disslow xss vectors from style attribute about java-html-sanitizer HOT 4 CLOSED

Also i care about "src" tag
in case of

<DIV STYLE="border-image: url(images/javascript.png) 30 round round;">

i shuld make this check:
PolicyFactory policy = new HtmlPolicyBuilder()
    .allowElements("p")
    .allowElements(new ElementPolicy() {
          public String apply(String elementName, List<String> attrs) {
            StylingPolicy sp = new StylingPolicy();
            sp.allowCSSProperty("color");
            sp.addCssPropertyCheker(new CSSPropertyChecker(){
                boolean includeThisProperty(String propertyName, String properyValue){
                    CSSPropertyValue prop = new  CSSPropertyValue(properyValue);
                     if(prop.isURLResource()){
                        CSSPropertyURL urlProp = new CSSPropertyURL(prop);
                        if(!urlProp.getDomain().equals(MY_DOMAIN)){ 
                           // css resource from third party domain
                           return false;// dissalow
                        } else {
                           return true;
                        }
                     }
                    if (prop.isExpression()){
                         // dissalow like: width: expression(alert('XSS'));
                         return false;
                    }
                    return true;
                }
            }, List.Of("border-image"));
            sp.applyTo(attrs);
          return elementName;
          }
     },TagsSet.ALLOWED)
    .build();
String safeHTML = policy.sanitize(untrustedHTML);

to prevent both "expression" and resource in css url from 3-party domain/

and dont forget that some css properties can have multiple values

Also what about < style > tag? Shuld this allow styles from users? In case of 
WYSIWYG there are some styles, that should be allowed. In general there must be 
element style perser.

Please ask questions on the mailing list, not in the issue list.
https://groups.google.com/forum/?fromgroups#!forum/owasp-java-html-sanitizer-sup
port