loofah 0.4.2 → 2.25.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/CHANGELOG.md +604 -0
- data/MIT-LICENSE.txt +3 -1
- data/README.md +410 -0
- data/SECURITY.md +18 -0
- data/lib/loofah/concerns.rb +207 -0
- data/lib/loofah/elements.rb +98 -0
- data/lib/loofah/helpers.rb +91 -4
- data/lib/loofah/html4/document.rb +17 -0
- data/lib/loofah/html4/document_fragment.rb +15 -0
- data/lib/loofah/html5/document.rb +17 -0
- data/lib/loofah/html5/document_fragment.rb +15 -0
- data/lib/loofah/html5/libxml2_workarounds.rb +28 -0
- data/lib/loofah/html5/safelist.rb +1058 -0
- data/lib/loofah/html5/scrub.rb +211 -40
- data/lib/loofah/metahelpers.rb +18 -0
- data/lib/loofah/scrubber.rb +31 -13
- data/lib/loofah/scrubbers.rb +262 -31
- data/lib/loofah/version.rb +6 -0
- data/lib/loofah/xml/document.rb +2 -0
- data/lib/loofah/xml/document_fragment.rb +6 -9
- data/lib/loofah.rb +131 -52
- metadata +79 -158
- data/CHANGELOG.rdoc +0 -92
- data/DEPRECATED.rdoc +0 -12
- data/Manifest.txt +0 -34
- data/README.rdoc +0 -330
- data/Rakefile +0 -61
- data/TODO.rdoc +0 -4
- data/benchmark/benchmark.rb +0 -149
- data/benchmark/fragment.html +0 -96
- data/benchmark/helper.rb +0 -73
- data/benchmark/www.slashdot.com.html +0 -2560
- data/init.rb +0 -1
- data/lib/loofah/active_record.rb +0 -62
- data/lib/loofah/html/document.rb +0 -22
- data/lib/loofah/html/document_fragment.rb +0 -46
- data/lib/loofah/html5/whitelist.rb +0 -174
- data/lib/loofah/instance_methods.rb +0 -77
- data/lib/loofah/xss_foliate.rb +0 -212
- data/test/helper.rb +0 -8
- data/test/html5/test_sanitizer.rb +0 -248
- data/test/test_active_record.rb +0 -146
- data/test/test_ad_hoc.rb +0 -272
- data/test/test_api.rb +0 -128
- data/test/test_helpers.rb +0 -28
- data/test/test_scrubber.rb +0 -227
- data/test/test_scrubbers.rb +0 -144
- data/test/test_xss_foliate.rb +0 -171
- data.tar.gz.sig +0 -0
- metadata.gz.sig +0 -2
|
@@ -0,0 +1,1058 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
require "set"
|
|
4
|
+
|
|
5
|
+
module Loofah
|
|
6
|
+
module HTML5 # :nodoc:
