Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Negative value sanitisation support for shorthand css properties #85

Closed
wants to merge 2 commits into from
Closed

Negative value sanitisation support for shorthand css properties #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f3a1686
Negative value sanitisation support for shorthand css properties
mukherjee78 Mar 31, 2015
06341a5
Support for data attributes with dash
mukherjee78 Apr 7, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions lib/loofah/html5/scrub.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ def scrub_attributes node
attr_node.node_name
end

if attr_name =~ /\Adata-\w+\z/
if attr_name =~ /\Adata-\S+\z/
next
end

Expand Down Expand Up @@ -79,7 +79,7 @@ def scrub_css style
elsif WhiteList::SHORTHAND_CSS_PROPERTIES.include?(prop.split('-')[0])
clean << "#{prop}: #{val};" unless val.split().any? do |keyword|
!WhiteList::ALLOWED_CSS_KEYWORDS.include?(keyword) &&
keyword !~ /\A(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/
keyword !~ /\A(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|-?\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/
end
elsif WhiteList::ALLOWED_SVG_PROPERTIES.include?(prop)
clean << "#{prop}: #{val};"
Expand Down
14 changes: 14 additions & 0 deletions test/html5/test_sanitizer.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,14 @@ def test_should_allow_data_attributes
check_sanitization(input, htmloutput, output, output)
end

def test_should_allow_data_attributes_with_dash
input = "<p data-index-number='123456'>123456</p>"

output = "<p data-index-number='123456'>123456</p>"
check_sanitization(input, output, output, output)
end


Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was actually already fixed by #87.

##
## libxml2 downcases attributes, so this is moot.
##
Expand Down Expand Up @@ -220,6 +228,12 @@ def test_css_negative_value_sanitization
sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :escape).to_xml)
assert_match %r/-0.03em/, sane.inner_html
end

def test_css_negative_value_sanitization_shorthand_css_properties
html = "<span style=\"margin-left:-0.05em;\">"
sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :escape).to_xml)
assert_match %r/-0.05em/, sane.inner_html
end
end

# <html5_license>
Expand Down