x",
-        Encoding.decodeHtml("&#x"));
-    assertEquals(
-        "",  // NUL elided.
-        Encoding.decodeHtml("&#x0"));
-    assertEquals(
-        "&#",
-        Encoding.decodeHtml("&#"));
-
-    assertEquals(
-        "\\",
-        Encoding.decodeHtml("\\"));
-    assertEquals(
-        "&",
-        Encoding.decodeHtml("&"));
-
-    assertEquals(
-        "&#000a;",
-        Encoding.decodeHtml("&#000a;"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#10;"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#010;"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#0010;"));
-    assertEquals(
-        "\t",
-        Encoding.decodeHtml("&#9;"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#10"));
-    assertEquals(
-        "&#00ziggy",
-        Encoding.decodeHtml("&#00ziggy"));
-    assertEquals(
-        "&#\n",
-        Encoding.decodeHtml("&#&#010;"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#0&#010;"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#01&#10;"));
-    assertEquals(
-        "&#\n",
-        Encoding.decodeHtml("&#&#10;"));
-    assertEquals(
-        "",  // Invalid XML char elided.
-        Encoding.decodeHtml("&#1"));
-    assertEquals(
-        "\t",
-        Encoding.decodeHtml("&#9"));
-    assertEquals(
-        "\n",
-        Encoding.decodeHtml("&#10"));
+        "&#x10000;"
+    );
+    assertDecodedHtml("\n", "&#xa");
+    assertDecodedHtml("&#x00ziggy", "&#x00ziggy");
+    assertDecodedHtml("&#xa00z;", "&#xa00z;");
+    assertDecodedHtml("&#\n", "&#&#x000a;");
+    assertDecodedHtml("&#x\n", "&#x&#x000a;");
+    assertDecodedHtml("\n\n", "&#xa&#x000a;");
+    assertDecodedHtml("&#\n", "&#&#xa;");
+    assertDecodedHtml("&#x", "&#x");
+    assertDecodedHtml("", "&#x0"); // NUL elided.
+    assertDecodedHtml("&#", "&#");
+
+    assertDecodedHtml("\\", "\\");
+    assertDecodedHtml("&", "&");
+
+    assertDecodedHtml("&#000a;", "&#000a;");
+    assertDecodedHtml("\n", "&#10;");
+    assertDecodedHtml("\n", "&#010;");
+    assertDecodedHtml("\n", "&#0010;");
+    assertDecodedHtml("\t", "&#9;");
+    assertDecodedHtml("\n", "&#10");
+    assertDecodedHtml("&#00ziggy", "&#00ziggy");
+    assertDecodedHtml("&#\n", "&#&#010;");
+    assertDecodedHtml("\n", "&#0&#010;");
+    assertDecodedHtml("\n", "&#01&#10;");
+    assertDecodedHtml("&#\n", "&#&#10;");
+    assertDecodedHtml("", "&#1"); // Invalid XML char elided.
+    assertDecodedHtml("\t", "&#9");
+    assertDecodedHtml("\n", "&#10");
 
