Whitelist text-align property for th and td
This commit is contained in:
parent
bc2cf82f68
commit
e1a77fa757
|
@ -25,10 +25,11 @@ module Banzai
|
|||
# Only push these customizations once
|
||||
return if customized?(whitelist[:transformers])
|
||||
|
||||
# Allow table alignment; we whitelist specific style properties in a
|
||||
# Allow table alignment; we whitelist specific text-align values in a
|
||||
# transformer below
|
||||
whitelist[:attributes]['th'] = %w(style)
|
||||
whitelist[:attributes]['td'] = %w(style)
|
||||
whitelist[:css] = { properties: ['text-align'] }
|
||||
|
||||
# Allow span elements
|
||||
whitelist[:elements].push('span')
|
||||
|
|
|
@ -93,6 +93,16 @@ describe Banzai::Filter::SanitizationFilter do
|
|||
expect(doc.at_css('td')['style']).to eq 'text-align: center'
|
||||
end
|
||||
|
||||
it 'disallows `text-align` property in `style` attribute on other elements' do
|
||||
html = <<~HTML
|
||||
<div style="text-align: center">Text</div>
|
||||
HTML
|
||||
|
||||
doc = filter(html)
|
||||
|
||||
expect(doc.at_css('div')['style']).to be_nil
|
||||
end
|
||||
|
||||
it 'allows `span` elements' do
|
||||
exp = act = %q{<span>Hello</span>}
|
||||
expect(filter(act).to_html).to eq exp
|
||||
|
@ -224,7 +234,7 @@ describe Banzai::Filter::SanitizationFilter do
|
|||
|
||||
'protocol-based JS injection: spaces and entities' => {
|
||||
input: '<a href="  javascript:alert(\'XSS\');">foo</a>',
|
||||
output: '<a href="">foo</a>'
|
||||
output: '<a href>foo</a>'
|
||||
},
|
||||
|
||||
'protocol whitespace' => {
|
||||
|
|
Loading…
Reference in New Issue