File tree 2 files changed +13
-1
lines changed
2 files changed +13
-1
lines changed Original file line number Diff line number Diff line change @@ -145,9 +145,11 @@ def scrub_attribute(node, attr_node)
145
145
attr_node . remove
146
146
end
147
147
end
148
+
148
149
if Loofah ::HTML5 ::SafeList ::SVG_ATTR_VAL_ALLOWS_REF . include? ( attr_name )
149
- attr_node . value = attr_node . value . gsub ( /url \s * \( \s *[^# \s ][^)]+? \) /m , ' ' ) if attr_node . value
150
+ Loofah :: HTML5 :: Scrub . scrub_attribute_that_allows_local_ref ( attr_node )
150
151
end
152
+
151
153
if Loofah ::HTML5 ::SafeList ::SVG_ALLOW_LOCAL_HREF . include? ( node . name ) && attr_name == 'xlink:href' && attr_node . value =~ /^\s *[^#\s ].*/m
152
154
attr_node . remove
153
155
end
Original file line number Diff line number Diff line change @@ -600,6 +600,16 @@ def test_disallow_the_dangerous_safelist_combination_of_select_and_style
600
600
refute_includes ( sanitized , "style" )
601
601
end
602
602
603
+ def test_scrubbing_svg_attr_values_that_allow_ref
604
+ input = %Q(<div fill="yellow url(http://bad.com/) #fff">hey</div>)
605
+ expected = %Q(<div fill="yellow #fff">hey</div>)
606
+ actual = scope_allowed_attributes %w( fill ) do
607
+ safe_list_sanitize ( input )
608
+ end
609
+
610
+ assert_equal ( expected , actual )
611
+ end
612
+
603
613
protected
604
614
605
615
def xpath_sanitize ( input , options = { } )
You can’t perform that action at this time.
0 commit comments