|
|
7
|
+
#
|
|
8
|
+
# HTML safelist lifted from HTML5lib sanitizer code:
|
|
9
|
+
#
|
|
10
|
+
# http://code.google.com/p/html5lib/
|
|
11
|
+
#
|
|
12
|
+
# <html5_license>
|
|
13
|
+
#
|
|
14
|
+
# Copyright (c) 2006-2008 The Authors
|
|
15
|
+
#
|
|
16
|
+
# Contributors:
|
|
17
|
+
# James Graham - jg307@cam.ac.uk
|
|
18
|
+
# Anne van Kesteren - annevankesteren@gmail.com
|
|
19
|
+
# Lachlan Hunt - lachlan.hunt@lachy.id.au
|
|
20
|
+
# Matt McDonald - kanashii@kanashii.ca
|
|
21
|
+
# Sam Ruby - rubys@intertwingly.net
|
|
22
|
+
# Ian Hickson (Google) - ian@hixie.ch
|
|
23
|
+
# Thomas Broyer - t.broyer@ltgt.net
|
|
24
|
+
# Jacques Distler - distler@golem.ph.utexas.edu
|
|
25
|
+
# Henri Sivonen - hsivonen@iki.fi
|
|
26
|
+
# The Mozilla Foundation (contributions from Henri Sivonen since 2008)
|
|
27
|
+
#
|
|
28
|
+
# Permission is hereby granted, free of charge, to any person
|
|
29
|
+
# obtaining a copy of this software and associated documentation
|
|
30
|
+
# files (the "Software"), to deal in the Software without
|
|
31
|
+
# restriction, including without limitation the rights to use, copy,
|
|
32
|
+
# modify, merge, publish, distribute, sublicense, and/or sell copies
|
|
33
|
+
# of the Software, and to permit persons to whom the Software is
|
|
34
|
+
# furnished to do so, subject to the following conditions:
|
|
35
|
+
#
|
|
36
|
+
# The above copyright notice and this permission notice shall be
|
|
37
|
+
# included in all copies or substantial portions of the Software.
|
|
38
|
+
#
|
|
39
|
+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
40
|
+
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
41
|
+
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
42
|
+
# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
|
43
|
+
# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
44
|
+
# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
45
|
+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
|
|
46
|
+
# DEALINGS IN THE SOFTWARE.
|
|
47
|
+
#
|
|
48
|
+
# </html5_license>
|
|
49
|
+
module SafeList
|
|
50
|
+
ACCEPTABLE_ELEMENTS = Set.new([
|
|
51
|
+
"a",
|
|
52
|
+
"abbr",
|
|
53
|
+
"acronym",
|
|
54
|
+
"address",
|
|
55
|
+
"area",
|
|
56
|
+
"article",
|
|
57
|
+
"aside",
|
|
58
|
+
"audio",
|
|
59
|
+
"b",
|
|
60
|
+
"bdi",
|
|
61
|
+
"bdo",
|
|
62
|
+
"big",
|
|
63
|
+
"blockquote",
|
|
64
|
+
"br",
|
|
65
|
+
"button",
|
|
66
|
+
"canvas",
|
|
67
|
+
"caption",
|
|
68
|
+
"center",
|
|
69
|
+
"cite",
|
|
70
|
+
"code",
|
|
71
|
+
"col",
|
|
72
|
+
"colgroup",
|
|
73
|
+
"command",
|
|
74
|
+
"datalist",
|
|
75
|
+
"dd",
|
|
76
|
+
"del",
|
|
77
|
+
"details",
|
|
78
|
+
"dfn",
|
|
79
|
+
"dir",
|
|
80
|
+
"div",
|
|
81
|
+
"dl",
|
|
82
|
+
"dt",
|
|
83
|
+
"em",
|
|
84
|
+
"fieldset",
|
|
85
|
+
"figcaption",
|
|
86
|
+
"figure",
|
|
87
|
+
"font",
|
|
88
|
+
"footer",
|
|
89
|
+
"form",
|
|
90
|
+
"h1",
|
|
91
|
+
"h2",
|
|
92
|
+
"h3",
|
|
93
|
+
"h4",
|
|
94
|
+
"h5",
|
|
95
|
+
"h6",
|
|
96
|
+
"header",
|
|
97
|
+
"hr",
|
|
98
|
+
"i",
|
|
99
|
+
"img",
|
|
100
|
+
"input",
|
|
101
|
+
"ins",
|
|
102
|
+
"kbd",
|
|
103
|
+
"label",
|
|
104
|
+
"legend",
|
|
105
|
+
"li",
|
|
106
|
+
"main",
|
|
107
|
+
"map",
|
|
108
|
+
"mark",
|
|
109
|
+
"menu",
|
|
110
|
+
"meter",
|
|
111
|
+
"nav",
|
|
112
|
+
"ol",
|
|
113
|
+
"optgroup",
|
|
114
|
+
"option",
|
|
115
|
+
"output",
|
|
116
|
+
"p",
|
|
117
|
+
"pre",
|
|
118
|
+
"q",
|
|
119
|
+
"s",
|
|
120
|
+
"samp",
|
|
121
|
+
"section",
|
|
122
|
+
"select",
|
|
123
|
+
"small",
|
|
124
|
+
"span",
|
|
125
|
+
"strike",
|
|
126
|
+
"strong",
|
|
127
|
+
"sub",
|
|
128
|
+
"summary",
|
|
129
|
+
"sup",
|
|
130
|
+
"table",
|
|
131
|
+
"tbody",
|
|
132
|
+
"td",
|
|
133
|
+
"textarea",
|
|
134
|
+
"tfoot",
|
|
135
|
+
"th",
|
|
136
|
+
"thead",
|
|
137
|
+
