This commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="ht

Using this as the test : <div class="highlight highlight-source-ruby notrans

PR in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

Regression in 2.9.0: string css attributes scrubbing about loofah HOT 5 CLOSED

aert commented on July 30, 2024

Regression in 2.9.0: string css attributes scrubbing

from loofah.

Comments (5)

flavorjones commented on July 30, 2024

Thanks for reporting this! I'll take a look.

from loofah.

flavorjones commented on July 30, 2024

Using this as the test script:

#!/usr/bin/env ruby

require 'loofah'

text = <<~EOF
<span style="font-size: 36px; font-family: 'AvenirNext-Regular';">This style gets stripped</span>
<span style="font-size: 36px; font-family: 'Avenir Next';">This style does not get stripped</span>
EOF

puts Loofah::VERSION
puts Loofah.fragment(text).scrub!(:strip)
puts Loofah.fragment(text).scrub!(:prune)

I git-bisected and agree that this commit introduced the issue:

bf13d48b7428aa36ee9dff083d017399249b2d60 is the first bad commit
commit bf13d48b7428aa36ee9dff083d017399249b2d60
Author: Mike Dalessio <[email protected]>
Date:   Wed Jan 13 13:44:19 2021 -0500

    fix: handle CSS functions in a CSS shorthand property
    
    Fixes #199.

 lib/loofah/html5/scrub.rb                 | 63 ++++++++++++++++++++-----------
 test/assets/testdata_sanitizer_tests1.dat |  8 ++--
 test/html5/test_scrub.rb                  | 10 -----
 test/html5/test_scrub_css.rb              | 32 ++++++++++++++++
 4 files changed, 76 insertions(+), 37 deletions(-)
 delete mode 100644 test/html5/test_scrub.rb
 create mode 100644 test/html5/test_scrub_css.rb

from loofah.

flavorjones commented on July 30, 2024

PR in #203

from loofah.

flavorjones commented on July 30, 2024

v2.9.1 has been released fixing this issue. Thanks again for reporting it!

from loofah.

aert commented on July 30, 2024

@flavorjones No thank you, you're the one doing the great work here : ).

from loofah.

Recommend Projects