Whitelist text-align property for th and td
This commit is contained in:
parent
bc2cf82f68
commit
e1a77fa757
|
@ -25,10 +25,11 @@ module Banzai
|
||||||
# Only push these customizations once
|
# Only push these customizations once
|
||||||
return if customized?(whitelist[:transformers])
|
return if customized?(whitelist[:transformers])
|
||||||
|
|
||||||
# Allow table alignment; we whitelist specific style properties in a
|
# Allow table alignment; we whitelist specific text-align values in a
|
||||||
# transformer below
|
# transformer below
|
||||||
whitelist[:attributes]['th'] = %w(style)
|
whitelist[:attributes]['th'] = %w(style)
|
||||||
whitelist[:attributes]['td'] = %w(style)
|
whitelist[:attributes]['td'] = %w(style)
|
||||||
|
whitelist[:css] = { properties: ['text-align'] }
|
||||||
|
|
||||||
# Allow span elements
|
# Allow span elements
|
||||||
whitelist[:elements].push('span')
|
whitelist[:elements].push('span')
|
||||||
|
|
|
@ -93,6 +93,16 @@ describe Banzai::Filter::SanitizationFilter do
|
||||||
expect(doc.at_css('td')['style']).to eq 'text-align: center'
|
expect(doc.at_css('td')['style']).to eq 'text-align: center'
|
||||||
end
|
end
|
||||||
|
|
||||||
|
it 'disallows `text-align` property in `style` attribute on other elements' do
|
||||||
|
html = <<~HTML
|
||||||
|
<div style="text-align: center">Text</div>
|
||||||
|
HTML
|
||||||
|
|
||||||
|
doc = filter(html)
|
||||||
|
|
||||||
|
expect(doc.at_css('div')['style']).to be_nil
|
||||||
|
end
|
||||||
|
|
||||||
it 'allows `span` elements' do
|
it 'allows `span` elements' do
|
||||||
exp = act = %q{<span>Hello</span>}
|
exp = act = %q{<span>Hello</span>}
|
||||||
expect(filter(act).to_html).to eq exp
|
expect(filter(act).to_html).to eq exp
|
||||||
|
@ -224,7 +234,7 @@ describe Banzai::Filter::SanitizationFilter do
|
||||||
|
|
||||||
'protocol-based JS injection: spaces and entities' => {
|
'protocol-based JS injection: spaces and entities' => {
|
||||||
input: '<a href="  javascript:alert(\'XSS\');">foo</a>',
|
input: '<a href="  javascript:alert(\'XSS\');">foo</a>',
|
||||||
output: '<a href="">foo</a>'
|
output: '<a href>foo</a>'
|
||||||
},
|
},
|
||||||
|
|
||||||
'protocol whitespace' => {
|
'protocol whitespace' => {
|
||||||
|
|
Loading…
Reference in New Issue