"time",
|
|
138
|
+
"tr",
|
|
139
|
+
"tt",
|
|
140
|
+
"u",
|
|
141
|
+
"ul",
|
|
142
|
+
"var",
|
|
143
|
+
"video",
|
|
144
|
+
"wbr",
|
|
145
|
+
])
|
|
146
|
+
|
|
147
|
+
MATHML_ELEMENTS = Set.new([
|
|
148
|
+
"annotation",
|
|
149
|
+
"annotation-xml",
|
|
150
|
+
"maction",
|
|
151
|
+
"math",
|
|
152
|
+
"menclose",
|
|
153
|
+
"merror",
|
|
154
|
+
"mfenced",
|
|
155
|
+
"mfrac",
|
|
156
|
+
"mi",
|
|
157
|
+
"mmultiscripts",
|
|
158
|
+
"mn",
|
|
159
|
+
"mo",
|
|
160
|
+
"mover",
|
|
161
|
+
"mpadded",
|
|
162
|
+
"mphantom",
|
|
163
|
+
"mprescripts",
|
|
164
|
+
"mroot",
|
|
165
|
+
"mrow",
|
|
166
|
+
"ms",
|
|
167
|
+
"mspace",
|
|
168
|
+
"msqrt",
|
|
169
|
+
"mstyle",
|
|
170
|
+
"msub",
|
|
171
|
+
"msubsup",
|
|
172
|
+
"msup",
|
|
173
|
+
"mtable",
|
|
174
|
+
"mtd",
|
|
175
|
+
"mtext",
|
|
176
|
+
"mtr",
|
|
177
|
+
"munder",
|
|
178
|
+
"munderover",
|
|
179
|
+
"none",
|
|
180
|
+
"semantics",
|
|
181
|
+
])
|
|
182
|
+
|
|
183
|
+
SVG_ELEMENTS = Set.new([
|
|
184
|
+
"a",
|
|
185
|
+
"altGlyph",
|
|
186
|
+
"animate",
|
|
187
|
+
"animateColor",
|
|
188
|
+
"animateMotion",
|
|
189
|
+
"animateTransform",
|
|
190
|
+
"circle",
|
|
191
|
+
"clipPath",
|
|
192
|
+
"cursor",
|
|
193
|
+
"defs",
|
|
194
|
+
"desc",
|
|
195
|
+
"ellipse",
|
|
196
|
+
"feGaussianBlur",
|
|
197
|
+
"feImage",
|
|
198
|
+
"filter",
|
|
199
|
+
"font-face",
|
|
200
|
+
"font-face-name",
|
|
201
|
+
"font-face-src",
|
|
202
|
+
"foreignObject",
|
|
203
|
+
"g",
|
|
204
|
+
"glyph",
|
|
205
|
+
"hkern",
|
|
206
|
+
"line",
|
|
207
|
+
"linearGradient",
|
|
208
|
+
"marker",
|
|
209
|
+
"mask",
|
|
210
|
+
"metadata",
|
|
211
|
+
"missing-glyph",
|
|
212
|
+
"mpath",
|
|
213
|
+
"path",
|
|
214
|
+
"pattern",
|
|
215
|
+
"polygon",
|
|
216
|
+
"polyline",
|
|
217
|
+
"radialGradient",
|
|
218
|
+
"rect",
|
|
219
|
+
"set",
|
|
220
|
+
"stop",
|
|
221
|
+
"svg",
|
|
222
|
+
"switch",
|
|
223
|
+
"symbol",
|
|
224
|
+
"text",
|
|
225
|
+
"textPath",
|
|
226
|
+
"title",
|
|
227
|
+
"tref",
|
|
228
|
+
"tspan",
|
|
229
|
+
"use",
|
|
230
|
+
])
|
|
231
|
+
|
|
232
|
+
ACCEPTABLE_ATTRIBUTES = Set.new([
|
|
233
|
+
"abbr",
|
|
234
|
+
"accept",
|
|
235
|
+
"accept-charset",
|
|
236
|
+
"accesskey",
|
|
237
|
+
"action",
|
|
238
|
+
"align",
|
|
239
|
+
"alt",
|
|
240
|
+
"axis",
|
|
241
|
+
"border",
|
|
242
|
+
"cellpadding",
|
|
243
|
+
"cellspacing",
|
|
244
|
+
"char",
|
|
245
|
+
"charoff",
|
|
246
|
+
"charset",
|
|
247
|
+
"checked",
|
|
248
|
+
"cite",
|
|
249
|
+
"class",
|
|
250
|
+
"clear",
|
|
251
|
+
"color",
|
|
252
|
+
"cols",
|
|
253
|
+
"colspan",
|
|
254
|
+
"compact",
|
|
255
|
+
"contenteditable",
|
|
256
|
+
"coords",
|
|
257
|
+
"datetime",
|
|
258
|
+
"dir",
|
|
259
|
+
"disabled",
|
|
260
|
+
"enctype",
|
|
261
|
+
"for",
|
|
262
|
+
"frame",
|
|
263
|
+
"headers",
|
|
264
|
+
"height",
|
|
265
|
+
"href",
|
|
266
|
+
"hreflang",
|
|
267
|
+
"hspace",
|
|
268
|
+
"id",
|
|
269
|
+
"ismap",
|
|
270
|
+
"label",
|
|
271
|
+
"lang",
|
|
272
|
+
"longdesc",
|
|
273
|
+
"loop",
|
|
274
|
+
"loopcount",
|
|
275
|
+
"loopend",
|
|
276
|
+
"loopstart",
|
|
277
|
+
"maxlength",
|
|
278
|
+
"media",
|
|
279
|
+
"method",
|
|
280
|
+
"multiple",
|
|
281
|
+
"name",
|
|
282
|
+
"nohref",
|
|
283
|
+
"noshade",
|
|
284
|
+
"nowrap",
|
|
285
|
+
"poster",
|
|
286
|
+
"preload",
|
|
287
|
+
"prompt",
|
|
288
|
+
"readonly",
|
|
289
|
+
"rel",
|
|
290
|
+
"rev",
|
|
291
|
+
"rows",
|
|
292
|
+
"rowspan",
|
|
293
|
+
"rules",
|
|
294
|
+
"scope",
|
|
295
|
+
"selected",
|
|
296
|
+
"shape",
|
|
297
|
+
"size",
|
|
298
|
+
"span",
|
|
299
|
+
"src",
|
|
300
|
+
"start",
|
|
301
|
+
"style",
|
|
302
|
+
"summary",
|
|
303
|
+
"tabindex",
|
|
304
|
+
"target",
|
|
305
|
+
"title",
|
|
306
|
+
"type",
|
|
307
|
+
"usemap",
|
|
308
|
+
"valign",
|
|
309
|
+
"value",
|
|
310
|
+
"vspace",
|
|
311
|
+
"width",
|
|
312
|
+
"xml:lang",
|
|
313
|
+
])
|
|
314
|
+
|
|
315
|
+
MATHML_ATTRIBUTES = Set.new([
|
|
316
|
+
"actiontype",
|
|
317
|
+
"align",
|
|
318
|
+
"close",
|
|
319
|
+
"columnalign",
|
|
320
|
+
"columnlines",
|
|
321
|
+
"columnspacing",
|
|
322
|
+
"columnspan",
|
|
323
|
+
"depth",
|
|
324
|
+
"dir",
|
|
325
|
+
"display",
|
|
326
|
+
"displaystyle",
|
|
327
|
+
"encoding",
|
|
328
|
+
"equalcolumns",
|
|
329
|
+
"equalrows",
|
|
330
|
+
"fence",
|
|
331
|
+
"fontstyle",
|
|
332
|
+
"fontweight",
|
|
333
|
+
"frame",
|
|
334
|
+
"height",
|
|
335
|
+
"href",
|
|
336
|
+
"linethickness",
|
|
337
|
+
"lquote",
|
|
338
|
+
"lspace",
|
|
339
|
+
"mathbackground",
|
|
340
|
+
"mathcolor",
|
|
341
|
+
"mathsize",
|
|
342
|
+
"mathvariant",
|
|
343
|
+
"maxsize",
|
|
344
|
+
"minsize",
|
|
345
|
+
"notation",
|
|
346
|
+
"open",
|
|
347
|
+
"other",
|
|
348
|
+
"rowalign",
|
|
349
|
+
"rowlines",
|
|
350
|
+
"rowspacing",
|
|
351
|
+
"rowspan",
|
|
352
|
+
"rquote",
|
|
353
|
+
"rspace",
|
|
354
|
+
"scriptlevel",
|
|
355
|
+
"selection",
|
|
356
|
+
"separator",
|
|
357
|
+
"separators",
|
|
358
|
+
"stretchy",
|
|
359
|
+
"width",
|
|
360
|
+
"xlink:href",
|
|
361
|
+
"xlink:show",
|
|
362
|
+
"xlink:type",
|
|
363
|
+
"xmlns",
|
|
364
|
+
"xmlns:xlink",
|
|
365
|
+
])
|
|
366
|
+
|
|
367
|
+
SVG_ATTRIBUTES = Set.new([
|
|
368
|
+
"accent-height",
|
|
369
|
+
"accumulate",
|
|
370
|
+
"additive",
|
|
371
|
+
"alphabetic",
|
|
372
|
+
"arabic-form",
|
|
373
|
+
"ascent",
|
|
374
|
+
"attributeName",
|
|
375
|
+
"attributeType",
|
|
376
|
+
"baseProfile",
|
|
377
|
+
"bbox",
|
|
378
|
+
"begin",
|
|
379
|
+
"calcMode",
|
|
380
|
+
"cap-height",
|
|
381
|
+
"class",
|
|
382
|
+
"clip-path",
|
|
383
|
+
"clip-rule",
|
|
384
|
+
"color",
|
|
385
|
+
"color-interpolation-filters",
|
|
386
|
+
"color-profile",
|
|
387
|
+
"color-rendering",
|
|
388
|
+
"content",
|
|
389
|
+
"cursor",
|
|
390
|
+
"cx",
|
|
391
|
+
"cy",
|
|
392
|
+
"d",
|
|
393
|
+
"descent",
|
|
394
|
+
"display",
|
|
395
|
+
"dur",
|
|
396
|
+
"dx",
|
|
397
|
+
"dy",
|
|
398
|
+
"end",
|
|
399
|
+
"fill",
|
|
400
|
+
"fill-opacity",
|
|
401
|
+
"fill-rule",
|
|
402
|
+
"filter",
|
|
403
|
+
"filterRes",
|
|
404
|
+
"filterUnits",
|
|
405
|
+
"font-family",
|
|
406
|
+
"font-size",
|
|
407
|
+
"font-stretch",
|
|
408
|
+
"font-style",
|
|
409
|
+
"font-variant",
|
|
410
|
+
"font-weight",
|
|
411
|
+
"fx",
|
|
412
|
+
"fy",
|
|
413
|
+
"g1",
|
|
414
|
+
"g2",
|
|
415
|
+
"glyph-name",
|
|
416
|
+
"gradientUnits",
|
|
417
|
+
"hanging",
|
|
418
|
+
"height",
|
|
419
|
+
"horiz-adv-x",
|
|
420
|
+
"horiz-origin-x",
|
|
421
|
+
"id",
|
|
422
|
+
"ideographic",
|
|
423
|
+
"k",
|
|
424
|
+
"keyPoints",
|
|
425
|
+
"keySplines",
|
|
426
|
+
"keyTimes",
|
|
427
|
+
"lang",
|
|
428
|
+
"marker",
|
|
429
|
+
"marker-end",
|
|
430
|
+
"marker-mid",
|
|
431
|
+
"marker-start",
|
|
432
|
+
"markerHeight",
|
|
433
|
+
"markerUnits",
|
|
434
|
+
"markerWidth",
|
|
435
|
+
"mask",
|
|
436
|
+
"maskContentUnits",
|
|
437
|
+
"maskUnits",
|
|
438
|
+
"mathematical",
|
|
439
|
+
"max",
|
|
440
|
+
"method",
|
|
441
|
+
"min",
|
|
442
|
+
"name",
|
|
443
|
+
"offset",
|
|
444
|
+
"opacity",
|
|
445
|
+
"orient",
|
|
446
|
+
"origin",
|
|
447
|
+
"overline-position",
|
|
448
|
+
"overline-thickness",
|
|
449
|
+
"panose-1",
|
|
450
|
+
"path",
|
|
451
|
+
"pathLength",
|
|
452
|
+
"patternContentUnits",
|
|
453
|
+
"patternTransform",
|
|
454
|
+
"patternUnits",
|
|
455
|
+
"points",
|
|
456
|
+
"preserveAspectRatio",
|
|
457
|
+
"primitiveUnits",
|
|
458
|
+
"r",
|
|
459
|
+
"refX",
|
|
460
|
+
"refY",
|
|
461
|
+
"repeatCount",
|
|
462
|
+
"repeatDur",
|
|
463
|
+
"requiredExtensions",
|
|
464
|
+
"requiredFeatures",
|
|
465
|
+
"restart",
|
|
466
|
+
"rotate",
|
