Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HTML scrubber removes shorthand CSS properties with float values that have >2 precision #149

Closed
danfstucky opened this issue Apr 17, 2018 · 2 comments
Milestone

Comments

@danfstucky
Copy link
Contributor

danfstucky commented Apr 17, 2018

The current HTML sanitizer removes CSS shorthand properties with a float value that has more than 2 decimals of precision. From my testing, this only applies to the shorthand properties.

I wrote a ruby script that tests a couple of simple cases and illustrates the problem: https://gist.github.com/danfstucky/ea3115cf63e636bc4aa887d8b0c7fabd
Here is a screenshot of the output from running that script:
screen shot 2018-04-17 at 1 54 24 pm

As you can see, loofah is removing the css shorthand properties that contain >2 decimals, but does not remove css properties with >2 decimals that are not shorthand (such as text-indent).
Neither loofah or html5lib's documentation indicate this would be the expected outcome.

Is this the expected behavior of loofah? If so, then why?
I also submitted a PR for the change if that helps speed up the process. #150

@flavorjones
Copy link
Owner

I've merged #149 and added some test coverage for it. Should be in v2.3.0 due out in a few days.

@flavorjones flavorjones added this to the v2.3.0 milestone Oct 28, 2018
@flavorjones
Copy link
Owner

v2.3.0 has been released.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants