Skip to content

Commit f0e3347

Browse files
committed
fix: replace slow regex attribute check with Loofah method
which uses the Crass parser
1 parent df03f2f commit f0e3347

File tree

2 files changed

+13
-1
lines changed

2 files changed

+13
-1
lines changed

lib/rails/html/scrubbers.rb

+3-1
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,11 @@ def scrub_attribute(node, attr_node)
145145
attr_node.remove
146146
end
147147
end
148+
148149
if Loofah::HTML5::SafeList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)
149-
attr_node.value = attr_node.value.gsub(/url\s*\(\s*[^#\s][^)]+?\)/m, ' ') if attr_node.value
150+
Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node)
150151
end
152+
151153
if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == 'xlink:href' && attr_node.value =~ /^\s*[^#\s].*/m
152154
attr_node.remove
153155
end

test/sanitizer_test.rb

+10
Original file line numberDiff line numberDiff line change
@@ -600,6 +600,16 @@ def test_disallow_the_dangerous_safelist_combination_of_select_and_style
600600
refute_includes(sanitized, "style")
601601
end
602602

603+
def test_scrubbing_svg_attr_values_that_allow_ref
604+
input = %Q(<div fill="yellow url(http://bad.com/) #fff">hey</div>)
605+
expected = %Q(<div fill="yellow #fff">hey</div>)
606+
actual = scope_allowed_attributes %w(fill) do
607+
safe_list_sanitize(input)
608+
end
609+
610+
assert_equal(expected, actual)
611+
end
612+
603613
protected
604614

605615
def xpath_sanitize(input, options = {})

0 commit comments

Comments
 (0)