diff --git a/sanitize.go b/sanitize.go index 103f39f..bda9124 100644 --- a/sanitize.go +++ b/sanitize.go @@ -229,7 +229,7 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer { case html.StartTagToken: - mostRecentlyStartedToken = strings.ToLower(token.Data) + mostRecentlyStartedToken = normaliseElementName(token.Data) aps, ok := p.elsAndAttrs[token.Data] if !ok { @@ -272,7 +272,7 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer { case html.EndTagToken: - if mostRecentlyStartedToken == strings.ToLower(token.Data) { + if mostRecentlyStartedToken == normaliseElementName(token.Data) { mostRecentlyStartedToken = "" } @@ -350,11 +350,11 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer { if !skipElementContent { switch mostRecentlyStartedToken { - case "script": + case `script`: // not encouraged, but if a policy allows JavaScript we // should not HTML escape it as that would break the output buff.WriteString(token.Data) - case "style": + case `style`: // not encouraged, but if a policy allows CSS styles we // should not HTML escape it as that would break the output buff.WriteString(token.Data) @@ -887,3 +887,23 @@ func (p *Policy) matchRegex(elementName string) (map[string]attrPolicy, bool) { } return aps, matched } + + +// normaliseElementName takes a HTML element like