NullPointerException for input string "|<?ai aaa"

[eddierock1994]

The code in question gets invoked through ESAPI library so I'm not sure if it has a bearing. But on examination of the method removePI of class AntiSamyDOMScanner, it looks like the node doesn't have any parent node. And so node.getParentNode() creates a null pointer exception. Attaching the stack trace here.

java.lang.NullPointerException
at org.owasp.validator.html.scan.AntiSamyDOMScanner.removePI(AntiSamyDOMScanner.java:689)
at org.owasp.validator.html.scan.AntiSamyDOMScanner.recursiveValidateTag(AntiSamyDOMScanner.java:260)
at org.owasp.validator.html.scan.AntiSamyDOMScanner.processChildren(AntiSamyDOMScanner.java:675)
at org.owasp.validator.html.scan.AntiSamyDOMScanner.processChildren(AntiSamyDOMScanner.java:666)
at org.owasp.validator.html.scan.AntiSamyDOMScanner.scan(AntiSamyDOMScanner.java:159)
at org.owasp.validator.html.AntiSamy.scan(AntiSamy.java:93)

[spassarop]

Hi @eddierock1994, thanks for the analysis. You're right, the problem in removePI is node.getParentNode().removeChild(node);.

In fact, after analyzing the issue I realized that the line is not even necessary. That's because the previous removeNode(node); call already does the same exact task, so the last line became redundant and conflictive. I think the best solution is to remove it.

I've added a unit test with four cases, soon to be uploaded in a PR with the suggested change. To make it easier for everyone to understand the problem (luckily this was not the case) and have a starting point in future reported issues, provide a JUnit test :)

[eddierock1994]

Hi @spassarop will provide a Junit test in the future. Sorry it's my first time logging an issue.

[davewichers]

This has been fixed in release 1.5.13

[eddierock1994]

Thanks for the quick resolution. You guys are great :D