You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We have a problem with HTML style in case the font-family name contains a space. Such name value should be surrounded with quotes.
In our application it is surrounding by double quotes, but Sanitize() will remove the font-family css attribute and all that are following.
Changing out the double quotes with single quotes might work (in the sense that it won't trigger removal during Sanitization), however the resulting HTML is changed (now using & quot ; encoding).
[Fact]
public void Reproduce()
{
var html = "<span style=\"color: rgba(57, 64, 78, 1); font-family: \"IBM Plex Sans\", sans-serif; font-size: 16px\"><strong>En hierbij moet worden genoemd dat</strong></span>";
var html2 = "<span style=\"color: rgba(57, 64, 78, 1); font-family: 'IBM Plex Sans', sans-serif; font-size: 16px\"><strong>En hierbij moet worden genoemd dat</strong></span>";
var html3 = "<span style=\"color: rgba(57, 64, 78, 1); font-family: "IBM Plex Sans", sans-serif; font-size: 16px\"><strong>En hierbij moet worden genoemd dat</strong></span>";
var sanitizer = new HtmlSanitizer();
var output = sanitizer.Sanitize(html);
var output2 = sanitizer.Sanitize(html2);
var output3 = sanitizer.Sanitize(html3);
var isSame = output == html;
var isSame2 = output2 == html2;
var isSame3 = output3 == html3;
}
Is there a way to configure the HtmlSanitizer to treat such font-family names correctly (i.e. not triggering removal and not changing the resulting HTML)?
The text was updated successfully, but these errors were encountered:
Both single quotes and " work fine as I can tell. Also, no quotes at all works fine. Double quotes are parsed as closing the style attribute so the following tokens are parsed as additional attributes of the span element up until the >. This works the same as in a browser.
We have a problem with HTML style in case the font-family name contains a space. Such name value should be surrounded with quotes.
In our application it is surrounding by double quotes, but Sanitize() will remove the font-family css attribute and all that are following.
Changing out the double quotes with single quotes might work (in the sense that it won't trigger removal during Sanitization), however the resulting HTML is changed (now using & quot ; encoding).
Is there a way to configure the HtmlSanitizer to treat such font-family names correctly (i.e. not triggering removal and not changing the resulting HTML)?
The text was updated successfully, but these errors were encountered: