diff options
| -rw-r--r-- | lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb | 15 | ||||
| -rw-r--r-- | test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb | 4 |
2 files changed, 19 insertions, 0 deletions
diff --git a/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb b/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb index 7fef35bfa..b1f1cfe01 100644 --- a/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb +++ b/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb @@ -27,6 +27,18 @@ module Redmine "a" => %w(href).freeze, }.freeze + ALLOWED_CSS_PROPERTIES = %w[ + color background-color + width + height + padding padding-left padding-right padding-top padding-bottom + margin margin-left margin-right margin-top margin-bottom + border border-left border-right border-top border-bottom border-radius border-style border-collapse border-spacing + font font-style font-variant font-weight font-stretch font-size line-height font-family + text-align + float + ].freeze + def allowlist @allowlist ||= customize_allowlist(super.deep_dup) end @@ -40,6 +52,9 @@ module Redmine allowlist[:attributes][:all].delete("name") allowlist[:attributes]["a"].push("name") + allowlist[:attributes][:all].push("style") + allowlist[:css] = { properties: ALLOWED_CSS_PROPERTIES } + # allow class on code tags (this holds the language info from fenced # code bocks and has the format language-foo) allowlist[:attributes]["code"] = %w(class) diff --git a/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb b/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb index 8cd6074ee..063727413 100644 --- a/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb +++ b/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb @@ -94,6 +94,10 @@ if Object.const_defined?(:CommonMarker) # rubocop:disable Layout/LineLength STRINGS = [ [ + '<span style="color: #333; background: url(\'https://example.com/evil.svg\')">hello</span>"', + '<span style="color: #333; ">hello</span>"' + ], + [ '<b>Lo<!-- comment -->rem</b> <a href="pants" title="foo" style="text-decoration: underline;">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br/>amet <style>.foo { color: #fff; }</style> <script>alert("hello world");</script>', '<b>Lorem</b> <a href="pants" title="foo">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br>amet .foo { color: #fff; } ' ], |