Imports Mediacloth's revision r141
Removes "on" attributes from explicit HTML inside wiki code
| 160 | # Sanitizes thw raw wiki input for dangerous HTML tags | # Sanitizes thw raw wiki input for dangerous HTML tags | 160 |
|---|---|---|---|
| 161 | def sanitize(input) | def sanitize(input) | 161 |
| 162 | input.gsub(/<(\/?)([^\s>\/]+)([^>]*)>/) do | input.gsub(/<(\/?)([^\s>\/]+)([^>]*)>/) do | 162 |
| 163 | WHITELIST.include?($2.downcase) ? $& : "<#{$1}#{$2}#{$3}>" | atts = clean_attributes($3) | 163 |
WHITELIST.include?($2.downcase) ? "<#{$1}#{$2}#{atts}>" : | 164 | ||
"<#{$1}#{$2}#{$3}>" | 165 | ||
| 164 | end | end | 166 |
| 165 | end | end | 167 |
| 168 | |||
def clean_attributes(input) | 169 | ||
input.gsub(/on[^=]*=(['|"])[^\1]*\1/, '') | 170 | ||
end | 171 | ||
| 166 | 172 | ||
| 167 | def tokenize(input) | def tokenize(input) | 173 |
| 168 | @text = sanitize(input) | @text = sanitize(input) | 174 |
| 378 | [:TEXT, "iii"], [:VARIABLE_END, "}}"], [:TEXT, "xxx"], [:VARIABLE_END, "}}"], | [:TEXT, "iii"], [:VARIABLE_END, "}}"], [:TEXT, "xxx"], [:VARIABLE_END, "}}"], | 378 |
|---|---|---|---|
| 379 | [:PARA_END, ""], [false, false]], | [:PARA_END, ""], [false, false]], | 379 |
| 380 | lex("{{xxx{{iii}}xxx}}")) | lex("{{xxx{{iii}}xxx}}")) | 380 |
| 381 | assert_equal([[:PARA_START, ""], [:TAG_START, "foo"], [:ATTR_NAME, "bar"], [:ATTR_VALUE, "{{ref}}"], [:TAG_END, ""], | assert_equal([[:PARA_START, ""], [:TAG_START, "span"], [:ATTR_NAME, "style"], [:ATTR_VALUE, "{{ref}}"], [:TAG_END, ""], | 381 |
| 382 | [:PARA_END, ""], [false, false]], | [:PARA_END, ""], [false, false]], | 382 |
| 383 | lex("<foo bar='{{ref}}'>")) | lex("<span style='{{ref}}'>")) | 383 |
| 384 | end | end | 384 |
| 385 | 385 | ||
| 386 | def test_xhtml_markup | def test_xhtml_markup | 386 |
| 178 | assert_no_sanitization "<SUP>Superscript</sup> and <CODE>code</CODE>" | assert_no_sanitization "<SUP>Superscript</sup> and <CODE>code</CODE>" | 178 |
|---|---|---|---|
| 179 | end | end | 179 |
| 180 | 180 | ||
| 181 | # TODO removes "on" attributes even in legal tags | def test_removes_on_attributes_even_from_legal_tags | 181 |
assert_sanitizes_to %{Here is some <b >bold</b> text}, | 182 | ||
%{Here is some <b onMouseOver="alert('Cuidado!')">bold</b> text} | 183 | ||
end | 184 | ||
| 182 | 185 | ||
| 183 | private | private | 186 |
| 184 | 187 |