Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

font-family with space in name triggers removal of following style attributes #564

Open
haraldwolkenfelt opened this issue Jan 3, 2025 · 1 comment

Comments

@haraldwolkenfelt
Copy link

haraldwolkenfelt commented Jan 3, 2025

We have a problem with HTML style in case the font-family name contains a space. Such name value should be surrounded with quotes.
In our application it is surrounding by double quotes, but Sanitize() will remove the font-family css attribute and all that are following.
Changing out the double quotes with single quotes might work (in the sense that it won't trigger removal during Sanitization), however the resulting HTML is changed (now using & quot ; encoding).

    [Fact]
    public void Reproduce()
    {
        var html = "<span style=\"color: rgba(57, 64, 78, 1); font-family: \"IBM Plex Sans\", sans-serif; font-size: 16px\"><strong>En hierbij moet worden genoemd dat</strong></span>";
        var html2 = "<span style=\"color: rgba(57, 64, 78, 1); font-family: 'IBM Plex Sans', sans-serif; font-size: 16px\"><strong>En hierbij moet worden genoemd dat</strong></span>";
        var html3 = "<span style=\"color: rgba(57, 64, 78, 1); font-family: &quot;IBM Plex Sans&quot;, sans-serif; font-size: 16px\"><strong>En hierbij moet worden genoemd dat</strong></span>";
        var sanitizer = new HtmlSanitizer();
        var output = sanitizer.Sanitize(html);
        var output2 = sanitizer.Sanitize(html2);
        var output3 = sanitizer.Sanitize(html3);
        var isSame = output == html;
        var isSame2 = output2 == html2;
        var isSame3 = output3 == html3;
    }

Is there a way to configure the HtmlSanitizer to treat such font-family names correctly (i.e. not triggering removal and not changing the resulting HTML)?

@mganss
Copy link
Owner

mganss commented Jan 3, 2025

Both single quotes and &quot; work fine as I can tell. Also, no quotes at all works fine. Double quotes are parsed as closing the style attribute so the following tokens are parsed as additional attributes of the span element up until the >. This works the same as in a browser.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants