diff --git a/lib/loofah/html5/scrub.rb b/lib/loofah/html5/scrub.rb index 5dbfb87e..2f6b9a26 100644 --- a/lib/loofah/html5/scrub.rb +++ b/lib/loofah/html5/scrub.rb @@ -6,7 +6,7 @@ module Loofah module HTML5 # :nodoc: module Scrub CONTROL_CHARACTERS = /[`\u0000-\u0020\u007f\u0080-\u0101]/ - CSS_KEYWORDISH = /\A(#[0-9a-fA-F]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|-?\d{0,3}\.?\d{0,10}(ch|cm|r?em|ex|in|lh|mm|pc|pt|px|Q|vw|vh|%|,|\))?)\z/ + CSS_KEYWORDISH = /\A(#[0-9a-fA-F]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|-?\d{0,3}\.?\d{0,10}(ch|cm|r?em|ex|in|lh|mm|pc|pt|px|Q|vmin|vw|vh|%|,|\))?)\z/ CRASS_SEMICOLON = { :node => :semicolon, :raw => ";" } class << self diff --git a/test/html5/test_sanitizer.rb b/test/html5/test_sanitizer.rb index 8d6f97d6..ff57495a 100755 --- a/test/html5/test_sanitizer.rb +++ b/test/html5/test_sanitizer.rb @@ -329,6 +329,12 @@ def test_css_lh_value assert_match %r/2lh/, sane.inner_html end + def test_css_vmin_value + html = "
" + sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :escape).to_xml) + assert_match %r/42vmin/, sane.inner_html + end + def test_css_function_sanitization_leaves_safelisted_functions_calc html = "" sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :strip).to_html)