Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WhiteListSanitizer hangs on long/specific style attributes #41

Closed
haf7 opened this issue Jul 19, 2015 · 3 comments
Closed

WhiteListSanitizer hangs on long/specific style attributes #41

haf7 opened this issue Jul 19, 2015 · 3 comments

Comments

@haf7
Copy link

haf7 commented Jul 19, 2015

WhiteListSanitizer hangs on (for example) the following input:

b2="<li class=\"my_next\" style=\"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 5px; padding-right: 10px; padding-bottom: 5px; padding-left: 10px; border-top-width: 1px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; outline-width: 0px; outline-style: initial; outline-color: initial; line-height: normal; font-style: inherit; font-size: 11px; font-family: inherit; word-spacing: normal; vertical-align: baseline; list-style-type: none; list-style-position: initial; list-style-image: initial; border-top-style: solid; border-top-color: rgb(51, 51, 51); font: normal normal bold 11px/normal Arial, Helvetica, sans-serif; color: rgb(255, 255, 255); white-space: nowrap; cursor: pointer; text-indent: 0px; \">Play Next</li>"
white_list_sanitizer = Rails::Html::WhiteListSanitizer.new
white_list_sanitizer.sanitize(b2)

Tested with rails 4.2.3

@mfazekas
Copy link

mfazekas commented Aug 5, 2015

probably related flavorjones/loofah#90

@kaspth
Copy link
Contributor

kaspth commented Aug 9, 2015

I'm closing because this is an issue with Loofah, as @mfazekas mentioned: flavorjones/loofah#90. Thanks ❤️

@kaspth kaspth closed this as completed Aug 9, 2015
@flavorjones
Copy link
Member

@haf7 Worth noting that I cannot reproduce hanging on your example, given Loofah v2.0.2 and Ruby 2.2.2.

But yes, flavorjones/loofah#90 is probably related.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants