Ticket #8222: sanitize_ie_for_edge_cases.diff

actionpack/test/template/text_helper_test.rb

@@ -279 +279 @@
-    assert_equal %{src="javascript:bang" <img width="5">foo</img>, <span>bar</span>}, result
-  end
-  
+  def test_sanitize_behavior
+    raw = %{style="behavior: url(foo.htc)" <div style="behavior: url(foo.htc)">foo</div>}
+    result = sanitize(raw)
+    assert_equal %{style="behavior: url(foo.htc)" <div>foo</div>}, result
+    raw = %{style="_beHaVior : url ( foo.htc)" <div style="_beHaVior : url ( foo.htc)">foo</div>}
+    result = sanitize(raw)
+    assert_equal %{style="_beHaVior : url ( foo.htc)" <div>foo</div>}, result
+  end
+  
+  def test_sanitize_expression
+    raw = %{style="expression(evilJS)" <div style="width: expression(evilJS)">foo</div>}
+    result = sanitize(raw)
+    assert_equal %{style="expression(evilJS)" <div>foo</div>}, result
+    raw = %{style="_eXpressiOn ( evilJS)" <div style="width: _eXpressiOn ( evilJS)">foo</div>}
+    result = sanitize(raw)
+    assert_equal %{style="_eXpressiOn ( evilJS)" <div>foo</div>}, result    
+  end
+  
-  def test_cycle_class
-    value = Cycle.new("one", 2, "3")
-    assert_equal("one", value.to_s)

actionpack/lib/action_view/helpers/text_helper.rb

@@ -202 +202 @@
-
-      VERBOTEN_TAGS = %w(form script plaintext) unless defined?(VERBOTEN_TAGS)
-      VERBOTEN_ATTRS = /^on/i unless defined?(VERBOTEN_ATTRS)
+      VERBOTEN_STYLE = /(expression|behavior)/i unless defined?(VERBOTEN_STYLE)
-
-      # Sanitizes the +html+ by converting <form> and <script> tags into regular
-      # text, and removing all "onxxx" attributes (so that arbitrary Javascript
@@ -228 +229 @@
-                else
-                  if node.closing != :close
-                    node.attributes.delete_if { |attr,v| attr =~ VERBOTEN_ATTRS }
+                    node.attributes.delete_if { |attr,v| attr == "style" && v =~ VERBOTEN_STYLE }
-                    %w(href src).each do |attr|
-                      node.attributes.delete attr if node.attributes[attr] =~ /^javascript:/i
-                    end