From 468377d6b54e9a29a9f1949b7c90df7f84ccb80a Mon Sep 17 00:00:00 2001
From: Marius Balteanu <marius.balteanu@zitec.com>
Date: Tue, 27 Sep 2022 17:11:53 +0000
Subject: [PATCH] Merged r21850 and r21851 from trunk to 5.0-stable (#37237).

git-svn-id: https://svn.redmine.org/redmine/branches/5.0-stable@21859 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 .../common_mark/sanitization_filter.rb            | 15 +++++++++++++++
 .../help/en/wiki_syntax_detailed_common_mark.html | 13 +++++++++++++
 .../common_mark/sanitization_filter_test.rb       |  4 ++++
 3 files changed, 32 insertions(+)

diff --git a/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb b/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb
index 7fef35bfa..b1f1cfe01 100644
--- a/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb
+++ b/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb
@@ -27,6 +27,18 @@ module Redmine
           "a" => %w(href).freeze,
         }.freeze
 
+        ALLOWED_CSS_PROPERTIES = %w[
+          color background-color
+          width
+          height
+          padding padding-left padding-right padding-top padding-bottom
+          margin margin-left margin-right margin-top margin-bottom
+          border border-left border-right border-top border-bottom border-radius border-style border-collapse border-spacing
+          font font-style font-variant font-weight font-stretch font-size line-height font-family
+          text-align
+          float
+        ].freeze
+
         def allowlist
           @allowlist ||= customize_allowlist(super.deep_dup)
         end
@@ -40,6 +52,9 @@ module Redmine
           allowlist[:attributes][:all].delete("name")
           allowlist[:attributes]["a"].push("name")
 
+          allowlist[:attributes][:all].push("style")
+          allowlist[:css] = { properties: ALLOWED_CSS_PROPERTIES }
+
           # allow class on code tags (this holds the language info from fenced
           # code bocks and has the format language-foo)
           allowlist[:attributes]["code"] = %w(class)
diff --git a/public/help/en/wiki_syntax_detailed_common_mark.html b/public/help/en/wiki_syntax_detailed_common_mark.html
index 087fa6f05..74c1dd2ef 100644
--- a/public/help/en/wiki_syntax_detailed_common_mark.html
+++ b/public/help/en/wiki_syntax_detailed_common_mark.html
@@ -356,6 +356,19 @@ It can be expanded by clicking a link.
 <tr><td align="center" colspan="2">bar</td></tr>
 </table>
 
+<p>The <strong>style</strong> attribute can be used in raw HTML to apply custom formatting. The following CSS properties are allowed:</p>
+<pre><code>
+  color background-color
+  width
+  height
+  padding padding-left padding-right padding-top padding-bottom
+  margin margin-left margin-right margin-top margin-bottom
+  border border-left border-right border-top border-bottom border-radius border-style border-collapse border-spacing
+  font font-style font-variant font-weight font-stretch font-size line-height font-family
+  text-align
+  float
+</code></pre>
+
 </body>
 </html>
 
diff --git a/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb b/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb
index 8cd6074ee..063727413 100644
--- a/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb
+++ b/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb
@@ -93,6 +93,10 @@ if Object.const_defined?(:CommonMarker)
     # samples taken from the Sanitize test suite
     # rubocop:disable Layout/LineLength
     STRINGS = [
+      [
+        '<span style="color: #333; background: url(\'https://example.com/evil.svg\')">hello</span>"',
+        '<span style="color: #333; ">hello</span>"'
+      ],
       [
         '<b>Lo<!-- comment -->rem</b> <a href="pants" title="foo" style="text-decoration: underline;">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br/>amet <style>.foo { color: #fff; }</style> <script>alert("hello world");</script>',
         '<b>Lorem</b> <a href="pants" title="foo">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br>amet .foo { color: #fff; } '
-- 
2.39.5