Hibernate Validator @SafeHtml fails to allow custom HTML tags and attributes

Question

I have a Java-based back end in which I'm using Hibernate for some more specific bean validation, namely: @SafeHtml. It works great for 99% of my needs, however, I have a part that allows a user to enter basic HTML to create their own header/footer. Therefore, I need to be less restrictive here.

For some reason, something is not right in my code. I'm getting 400 Bad Request. I would really appreciate any help. Thank you in advance!

HTML:

 <table bgcolor="navy" cellpadding="0" cellspacing="0" border="0" height="60" width="600" style="border-collapse:collapse;">
    <tr>
      <td>
          <div style="display:none;font-size:1px;line-height:1px;max-height:0px;max-width:0px;opacity:0;overflow:hidden;mso-hide:all;font-family: sans-serif;">
          </div>
          <table align="left" width="600" class="email-container" cellpadding="0" cellspacing="0" border="0">
            <tr>
              <td style="padding: 20px 10px;width: 100%;font-size: 12px; mso-height-rule: exactly; line-height:14px; text-align: center; color: #CCCCCC;">
                © HELLO WORLD All rights reserved - <a href="https://www.someUrl" style="color: #CCCCCC" target="new" rel="noopener noreferrer">Privacy Policy GK</a>
              </td>
            </tr>
          </table>
      </td>
    </tr>
  </table>


Java:

    @SafeHtml(whitelistType = SafeHtml.WhiteListType.RELAXED,
            additionalTags = {"html", "tr", "body", "b", "i", "table", "td", "center", "div", "a", "img", "font"},
            additionalTagsWithAttributes = {
                    //@SafeHtml.Tag(name = "a", attributesWithProtocols = @SafeHtml.Attribute(name = "href", protocols = "#")),
                    @SafeHtml.Tag(name = "a", attributes = {"href"}),
                    @SafeHtml.Tag(name = "body", attributes = {"bgcolor", "width", "style"}),
                    @SafeHtml.Tag(name = "table", attributes = {"align", "bgcolor", "cellpadding", "cellspacing", "border", "height", "width", "style", "color", "class"}),
                    @SafeHtml.Tag(name = "td", attributes = {"style", "align", "bgcolor"}),
                    @SafeHtml.Tag(name = "font", attributes = {"face"}),
                    @SafeHtml.Tag(name = "img", attributes = {"src", "width", "height", "alt", "border"}),
                    @SafeHtml.Tag(name = ":all", attributes = {"style", "dir", "checked", "class", "id", "target", "title", "type"})
            })

Answer 1

You are not allowing for "rel" inside "a". Just try :

@SafeHtml.Tag(name = "a", attributes = {"href", "rel"}),

And it will work.

Full test source:

package org.example;

import static org.junit.Assert.assertTrue;

import org.hibernate.validator.constraints.SafeHtml;
import org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator;
import org.junit.Test;

@SafeHtml(whitelistType = SafeHtml.WhiteListType.RELAXED,
        additionalTags = {"html", "tr", "body", "b", "i", "table", "td", "center", "div", "a", "img", "font"},
        additionalTagsWithAttributes = {
                //@SafeHtml.Tag(name = "a", attributesWithProtocols = @SafeHtml.Attribute(name = "href", protocols = "#")),
                @SafeHtml.Tag(name = "a", attributes = {"href", "rel"}),
                @SafeHtml.Tag(name = "body", attributes = {"bgcolor", "width", "style"}),
                @SafeHtml.Tag(name = "table", attributes = {"align", "bgcolor", "cellpadding", "cellspacing", "border", "height", "width", "style", "color", "class"}),
                @SafeHtml.Tag(name = "td", attributes = {"style", "align", "bgcolor"}),
                @SafeHtml.Tag(name = "font", attributes = {"face"}),
                @SafeHtml.Tag(name = "img", attributes = {"src", "width", "height", "alt", "border"}),
                @SafeHtml.Tag(name = ":all", attributes = {"style", "dir", "checked", "class", "id", "target", "title", "type"})
        })
public class Q60122842Test
{
    @Test
    public void isValid()
    {
        String value = " <table bgcolor=\"navy\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" height=\"60\" width=\"600\" style=\"border-collapse:collapse;\">\n" +
                "    <tr>\n" +
                "      <td>\n" +
                "          <div style=\"display:none;font-size:1px;line-height:1px;max-height:0px;max-width:0px;opacity:0;overflow:hidden;mso-hide:all;font-family: sans-serif;\">\n" +
                "          </div>\n" +
                "          <table align=\"left\" width=\"600\" class=\"email-container\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\">\n" +
                "            <tr>\n" +
                "              <td style=\"padding: 20px 10px;width: 100%;font-size: 12px; mso-height-rule: exactly; line-height:14px; text-align: center; color: #CCCCCC;\">\n" +
                "                © HELLO WORLD All rights reserved - <a href=\"https://www.someUrl\" style=\"color: #CCCCCC\" target=\"new\" rel=\"noopener noreferrer\">Privacy Policy GK</a>\n" +
                "              </td>\n" +
                "            </tr>\n" +
                "          </table>\n" +
                "      </td>\n" +
                "    </tr>\n" +
                "  </table>";

        SafeHtml annotation = Q60122842Test.class.getAnnotation(SafeHtml.class);
        SafeHtmlValidator validator = new SafeHtmlValidator();
        validator.initialize( annotation );
        assertTrue(validator.isValid(value, null));
    }
}