     // test the named escapes
-    assertEquals(
-        "<",
-        Encoding.decodeHtml("&lt;"));
-    assertEquals(
-        ">",
-        Encoding.decodeHtml("&gt;"));
-    assertEquals(
-        "\"",
-        Encoding.decodeHtml("&quot;"));
-    assertEquals(
-        "'",
-        Encoding.decodeHtml("&apos;"));
-    assertEquals(
-        "'",
-        Encoding.decodeHtml("&#39;"));
-    assertEquals(
-        "'",
-        Encoding.decodeHtml("&#x27;"));
-    assertEquals(
-        "&",
-        Encoding.decodeHtml("&amp;"));
-    assertEquals(
-        "&lt;",
-        Encoding.decodeHtml("&amp;lt;"));
-    assertEquals(
-        "&",
-        Encoding.decodeHtml("&AMP;"));
-    assertEquals(
-        "&",
-        Encoding.decodeHtml("&AMP"));
-    assertEquals(
-        "&",
-        Encoding.decodeHtml("&AmP;"));
-    assertEquals(
-        "\u0391",
-        Encoding.decodeHtml("&Alpha;"));
-    assertEquals(
-        "\u03b1",
-        Encoding.decodeHtml("&alpha;"));
-    assertEquals(
-        "\ud835\udc9c",  // U+1D49C requires a surrogate pair in UTF-16.
-        Encoding.decodeHtml("&Ascr;"));
-    assertEquals(
-        "fj",  // &fjlig; refers to 2 characters.
-        Encoding.decodeHtml("&fjlig;"));
-    assertEquals(
-        "\u2233",  // HTML entity with the longest name.
-        Encoding.decodeHtml("&CounterClockwiseContourIntegral;"));
-    assertEquals( // Missing the semicolon.
-        "&CounterClockwiseContourIntegral",
-        Encoding.decodeHtml("&CounterClockwiseContourIntegral"));
-
-    assertEquals(
-        "&;",
-        Encoding.decodeHtml("&;"));
-    assertEquals(
-        "&bogus;",
-        Encoding.decodeHtml("&bogus;"));
+    assertDecodedHtml("<", "&lt;");
+    assertDecodedHtml(">", "&gt;");
+    assertDecodedHtml("\"", "&quot;");
+    assertDecodedHtml("'", "&apos;");
+    assertDecodedHtml("'", "&#39;");
+    assertDecodedHtml("'", "&#x27;");
+    assertDecodedHtml("&", "&amp;");
+    assertDecodedHtml("&lt;", "&amp;lt;");
+    assertDecodedHtml("&", "&AMP;");
+    assertDecodedHtml("&", "&AMP");
+    assertDecodedHtml("&", "&AmP;");
+    assertDecodedHtml("\u0391", "&Alpha;");
+    assertDecodedHtml("\u03b1", "&alpha;");
+    // U+1D49C requires a surrogate pair in UTF-16.
+    assertDecodedHtml("\ud835\udc9c", "&Ascr;");
+    // &fjlig; refers to 2 characters.
+    assertDecodedHtml("fj", "&fjlig;");
+    // HTML entity with the longest name.
+    assertDecodedHtml("\u2233", "&CounterClockwiseContourIntegral;");
+    // Missing the semicolon.
+    assertDecodedHtml(
+       "&CounterClockwiseContourIntegral",
+       "&CounterClockwiseContourIntegral"
+    );
+
+    assertDecodedHtml("&;", "&;");
+    assertDecodedHtml("&bogus;", "&bogus;");
+
+    // Some strings decode differently depending on whether or not they're in an HTML attribute.
+    assertDecodedHtml(
+        "?foo\u00B6m=bar",
+        "?foo&param=bar",
+        "?foo&param=bar"
+    );
+    assertDecodedHtml(
+        "?foo\u00B6=bar",
+        "?foo&para=bar",
+        "?foo&para=bar"
+    );
   }
 
   @Test
diff --git a/src/test/java/org/owasp/html/HtmlSanitizerTest.java b/src/test/java/org/owasp/html/HtmlSanitizerTest.java
index 53ff9270..d1a73e86 100644
--- a/src/test/java/org/owasp/html/HtmlSanitizerTest.java
+++ b/src/test/java/org/owasp/html/HtmlSanitizerTest.java
@@ -440,6 +440,13 @@ public static final void testMacOSAndIOSQueryOfDeath() {
     }
   }
 
+  @Test
+  public static final void testIssue254SemicolonlessNamedCharactersInUrls() {
+    String input = "<a href=\"/test/?param1=valueOne&param2=valueTwo\">click me</a>";
+    String want = "<a href=\"/test/?param1&#61;valueOne&amp;param2&#61;valueTwo\">click me</a>";
+    assertEquals(want, sanitize(input));
+  }
+
   private static String sanitize(@Nullable String html) {
     StringBuilder sb = new StringBuilder();
     HtmlStreamRenderer renderer = HtmlStreamRenderer.create(

From c2c74fcd8ad0398e5d0d060f4c98628803924ddf Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Wed, 8 Jun 2022 10:45:42 -0600
Subject: [PATCH 26/28] Fix missing null checks in uses of
 consumeIdentOrUrlOrFunctions (#266)

CssTokens code assumed that consumeIdentOrUrlOrFunctions always
returned a token type and consumed characters.

