diff --git a/CHANGELOG.md b/CHANGELOG.md index 46ab0bf9..765a56ed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ Features: * Support HTML5 `
` tag. #133 (Thanks, @MothOnMars!) * Recognize HTML5 block elements. #136 (Thanks, @MothOnMars!) * Support SVG `` tag. #131 (Thanks, @baopham!) -* Support for whitelisting CSS functions, initially just `calc`. #122/#123 (Thanks, @NikoRoberts!) +* Support for whitelisting CSS functions, initially just `calc` and `rgb`. #122/#123/#129 (Thanks, @NikoRoberts!) Bugfixes: diff --git a/lib/loofah/html5/whitelist.rb b/lib/loofah/html5/whitelist.rb index 69f17aaf..5e556db4 100644 --- a/lib/loofah/html5/whitelist.rb +++ b/lib/loofah/html5/whitelist.rb @@ -137,7 +137,7 @@ module WhiteList purple red right solid silver teal top transparent underline white yellow] - ACCEPTABLE_CSS_FUNCTIONS = Set.new %w[calc] + ACCEPTABLE_CSS_FUNCTIONS = Set.new %w[calc rgb] SHORTHAND_CSS_PROPERTIES = Set.new %w[background border margin padding] diff --git a/test/html5/test_sanitizer.rb b/test/html5/test_sanitizer.rb index 2c30ec4d..25acfb31 100755 --- a/test/html5/test_sanitizer.rb +++ b/test/html5/test_sanitizer.rb @@ -275,16 +275,30 @@ def test_css_negative_value_sanitization_shorthand_css_properties assert_match %r/-0.05em/, sane.inner_html end - def test_css_function_sanitization_leaves_whitelisted_functions + def test_css_function_sanitization_leaves_whitelisted_functions_calc html = "" sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :strip).to_html) assert_match %r/calc\(5%\)/, sane.inner_html + + html = "" + sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :strip).to_html) + assert_match %r/calc\(5%\)/, sane.inner_html + end + + def test_css_function_sanitization_leaves_whitelisted_functions_rgb + html = '' + sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :strip).to_html) + assert_match %r/rgb\(255, 0, 0\)/, sane.inner_html end def test_css_function_sanitization_strips_style_attributes_with_unsafe_functions html = "" sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :strip).to_html) assert_match %r/<\/span>/, sane.inner_html + + html = "" + sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :strip).to_html) + assert_match %r/<\/span>/, sane.inner_html end def test_issue_90_slow_regex