From 741ed90f8a21fcf77e5112fbe07216d20d478b8b Mon Sep 17 00:00:00 2001 From: subbudvk <115633743+subbudvk@users.noreply.github.com> Date: Thu, 11 Apr 2024 06:32:00 +0530 Subject: [PATCH 1/2] Fix : allowAttributes("style").globally() shouldn't imply allowStyling() --- .../src/main/java/org/owasp/html/HtmlPolicyBuilder.java | 3 --- 1 file changed, 3 deletions(-) diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java index d5a5df05..05cf781d 100644 --- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java @@ -967,9 +967,6 @@ public AttributeBuilder matching( */ @SuppressWarnings("synthetic-access") public HtmlPolicyBuilder globally() { - if (attributeNames.contains("style")) { - allowStyling(); - } return HtmlPolicyBuilder.this.allowAttributesGlobally( policy, attributeNames); } From cf0fa255806365af8851c4399fa6dea3e0ddf6d4 Mon Sep 17 00:00:00 2001 From: subbudvk <115633743+subbudvk@users.noreply.github.com> Date: Thu, 11 Apr 2024 06:34:00 +0530 Subject: [PATCH 2/2] Fix : Test related to global stylinh --- .../src/test/java/org/owasp/html/SanitizersTest.java | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/SanitizersTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/SanitizersTest.java index 5ad6f501..4b4614f8 100644 --- a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/SanitizersTest.java +++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/SanitizersTest.java @@ -541,17 +541,6 @@ public static final void testOptionAllowsText() { pf.sanitize(input) ); } - - @Test - public static final void testStyleGlobally() { - PolicyFactory policyBuilder = new HtmlPolicyBuilder() - .allowAttributes("style").globally() - .allowElements("a", "label", "h1", "h2", "h3", "h4", "h5", "h6") - .toFactory(); - String input = "