This commit audits all uses of that function and checks that
they make progress.
---
 src/main/java/org/owasp/html/CssTokens.java   | 32 ++++++++++++++++---
 .../org/owasp/html/HtmlSanitizerTest.java     |  7 ++++
 2 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/src/main/java/org/owasp/html/CssTokens.java b/src/main/java/org/owasp/html/CssTokens.java
index 28aa16dc..7fd44904 100644
--- a/src/main/java/org/owasp/html/CssTokens.java
+++ b/src/main/java/org/owasp/html/CssTokens.java
@@ -453,7 +453,7 @@ void lex() {
         char ch = css.charAt(pos);
         int startOfToken = pos;
         int startOfOutputToken = sb.length();
-        final TokenType type;
+        TokenType type;
         switch (ch) {
           case '\t': case '\n': case '\f': case '\r': case ' ': case '\ufeff':
             consumeIgnorable();
@@ -514,6 +514,7 @@ void lex() {
               type = TokenType.UNICODE_RANGE;
             } else {
               type = consumeIdentOrUrlOrFunction();
+              assert type != null;
             }
             break;
           case '0': case '1': case '2': case '3': case '4':
@@ -533,7 +534,14 @@ && isDecimal(css.charAt(pos + 2)))) {
               if (consumeIgnorable()) {  // -->
                 type = TokenType.WHITESPACE;
               } else {
-                type = consumeIdentOrUrlOrFunction();
+                TokenType identType = consumeIdentOrUrlOrFunction();
+                if (identType == null) {
+                  breakOutput();
+                  consumeDelim(ch);
+                  type = TokenType.DELIM;
+                } else {
+                  type = identType;
+                }
               }
             } else if (isIdentPart(lookahead)) {
               // treat ".<IDENT>" as one token.
@@ -589,9 +597,17 @@ && isDecimal(css.charAt(pos + 2)))) {
             }
             break;
           }
-          case '_':
-            type = consumeIdentOrUrlOrFunction();
+          case '_': {
+            TokenType identType = consumeIdentOrUrlOrFunction();
+            if (identType != null) {
+              type = identType;
+            } else {
+              ++pos;  // drop
+              breakOutput();
+              type = TokenType.WHITESPACE;
+            }
             break;
+          }
           case '\\': {
             // Optimistically parse as an ident.
             TokenType identType = consumeIdentOrUrlOrFunction();
@@ -624,7 +640,13 @@ && isDecimal(css.charAt(pos + 2)))) {
               type = TokenType.WHITESPACE;
             }
         }
-        assert pos > startOfToken
+        // Make progress even in the face of errors above.
+        if (type == null && pos == startOfToken) {
+          type = TokenType.WHITESPACE;
+          breakOutput();
+          ++pos;
+        }
+        assert type != null && pos > startOfToken
             : "empty token at " + pos + ", ch0=" + css.charAt(startOfToken)
             + ":U+" + Integer.toHexString(css.charAt(startOfToken));
         int endOfOutputToken = sb.length();
diff --git a/src/test/java/org/owasp/html/HtmlSanitizerTest.java b/src/test/java/org/owasp/html/HtmlSanitizerTest.java
index d1a73e86..1ff169df 100644
--- a/src/test/java/org/owasp/html/HtmlSanitizerTest.java
+++ b/src/test/java/org/owasp/html/HtmlSanitizerTest.java
@@ -447,6 +447,13 @@ public static final void testIssue254SemicolonlessNamedCharactersInUrls() {
     assertEquals(want, sanitize(input));
   }
 
+  @Test
+  public static final void testStylingCornerCase() {
+    String input = "<a style=\\006-\\000038";
+    String want = "";
+    assertEquals(want, sanitize(input));
+  }
+
   private static String sanitize(@Nullable String html) {
     StringBuilder sb = new StringBuilder();
     HtmlStreamRenderer renderer = HtmlStreamRenderer.create(

From e35ef4fec8a4021845204c5cedb952e1aaf679e4 Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Wed, 8 Jun 2022 11:10:35 -0600
Subject: [PATCH 27/28] Release candidate 20220608.1

---
 README.md               | 10 +++++-----
 aggregate/pom.xml       |  4 ++--
 change_log.md           |  5 +++++
 docs/getting_started.md | 10 +++++-----
 docs/maven.md           |  2 +-
 empiricism/pom.xml      |  4 ++--
 html-types/pom.xml      |  4 ++--
 parent/pom.xml          |  2 +-
 pom.xml                 |  2 +-
 9 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/README.md b/README.md
index caab4b2e..e6249953 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ how to get started with or without Maven.
 ## Prepackaged Policies
 
