Ticket #5616: text_helper_strict_sanitize_patch.2.diff

actionpack/test/template/text_helper_test.rb

@@ -194 +194 @@
-    result = sanitize(raw)
-    assert_equal %{href="javascript:bang" <a name='hello'>foo</a>, <span>bar</span>}, result
-  end
+
+  def test_sanitize_javascript_href_newlines
+    raw = %{href="j\nava\nscript:bang" <a href="j\nava\nscrip\nt:bang" name="hello">foo</a>, <span href="jav\nascript:bang">bar</span>}
+    result = sanitize(raw)
+    assert_equal %{href="j\nava\nscript:bang" <a name='hello'>foo</a>, <span>bar</span>}, result
+  end
+
+  def test_sanitize_javascript_style_newlines
+    raw = %{style="javascript:bang" <a style='background:url("javascr\ni\npt:bang")' name="hello">foo</a>, <span style="background:url('jav\nascript:bang')">bar</span>}
+    result = sanitize(raw)
+         assert_equal %{style="javascript:bang" <a name='hello'>foo</a>, <span>bar</span>}, result
+  end
-  
-  def test_cycle_class
-    value = Cycle.new("one", 2, "3")

actionpack/lib/action_view/helpers/text_helper.rb

@@ -174 +174 @@
-      # Sanitizes the given HTML by making form and script tags into regular
-      # text, and removing all "onxxx" attributes (so that arbitrary Javascript
-      # cannot be executed). Also removes href attributes that start with
-
+
+
-      #
-      # Returns the sanitized text.
-      def sanitize(html)
@@ -192 +193 @@
-                else
-                  if node.closing != :close
-                    node.attributes.delete_if { |attr,v| attr =~ VERBOTEN_ATTRS }
-
+
+
+
-                      node.attributes.delete "href"
-                    end
+                                                  # Remove any style attributes containing "javascript:"
+                                             if node.attributes["style"] =~ /j[\r\n]*a[\r\n]*v[\r\n]*a[\r\n]*s[\r\n]*c[\r\n]*r[\r\n]*i[\r\n]*p[\r\n]*t[\r\n]*:/i 
+                                               node.attributes.delete "style"
+                                             end
-                  end
-                  node.to_s
-                end