|
467
|
+
"rx",
|
|
468
|
+
"ry",
|
|
469
|
+
"slope",
|
|
470
|
+
"spacing",
|
|
471
|
+
"startOffset",
|
|
472
|
+
"stdDeviation",
|
|
473
|
+
"stemh",
|
|
474
|
+
"stemv",
|
|
475
|
+
"stop-color",
|
|
476
|
+
"stop-opacity",
|
|
477
|
+
"strikethrough-position",
|
|
478
|
+
"strikethrough-thickness",
|
|
479
|
+
"stroke",
|
|
480
|
+
"stroke-dasharray",
|
|
481
|
+
"stroke-dashoffset",
|
|
482
|
+
"stroke-linecap",
|
|
483
|
+
"stroke-linejoin",
|
|
484
|
+
"stroke-miterlimit",
|
|
485
|
+
"stroke-opacity",
|
|
486
|
+
"stroke-width",
|
|
487
|
+
"systemLanguage",
|
|
488
|
+
"target",
|
|
489
|
+
"text-anchor",
|
|
490
|
+
"transform",
|
|
491
|
+
"type",
|
|
492
|
+
"u1",
|
|
493
|
+
"u2",
|
|
494
|
+
"underline-position",
|
|
495
|
+
"underline-thickness",
|
|
496
|
+
"unicode",
|
|
497
|
+
"unicode-range",
|
|
498
|
+
"units-per-em",
|
|
499
|
+
"version",
|
|
500
|
+
"viewBox",
|
|
501
|
+
"visibility",
|
|
502
|
+
"width",
|
|
503
|
+
"widths",
|
|
504
|
+
"x",
|
|
505
|
+
"x-height",
|
|
506
|
+
"x1",
|
|
507
|
+
"x2",
|
|
508
|
+
"xlink:actuate",
|
|
509
|
+
"xlink:arcrole",
|
|
510
|
+
"xlink:href",
|
|
511
|
+
"xlink:role",
|
|
512
|
+
"xlink:show",
|
|
513
|
+
"xlink:title",
|
|
514
|
+
"xlink:type",
|
|
515
|
+
"xml:base",
|
|
516
|
+
"xml:lang",
|
|
517
|
+
"xml:space",
|
|
518
|
+
"xmlns",
|
|
519
|
+
"xmlns:xlink",
|
|
520
|
+
"y",
|
|
521
|
+
"y1",
|
|
522
|
+
"y2",
|
|
523
|
+
"zoomAndPan",
|
|
524
|
+
])
|
|
525
|
+
|
|
526
|
+
ARIA_ATTRIBUTES = Set.new([
|
|
527
|
+
"aria-activedescendant",
|
|
528
|
+
"aria-atomic",
|
|
529
|
+
"aria-autocomplete",
|
|
530
|
+
"aria-braillelabel",
|
|
531
|
+
"aria-brailleroledescription",
|
|
532
|
+
"aria-busy",
|
|
533
|
+
"aria-checked",
|
|
534
|
+
"aria-colcount",
|
|
535
|
+
"aria-colindex",
|
|
536
|
+
"aria-colindextext",
|
|
537
|
+
"aria-colspan",
|
|
538
|
+
"aria-controls",
|
|
539
|
+
"aria-current",
|
|
540
|
+
"aria-describedby",
|
|
541
|
+
"aria-description",
|
|
542
|
+
"aria-details",
|
|
543
|
+
"aria-disabled",
|
|
544
|
+
"aria-dropeffect",
|
|
545
|
+
"aria-errormessage",
|
|
546
|
+
"aria-expanded",
|
|
547
|
+
"aria-flowto",
|
|
548
|
+
"aria-grabbed",
|
|
549
|
+
"aria-haspopup",
|
|
550
|
+
"aria-hidden",
|
|
551
|
+
"aria-invalid",
|
|
552
|
+
"aria-keyshortcuts",
|
|
553
|
+
"aria-label",
|
|
554
|
+
"aria-labelledby",
|
|
555
|
+
"aria-level",
|
|
556
|
+
"aria-live",
|
|
557
|
+
"aria-multiline",
|
|
558
|
+
"aria-multiselectable",
|
|
559
|
+
"aria-orientation",
|
|
560
|
+
"aria-owns",
|
|
561
|
+
"aria-placeholder",
|
|
562
|
+
"aria-posinset",
|
|
563
|
+
"aria-pressed",
|
|
564
|
+
"aria-readonly",
|
|
565
|
+
"aria-relevant",
|
|
566
|
+
"aria-required",
|
|
567
|
+
"aria-roledescription",
|
|
568
|
+
"aria-rowcount",
|
|
569
|
+
"aria-rowindex",
|
|
570
|
+
"aria-rowindextext",
|
|
571
|
+
"aria-rowspan",
|
|
572
|
+
"aria-selected",
|
|
573
|
+
"aria-setsize",
|
|
574
|
+
"aria-sort",
|
|
575
|
+
"aria-valuemax",
|
|
576
|
+
"aria-valuemin",
|
|
577
|
+
"aria-valuenow",
|
|
578
|
+
"aria-valuetext",
|
|
579
|
+
"role",
|
|
580
|
+
])
|
|
581
|
+
|
|
582
|
+
ATTR_VAL_IS_URI = Set.new([
|
|
583
|
+
"action",
|
|
584
|
+
"cite",
|
|
585
|
+
"href",
|
|
586
|
+
"longdesc",
|
|
587
|
+
"poster",
|
|
588
|
+
"preload",
|
|
589
|
+
"src",
|
|
590
|
+
"xlink:href",
|
|
591
|
+
"xml:base",
|
|
592
|
+
])
|
|
593
|
+
|
|
594
|
+
SVG_ATTR_VAL_ALLOWS_REF = Set.new([
|
|
595
|
+
"clip-path",
|
|
596
|
+
"color-profile",
|
|
597
|
+
"cursor",
|
|
598
|
+
"fill",
|
|
599
|
+
"filter",
|
|
600
|
+
"marker",
|
|
601
|
+
"marker-end",
|
|
602
|
+
"marker-mid",
|
|
603
|
+
"marker-start",
|
|
604
|
+
"mask",
|
|
605
|
+
"stroke",
|
|
606
|
+
])
|
|
607
|
+
|
|
608
|
+
SVG_ALLOW_LOCAL_HREF = Set.new([
|
|
609
|
+
"altGlyph",
|
|
610
|
+
"animate",
|
|
611
|
+
"animateColor",
|
|
612
|
+
"animateMotion",
|
|
613
|
+
"animateTransform",
|
|
614
|
+
"cursor",
|
|
615
|
+
"feImage",
|
|
616
|
+
"filter",
|
|
617
|
+
"linearGradient",
|
|
618
|
+
"pattern",
|
|
619
|
+
"radialGradient",
|
|
620
|
+
"set",
|
|
621
|
+
"textpath",
|
|
622
|
+
"tref",
|
|
623
|
+
"use",
|
|
624
|
+
])
|
|
625
|
+
|
|
626
|
+
ACCEPTABLE_CSS_PROPERTIES = Set.new([
|
|
627
|
+
"azimuth",
|
|
628
|
+
"align-content",
|
|
629
|
+
"align-items",
|
|
630
|
+
"align-self",
|
|
631
|
+
"aspect-ratio",
|
|
632
|
+
"background-color",
|
|
633
|
+
"border-bottom-color",
|
|
634
|
+
"border-collapse",
|
|
635
|
+
"border-color",
|
|
636
|
+
"border-left-color",
|
|
637
|
+
"border-right-color",
|
|
638
|
+
"border-top-color",
|
|
639
|
+
"clear",
|
|
640
|
+
"color",
|
|
641
|
+
"cursor",
|
|
642
|
+
"direction",
|
|
643
|
+
"display",
|
|
644
|
+
"elevation",
|
|
645
|
+
"flex",
|
|
646
|
+
"flex-basis",
|
|
647
|
+
"flex-direction",
|
|
648
|
+
"flex-flow",
|
|
649
|
+
"flex-grow",
|
|
650
|
+
"flex-shrink",
|
|
651
|
+
"flex-wrap",
|
|
652
|
+
"float",
|
|
653
|
+
"font",
|
|
654
|
+
"font-family",
|
|
655
|
+
"font-size",
|
|
656
|
+
"font-style",
|
|
657
|
+
"font-variant",
|
|
658
|
+
"font-weight",
|
|
659
|
+
"height",
|
|
660
|
+
"justify-content",
|
|
661
|
+
"letter-spacing",
|
|
662
|
+
"line-height",
|
|
663
|
+
"list-style",
|
|
664
|
+
"list-style-type",
|
|
665
|
+
"max-height",
|
|
666
|
+
"max-width",
|
|
667
|
+
"min-height",
|
|
668
|
+
"min-width",
|
|
669
|
+
"order",
|
|
670
|
+
"overflow",
|
|
671
|
+
"overflow-x",
|
|
672
|
+
"overflow-y",
|
|
673
|
+
"page-break-after",
|
|
674
|
+
"page-break-before",
|
|
675
|
+
"page-break-inside",
|
|
676
|
+
"pause",
|
|
677
|
+
"pause-after",
|
|
678
|
+
"pause-before",
|
|
679
|
+
"pitch",
|
|
680
|
+
"pitch-range",
|
|
681
|
+
"richness",
|
|
682
|
+
"speak",
|
|
683
|
+
"speak-header",
|
|
684
|
+
"speak-numeral",
|
|
685
|
+
"speak-punctuation",
|
|
686
|
+
"speech-rate",
|
|
687
|
+
"stress",
|
|
688
|
+
"text-align",
|
|
689
|
+
"text-decoration",
|
|
690
|
+
"text-indent",
|
|
691
|
+
"unicode-bidi",
|
|
692
|
+
"vertical-align",
|
|
693
|
+
"voice-family",
|
|
694
|
+
"volume",
|
|
695
|
+
"white-space",
|
|
696
|
+
"width",
|
|
697
|
+
])
|
|
698
|
+
|
|
699
|
+
ACCEPTABLE_CSS_KEYWORDS = Set.new([
|
|
700
|
+
"!important",
|
|
701
|
+
"auto",
|
|
702
|
+
"block",
|
|
703
|
+
"bold",
|
|
704
|
+
"both",
|
|
705
|
+
"bottom",
|
|
706
|
+
"center",
|
|
707
|
+
"collapse",
|
|
708
|
+
"dashed",
|
|
709
|
+
"dotted",
|
|
710
|
+
"double",
|
|
711
|
+
"groove",
|
|
712
|
+
"hidden",
|
|
713
|
+
"inherit",
|
|
714
|
+
"initial",
|
|
715
|
+
"inset",
|
|
716
|
+
"italic",
|
|
717
|
+
"left",
|
|
718
|
+
"medium",
|
|
719
|
+
"none",
|
|
720
|
+
"normal",
|
|
721
|
+
"nowrap",
|
|
722
|
+
"outset",
|
|
723
|
+
"pointer",
|
|
724
|
+
"revert",
|
|
725
|
+
"ridge",
|
|
726
|
+
"right",
|
|
727
|
+
"separate",
|
|
728
|
+
"solid",
|
|
729
|
+
"thick",
|
|
730
|
+
"thin",
|
|
731
|
+
"top",
|
|
732
|
+
"transparent",
|
|
733
|
+
"underline",
|
|
734
|
+
"unset",
|
|
735
|
+
])
|
|
736
|
+
|
|
737
|
+
# https://www.w3.org/TR/css-color-3/#html4
|
|
738
|
+
ACCEPTABLE_CSS_COLORS = Set.new([
|
|
739
|
+
"aqua",
|
|
740
|
+
"black",
|
|
741
|
+
"blue",
|
|
742
|
+
"fuchsia",
|
|
743
|
+
"gray",
|
|
744
|
+
"green",
|
|
745
|
+
"lime",
|
|
746
|
+
"maroon",
|
|
747
|
+
"navy",
|
|
748
|
+
"olive",
|
|
749
|
+
"purple",
|
|
750
|
+
"red",
|
|
751
|
+
"silver",
|
|
752
|
+
"teal",
|
|
753
|
+
"white",
|
|
754
|
+
"yellow",
|
|
755
|
+
])
|
|
756
|
+
|
|
757
|
+
# https://www.w3.org/TR/css-color-3/#svg-color
|
|
758
|
+
ACCEPTABLE_CSS_EXTENDED_COLORS = Set.new([
|
|
759
|
+
"aliceblue",
|
|
760
|
+
"antiquewhite",
|
|
761
|
+
"aqua",
|
|
762
|
+
"aquamarine",
|
|
763
|
+
"azure",
|
|
764
|
+
"beige",
|
|
765
|
+
"bisque",
|
|
766
|
+
"black",
|
|
767
|
+
"blanchedalmond",
|
|
768
|
+
"blue",
|
|
769
|
+
"blueviolet",
|
|
770
|
+
"brown",
|
|
771
|
+
"burlywood",
|
|
772
|
+
"cadetblue",
|
|
773
|
+
"chartreuse",
|
|
774
|
+
"chocolate",
|
|
775
|
+
"coral",
|
|
776
|
+
"cornflowerblue",
|
|
777
|
+
"cornsilk",
|
|
778
|
+
"crimson",
|
|
779
|
+
"cyan",
|
|
780
|
+
"darkblue",
|
|
781
|
+
"darkcyan",
|
|
782
|
+
"darkgoldenrod",
|
|
783
|
+
"darkgray",
|
|
784
|
+
"darkgreen",
|
|
785
|
+
"darkgrey",
|
|
786
|
+
"darkkhaki",
|
|
787
|
+
"darkmagenta",
|
|
788
|
+
"darkolivegreen",
|
|
789
|
+
"darkorange",
|
|
790
|
+
"darkorchid",
|
|
791
|
+
"darkred",
|
|
792
|
+
"darksalmon",
|
|
793
|
+
"darkseagreen",
|
|
794
|
+
"darkslateblue",
|
|
795
|
+
"darkslategray",
|
|
796
|
+
"darkslategrey",
|
|
797
|
+
"darkturquoise",
|
|
798
|
+
"darkviolet",
|
|
799
|
+
"deeppink",
|
|
800
|
+
"deepskyblue",
|
|
801
|
+
"dimgray",
|
|
802
|
+
"dimgrey",
|
|
803
|
+
"dodgerblue",
|
|
804
|
+
"firebrick",
|
|
805
|
+
"floralwhite",
|
|
806
|
+
"forestgreen",
|
|
807
|
+
"fuchsia",
|
|
808
|
+
"gainsboro",
|
|
809
|
+
"ghostwhite",
|
|
810
|
+
"gold",
|
|
811
|
+
"goldenrod",
|
|
812
|
+
"gray",
|
|
813
|
+
"green",
|
|
814
|
+
"greenyellow",
|
|
815
|
+
"grey",
|
|
816
|
+
"honeydew",
|
|
817
|
+
"hotpink",
|
|
818
|
+
"indianred",
|
|
819
|
+
"indigo",
|
|
820
|
+
"ivory",
|
|
821
|
+
"khaki",
|
|
822
|
+
"lavender",
|
|
823
|
+
"lavenderblush",
|
|
824
|
+
"lawngreen",
|
|
825
|
+
"lemonchiffon",
|
|
826
|
+
"lightblue",
|
|
827
|
+
"lightcoral",
|
|
828
|
+
"lightcyan",
|
|
829
|
+
"lightgoldenrodyellow",
|
|
830
|
+
"lightgray",
|
|
831
|
+
"lightgreen",
|
|
832
|
+
"lightgrey",
|
|
833
|
+
"lightpink",
|
|
834
|
+
"lightsalmon",
|
|
835
|
+
"lightseagreen",
|
|
836
|
+
"lightskyblue",
|
|
837
|
+
"lightslategray",
|
|
838
|
+
"lightslategrey",
|
|
839
|
+
"lightsteelblue",
|
|
840
|
+
"lightyellow",
|
|
841
|
+
"lime",
|
|
842
|
+
"limegreen",
|
|
843
|
+
"linen",
|
|
844
|
+
"magenta",
|
|
845
|
+
"maroon",
|
|
846
|
+
"mediumaquamarine",
|
|
847
|
+
"mediumblue",
|
|
848
|
+
"mediumorchid",
|
|
849
|
+
"mediumpurple",
|
|
850
|
+
"mediumseagreen",
|
|
851
|
+
"mediumslateblue",
|
|
852
|
+
"mediumspringgreen",
|
|
853
|
+
"mediumturquoise",
|
|
854
|
+
"mediumvioletred",
|
|
855
|
+
"midnightblue",
|
|
856
|
+
"mintcream",
|
|
857
|
+
"mistyrose",
|
|
858
|
+
"moccasin",
|
|
859
|
+
"navajowhite",
|
|
860
|
+
"navy",
|
|
861
|
+
"oldlace",
|
|
862
|
+
"olive",
|
|
863
|
+
"olivedrab",
|
|
864
|
+
"orange",
|
|
865
|
+
"orangered",
|
|
866
|
+
"orchid",
|
|
867
|
+
"palegoldenrod",
|
|
868
|
+
"palegreen",
|
|
869
|
+
"paleturquoise",
|
|
870
|
+
"palevioletred",
|
|
871
|
+
"papayawhip",
|
|
872
|
+
"peachpuff",
|
|
873
|
+
"peru",
|
|
874
|
+
"pink",
|
|
875
|
+
"plum",
|
|
876
|
+
"powderblue",
|
|
877
|
+
"purple",
|
|
878
|
+
"red",
|
|
879
|
+
"rosybrown",
|
|
880
|
+
"royalblue",
|
|
881
|
+
"saddlebrown",
|
|
882
|
+
"salmon",
|
|
883
|
+
"sandybrown",
|
|
884
|
+
"seagreen",
|
|
885
|
+
"seashell",
|
|
886
|
+
"sienna",
|
|
887
|
+
"silver",
|
|
888
|
+
"skyblue",
|
|
889
|
+
"slateblue",
|
|
890
|
+
"slategray",
|
|
891
|
+
"slategrey",
|
|
892
|
+
"snow",
|
|
893
|
+
"springgreen",
|
|
894
|
+
"steelblue",
|
|
895
|
+
"tan",
|
|
896
|
+
"teal",
|
|
897
|
+
"thistle",
|
|
898
|
+
"tomato",
|
|
899
|
+
"turquoise",
|
|
900
|
+
"violet",
|
|
901
|
+
"wheat",
|
|
902
|
+
"white",
|
|
903
|
+
"whitesmoke",
|
|
904
|
+
"yellow",
|
|
905
|
+
"yellowgreen",
|
|
906
|
+
])
|
|
907
|
+
|
|
908
|
+
# see https://www.quackit.com/css/functions/
|
|
909
|
+
# omit `url` and `image` from that list
|
|
910
|
+
ACCEPTABLE_CSS_FUNCTIONS = Set.new([
|
|
911
|
+
"attr",
|
|
912
|
+
"blur",
|
|
913
|
+
"brightness",
|
|
914
|
+
"calc",
|
|
915
|
+
"circle",
|
|
916
|
+
"contrast",
|
|