 You can use
-[prepackaged policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/Sanitizers.html):
+[prepackaged policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/org/owasp/html/Sanitizers.html):
 
 ```Java
 PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
@@ -47,7 +47,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
 The
 [tests](https://github.com/OWASP/java-html-sanitizer/blob/main/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java)
 show how to configure your own
-[policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/HtmlPolicyBuilder.html):
+[policy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/org/owasp/html/HtmlPolicyBuilder.html):
 
 ```Java
 PolicyFactory policy = new HtmlPolicyBuilder()
@@ -62,7 +62,7 @@ String safeHTML = policy.sanitize(untrustedHTML);
 ## Custom Policies
 
 You can write
-[custom policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/ElementPolicy.html)
+[custom policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/org/owasp/html/ElementPolicy.html)
 to do things like changing `h1`s to `div`s with a certain class:
 
 ```Java
@@ -85,7 +85,7 @@ need to be explicitly whitelisted using the `allowWithoutAttributes()`
 method if you want them to be allowed through the filter when these
 elements do not include any attributes.
 
-[Attribute policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/AttributePolicy.html) allow running custom code too.  Adding an attribute policy will not water down any default policy like `style` or URL attribute checks.
+[Attribute policies](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/org/owasp/html/AttributePolicy.html) allow running custom code too.  Adding an attribute policy will not water down any default policy like `style` or URL attribute checks.
 
 ```Java
 new HtmlPolicyBuilder = new HtmlPolicyBuilder()
@@ -153,7 +153,7 @@ of the output.
 
 ## Telemetry
 
-When a policy rejects an element or attribute it notifies an [HtmlChangeListener](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/HtmlChangeListener.html).
+When a policy rejects an element or attribute it notifies an [HtmlChangeListener](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/org/owasp/html/HtmlChangeListener.html).
 
 You can use this to keep track of policy violation trends and find out when someone
 is making an effort to breach your security.
diff --git a/aggregate/pom.xml b/aggregate/pom.xml
index c03a6bb3..2102bae6 100644
--- a/aggregate/pom.xml
+++ b/aggregate/pom.xml
@@ -3,12 +3,12 @@
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>aggregate</artifactId>
   <packaging>pom</packaging>
-  <version>20211018.3-SNAPSHOT</version>
+  <version>20220608.1</version>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.3-SNAPSHOT</version>
+    <version>20220608.1</version>
   </parent>
 
   <modules>
diff --git a/change_log.md b/change_log.md
index 549e2046..04324a49 100644
--- a/change_log.md
+++ b/change_log.md
@@ -1,6 +1,11 @@
 # OWASP Java HTML Sanitizer Change Log
 
 Most recent at top.
+  * Release 20220608.1
+    * Fix bugs in CSS tokenization
+    * Fix deocding of HTML character references that lack semicolons
+      like `&para` in HTML attribute values that affected
+      URL query parameters.
   * Release 20211018.2
     * Tweak how we address CVE-2021-42575 to be more tailored and to
       interfere less with `<style>` element content in general.  We
diff --git a/docs/getting_started.md b/docs/getting_started.md
index 6f5909b1..44de7fe8 100644
--- a/docs/getting_started.md
+++ b/docs/getting_started.md
@@ -30,16 +30,16 @@ it to HTML.
 The
 [javadoc](http://javadoc.io/doc/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/)
 covers more detailed topics, including
-[customization](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/HtmlPolicyBuilder.html).
+[customization](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/org/owasp/html/HtmlPolicyBuilder.html).
 
 Important classes are:
 
-  * [Sanitizers](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
-  * [HtmlPolicyBuilder](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
+  * [Sanitizers](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/org/owasp/html/Sanitizers.html) contains combinable pre-packaged policies.
+  * [HtmlPolicyBuilder](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/org/owasp/html/HtmlPolicyBuilder.html) lets you easily build custom policies.
 
 For advanced use, see:
-  * [AttributePolicy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20180219.1/org/owasp/html/ElementPolicy.html) allow complex customization.
-  * [HtmlStreamEventReceiver](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
+  * [AttributePolicy](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/org/owasp/html/AttributePolicy.html) and [ElementPolicy](http://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20180219.1/org/owasp/html/ElementPolicy.html) allow complex customization.
+  * [HtmlStreamEventReceiver](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/org/owasp/html/HtmlStreamEventReceiver.html) if you don't just want a `String` as output.
 
