Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

aria attributes #233

Merged
merged 2 commits into from Apr 28, 2022
Merged

aria attributes #233

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8d183d3
Adds ARIA attributes
nick-desteffen Apr 22, 2022
5f58b9c
feat: add the remaining aria attributes and an ad-hoc test
flavorjones Apr 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
58 changes: 57 additions & 1 deletion lib/loofah/html5/safelist.rb
View file
Open in desktop
Expand Up @@ -512,6 +512,62 @@ module SafeList
"zoomAndPan",
])

ARIA_ATTRIBUTES = Set.new([
"aria-activedescendant",
"aria-atomic",
"aria-autocomplete",
"aria-braillelabel",
"aria-brailleroledescription",
"aria-busy",
"aria-checked",
"aria-colcount",
"aria-colindex",
"aria-colindextext",
"aria-colspan",
"aria-controls",
"aria-current",
"aria-describedby",
"aria-description",
"aria-details",
"aria-disabled",
"aria-dropeffect",
"aria-errormessage",
"aria-expanded",
"aria-flowto",
"aria-grabbed",
"aria-haspopup",
"aria-hidden",
"aria-invalid",
"aria-keyshortcuts",
"aria-label",
"aria-labelledby",
"aria-level",
"aria-live",
"aria-multiline",
"aria-multiselectable",
"aria-orientation",
"aria-owns",
"aria-placeholder",
"aria-posinset",
"aria-pressed",
"aria-readonly",
"aria-relevant",
"aria-required",
"aria-roledescription",
"aria-rowcount",
"aria-rowindex",
"aria-rowindextext",
"aria-rowspan",
"aria-selected",
"aria-setsize",
"aria-sort",
"aria-valuemax",
"aria-valuemin",
"aria-valuenow",
"aria-valuetext",
"role",
])

ATTR_VAL_IS_URI = Set.new([
"action",
"cite",
Expand Down Expand Up @@ -795,7 +851,7 @@ module SafeList

# subclasses may define their own versions of these constants
ALLOWED_ELEMENTS = ACCEPTABLE_ELEMENTS + MATHML_ELEMENTS + SVG_ELEMENTS
ALLOWED_ATTRIBUTES = ACCEPTABLE_ATTRIBUTES + MATHML_ATTRIBUTES + SVG_ATTRIBUTES
ALLOWED_ATTRIBUTES = ACCEPTABLE_ATTRIBUTES + MATHML_ATTRIBUTES + SVG_ATTRIBUTES + ARIA_ATTRIBUTES
ALLOWED_CSS_PROPERTIES = ACCEPTABLE_CSS_PROPERTIES
ALLOWED_CSS_KEYWORDS = ACCEPTABLE_CSS_KEYWORDS
ALLOWED_CSS_FUNCTIONS = ACCEPTABLE_CSS_FUNCTIONS
Expand Down
15 changes: 15 additions & 0 deletions test/integration/test_ad_hoc.rb
View file
Open in desktop
Expand Up @@ -195,6 +195,21 @@ def test_dont_remove_whitespace_between_tags
end
end

it "allows aria attributes" do
html = <<~HTML
<div role="application" aria-label="calendar"
aria-description="Game schedule for the Boston Red Sox 2021 Season">
<h1>Red Sox 2021</h1>
</div>
HTML

sanitized = Loofah.scrub_fragment(html, :escape)
attributes = sanitized.at_css("div").attributes
assert_includes(attributes.keys, "role")
assert_includes(attributes.keys, "aria-label")
assert_includes(attributes.keys, "aria-description")
end

context "xss protection from svg animate attributes" do
# see recommendation from https://html5sec.org/#137
# to sanitize "to", "from", "values", and "by" attributes
Expand Down