diff --git a/reader/sanitizer/sanitizer.go b/reader/sanitizer/sanitizer.go
index 0af6c197..92ae869e 100644
--- a/reader/sanitizer/sanitizer.go
+++ b/reader/sanitizer/sanitizer.go
@@ -113,6 +113,10 @@ func sanitizeAttributes(baseURL, tagName string, attributes []html.Attribute) ([
value = sanitizeSrcsetAttr(baseURL, value)
}
+ if tagName == "img" && (attribute.Key == "width" || attribute.Key == "height") && !isPositiveInteger(value) {
+ continue
+ }
+
if isExternalResourceAttribute(attribute.Key) {
if tagName == "iframe" {
if isValidIframeSource(baseURL, attribute.Val) {
@@ -350,7 +354,7 @@ func isValidIframeSource(baseURL, src string) bool {
func getTagAllowList() map[string][]string {
whitelist := make(map[string][]string)
- whitelist["img"] = []string{"alt", "title", "src", "srcset", "sizes"}
+ whitelist["img"] = []string{"alt", "title", "src", "srcset", "sizes", "width", "height"}
whitelist["picture"] = []string{}
whitelist["audio"] = []string{"src"}
whitelist["video"] = []string{"poster", "height", "width", "src"}
@@ -511,3 +515,10 @@ func isValidDataAttribute(value string) bool {
}
return false
}
+
+func isPositiveInteger(value string) bool {
+ if number, err := strconv.Atoi(value); err == nil {
+ return number > 0
+ }
+ return false
+}
diff --git a/reader/sanitizer/sanitizer_test.go b/reader/sanitizer/sanitizer_test.go
index fedb98ee..aee7ba4e 100644
--- a/reader/sanitizer/sanitizer_test.go
+++ b/reader/sanitizer/sanitizer_test.go
@@ -15,6 +15,26 @@ func TestValidInput(t *testing.T) {
}
}
+func TestImgWithWidthAndHeightAttribute(t *testing.T) {
+ input := `
`
+ expected := `
`
+ output := Sanitize("http://example.org/", input)
+
+ if output != expected {
+ t.Errorf(`Wrong output: %s`, output)
+ }
+}
+
+func TestImgWithIncorrectWidthAndHeightAttribute(t *testing.T) {
+ input := `
`
+ expected := `
`
+ output := Sanitize("http://example.org/", input)
+
+ if output != expected {
+ t.Errorf(`Wrong output: %s`, output)
+ }
+}
+
func TestImgWithTextDataURL(t *testing.T) {
input := `
`
expected := ``
@@ -57,7 +77,7 @@ func TestSourceWithSrcsetAndMedia(t *testing.T) {
func TestMediumImgWithSrcset(t *testing.T) {
input := `
`
- expected := `
`
+ expected := `
`
output := Sanitize("http://example.org/", input)
if output != expected {