 ## Asking Questions
 
diff --git a/docs/maven.md b/docs/maven.md
index 25c62755..c24a0464 100644
--- a/docs/maven.md
+++ b/docs/maven.md
@@ -23,7 +23,7 @@ Bigger numbers are more recent and the [change log](../change_log.md)
 can shed light on the salient differences.
 
 You should be able to build with the HTML sanitizer.  You can read the
-[javadoc](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20211018.1/index.html),
+[javadoc](https://static.javadoc.io/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer/20220608.1/index.html),
 and if you have questions that aren't answered by these wiki pages,
 you can ask on the
 [mailing list](http://groups.google.com/group/owasp-java-html-sanitizer-support).
diff --git a/empiricism/pom.xml b/empiricism/pom.xml
index d9953b5d..d37fd718 100644
--- a/empiricism/pom.xml
+++ b/empiricism/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20211018.3-SNAPSHOT</version>
+  <version>20220608.1</version>
   <packaging>jar</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.3-SNAPSHOT</version>
+    <version>20220608.1</version>
   </parent>
 
   <name>empiricism</name>
diff --git a/html-types/pom.xml b/html-types/pom.xml
index 0acdcccf..8e033034 100644
--- a/html-types/pom.xml
+++ b/html-types/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20211018.3-SNAPSHOT</version>
+  <version>20220608.1</version>
   <packaging>bundle</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.3-SNAPSHOT</version>
+    <version>20220608.1</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
diff --git a/parent/pom.xml b/parent/pom.xml
index 52c41fd5..ee4dd051 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -2,7 +2,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>parent</artifactId>
-  <version>20211018.3-SNAPSHOT</version>
+  <version>20220608.1</version>
 
   <packaging>pom</packaging>
 
diff --git a/pom.xml b/pom.xml
index ef48410d..6346b3e9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <relativePath>parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20211018.3-SNAPSHOT</version>
+    <version>20220608.1</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer</name>

From 37569793a12238424ebd1c2ccfc7db011b327088 Mon Sep 17 00:00:00 2001
From: Mike Samuel <mikesamuel@gmail.com>
Date: Wed, 8 Jun 2022 11:12:00 -0600
Subject: [PATCH 28/28] Bumped dev version

---
 aggregate/pom.xml  | 4 ++--
 empiricism/pom.xml | 4 ++--
 html-types/pom.xml | 4 ++--
 parent/pom.xml     | 2 +-
 pom.xml            | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/aggregate/pom.xml b/aggregate/pom.xml
index 2102bae6..1fc1a84e 100644
--- a/aggregate/pom.xml
+++ b/aggregate/pom.xml
@@ -3,12 +3,12 @@
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>aggregate</artifactId>
   <packaging>pom</packaging>
-  <version>20220608.1</version>
+  <version>20220608.2-SNAPSHOT</version>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20220608.1</version>
+    <version>20220608.2-SNAPSHOT</version>
   </parent>
 
   <modules>
diff --git a/empiricism/pom.xml b/empiricism/pom.xml
index d37fd718..2a5d1c8f 100644
--- a/empiricism/pom.xml
+++ b/empiricism/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20220608.1</version>
+  <version>20220608.2-SNAPSHOT</version>
   <packaging>jar</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20220608.1</version>
+    <version>20220608.2-SNAPSHOT</version>
   </parent>
 
   <name>empiricism</name>
diff --git a/html-types/pom.xml b/html-types/pom.xml
index 8e033034..97f9eb19 100644
--- a/html-types/pom.xml
+++ b/html-types/pom.xml
@@ -2,13 +2,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>html-types</artifactId>
-  <version>20220608.1</version>
+  <version>20220608.2-SNAPSHOT</version>
   <packaging>bundle</packaging>
   <parent>
     <relativePath>../parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20220608.1</version>
+    <version>20220608.2-SNAPSHOT</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer Safe HTML Compatibility</name>
diff --git a/parent/pom.xml b/parent/pom.xml
index ee4dd051..ec4f2631 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -2,7 +2,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
   <artifactId>parent</artifactId>
-  <version>20220608.1</version>
+  <version>20220608.2-SNAPSHOT</version>
 
   <packaging>pom</packaging>
 
diff --git a/pom.xml b/pom.xml
index 6346b3e9..ed9b523f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <relativePath>parent</relativePath>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>parent</artifactId>
-    <version>20220608.1</version>
+    <version>20220608.2-SNAPSHOT</version>
   </parent>
 
   <name>OWASP Java HTML Sanitizer</name>