/*
 * Copyright 2016-2017 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package de.vorb.platon.config;

import de.vorb.platon.util.InputSanitizer;

import org.owasp.html.HtmlPolicyBuilder;
import org.owasp.html.PolicyFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

@Configuration
public class PlatonConfig {

    @Bean
    public WebMvcConfigurerAdapter staticResourceHandlerConfigurer() {
        return new WebMvcConfigurerAdapter() {
            @Override
            public void addResourceHandlers(ResourceHandlerRegistry registry) {
                registry.addResourceHandler("classpath:/public");
            }
        };
    }

    private static final HtmlPolicyBuilder htmlContentPolicyBuilder = new HtmlPolicyBuilder()
            .allowUrlProtocols("http", "https", "mailto")
            .allowAttributes("href").onElements("a")
            .allowAttributes("src", "width", "height", "alt").onElements("img")
            .allowAttributes("class").onElements("div", "span");

    @Value("${platon.input.html_elements}")
    private String htmlElements;

    @Bean
    public InputSanitizer htmlInputSanitizer() {
        final String[] htmlElementList = htmlElements.split("\\s*,\\s*");

        htmlContentPolicyBuilder.allowElements(htmlElementList);

        final PolicyFactory htmlContentPolicy = htmlContentPolicyBuilder.toFactory();

        return htmlContentPolicy::sanitize;
    }

}

@@ -1485,22 +1485,137 @@
     
-private static
+@Bean%0A    public InputSanitizer htmlInputSanitizer(@Value(%22$%7Bplaton.input.html_elements%7D%22) String allowedHtmlElements) %7B%0A%0A       
  fin
@@ -1635,31 +1635,24 @@
 Builder html
-Content
 PolicyBuilde
@@ -1679,16 +1679,20 @@
 ilder()%0A
+    
         
@@ -1745,32 +1745,36 @@
 o%22)%0A            
+ 
+   
 .allowAttributes
@@ -1802,32 +1802,36 @@
 a%22)%0A            
+   
+ 
 .allowAttributes
@@ -1886,32 +1886,36 @@
 g%22)%0A            
+    
 .allowAttributes
@@ -1960,183 +1960,52 @@
     
-@Value(%22$%7Bplaton.input.html_elements%7D%22)%0A    private String htmlElements;%0A%0A    @Bean%0A    public InputSanitizer htmlInputSanitizer() %7B%0A        final String%5B%5D htmlElementList = h
+    htmlPolicyBuilder.allowElements(allowedH
 tmlE
@@ -2012,16 +2012,23 @@
 lements.
+trim().
 split(%22%5C
@@ -2041,73 +2041,8 @@
 s*%22)
-;%0A%0A        htmlContentPolicyBuilder.allowElements(htmlElementList
 );%0A%0A
@@ -2089,31 +2089,24 @@
 olicy = html
-Content
 PolicyBuilde

Reduce PlatonConfig