917
|
+
"counter",
|
|
918
|
+
"counters",
|
|
919
|
+
"cubic-bezier",
|
|
920
|
+
"drop-shadow",
|
|
921
|
+
"ellipse",
|
|
922
|
+
"grayscale",
|
|
923
|
+
"hsl",
|
|
924
|
+
"hsla",
|
|
925
|
+
"hue-rotate",
|
|
926
|
+
"hwb",
|
|
927
|
+
"inset",
|
|
928
|
+
"invert",
|
|
929
|
+
"linear-gradient",
|
|
930
|
+
"matrix",
|
|
931
|
+
"matrix3d",
|
|
932
|
+
"opacity",
|
|
933
|
+
"perspective",
|
|
934
|
+
"polygon",
|
|
935
|
+
"radial-gradient",
|
|
936
|
+
"repeating-linear-gradient",
|
|
937
|
+
"repeating-radial-gradient",
|
|
938
|
+
"rgb",
|
|
939
|
+
"rgba",
|
|
940
|
+
"rotate",
|
|
941
|
+
"rotate3d",
|
|
942
|
+
"rotateX",
|
|
943
|
+
"rotateY",
|
|
944
|
+
"rotateZ",
|
|
945
|
+
"saturate",
|
|
946
|
+
"sepia",
|
|
947
|
+
"scale",
|
|
948
|
+
"scale3d",
|
|
949
|
+
"scaleX",
|
|
950
|
+
"scaleY",
|
|
951
|
+
"scaleZ",
|
|
952
|
+
"skew",
|
|
953
|
+
"skewX",
|
|
954
|
+
"skewY",
|
|
955
|
+
"symbols",
|
|
956
|
+
"translate",
|
|
957
|
+
"translate3d",
|
|
958
|
+
"translateX",
|
|
959
|
+
"translateY",
|
|
960
|
+
"translateZ",
|
|
961
|
+
])
|
|
962
|
+
|
|
963
|
+
SHORTHAND_CSS_PROPERTIES = Set.new([
|
|
964
|
+
"background",
|
|
965
|
+
"border",
|
|
966
|
+
"margin",
|
|
967
|
+
"padding",
|
|
968
|
+
])
|
|
969
|
+
|
|
970
|
+
ACCEPTABLE_SVG_PROPERTIES = Set.new([
|
|
971
|
+
"fill",
|
|
972
|
+
"fill-opacity",
|
|
973
|
+
"fill-rule",
|
|
974
|
+
"stroke",
|
|
975
|
+
"stroke-width",
|
|
976
|
+
"stroke-linecap",
|
|
977
|
+
"stroke-linejoin",
|
|
978
|
+
"stroke-opacity",
|
|
979
|
+
])
|
|
980
|
+
|
|
981
|
+
PROTOCOL_SEPARATOR = /:|(�*58)|(p)|(�*3a)|(%|%)3A/i
|
|
982
|
+
|
|
983
|
+
ACCEPTABLE_PROTOCOLS = Set.new([
|
|
984
|
+
"afs",
|
|
985
|
+
"aim",
|
|
986
|
+
"callto",
|
|
987
|
+
"data",
|
|
988
|
+
"ed2k",
|
|
989
|
+
"fax",
|
|
990
|
+
"feed",
|
|
991
|
+
"ftp",
|
|
992
|
+
"gopher",
|
|
993
|
+
"http",
|
|
994
|
+
"https",
|
|
995
|
+
"irc",
|
|
996
|
+
"line",
|
|
997
|
+
"mailto",
|
|
998
|
+
"modem",
|
|
999
|
+
"news",
|
|
1000
|
+
"nntp",
|
|
1001
|
+
"rsync",
|
|
1002
|
+
"rtsp",
|
|
1003
|
+
"sftp",
|
|
1004
|
+
"sms",
|
|
1005
|
+
"ssh",
|
|
1006
|
+
"tag",
|
|
1007
|
+
"tel",
|
|
1008
|
+
"telnet",
|
|
1009
|
+
"urn",
|
|
1010
|
+
"webcal",
|
|
1011
|
+
"xmpp",
|
|
1012
|
+
])
|
|
1013
|
+
|
|
1014
|
+
ACCEPTABLE_URI_DATA_MEDIATYPES = Set.new([
|
|
1015
|
+
"image/gif",
|
|
1016
|
+
"image/jpeg",
|
|
1017
|
+
"image/png",
|
|
1018
|
+
"text/css",
|
|
1019
|
+
"text/plain",
|
|
1020
|
+
])
|
|
1021
|
+
|
|
1022
|
+
# subclasses may define their own versions of these constants
|
|
1023
|
+
ALLOWED_ELEMENTS = ACCEPTABLE_ELEMENTS + MATHML_ELEMENTS + SVG_ELEMENTS
|
|
1024
|
+
ALLOWED_ATTRIBUTES = ACCEPTABLE_ATTRIBUTES + MATHML_ATTRIBUTES + SVG_ATTRIBUTES + ARIA_ATTRIBUTES
|
|
1025
|
+
ALLOWED_CSS_PROPERTIES = ACCEPTABLE_CSS_PROPERTIES
|
|
1026
|
+
ALLOWED_CSS_KEYWORDS = ACCEPTABLE_CSS_KEYWORDS + ACCEPTABLE_CSS_COLORS + ACCEPTABLE_CSS_EXTENDED_COLORS
|
|
1027
|
+
ALLOWED_CSS_FUNCTIONS = ACCEPTABLE_CSS_FUNCTIONS
|
|
1028
|
+
ALLOWED_SVG_PROPERTIES = ACCEPTABLE_SVG_PROPERTIES
|
|
1029
|
+
ALLOWED_PROTOCOLS = ACCEPTABLE_PROTOCOLS
|
|
1030
|
+
ALLOWED_URI_DATA_MEDIATYPES = ACCEPTABLE_URI_DATA_MEDIATYPES
|
|
1031
|
+
|
|
1032
|
+
# TODO: remove VOID_ELEMENTS in a future major release
|
|
1033
|
+
# and put it in the tests (it is used only for testing, not for functional behavior)
|
|
1034
|
+
VOID_ELEMENTS = Set.new([
|
|
1035
|
+
"area",
|
|
1036
|
+
"br",
|
|
1037
|
+
"hr",
|
|
1038
|
+
"img",
|
|
1039
|
+
"input",
|
|
1040
|
+
])
|
|
1041
|
+
|
|
1042
|
+
# additional tags we should consider safe since we have libxml2 fixing up our documents.
|
|
1043
|
+
TAGS_SAFE_WITH_LIBXML2 = Set.new([
|
|
1044
|
+
"body",
|
|
1045
|
+
"head",
|
|
1046
|
+
"html",
|
|
1047
|
+
])
|
|
1048
|
+
ALLOWED_ELEMENTS_WITH_LIBXML2 = ALLOWED_ELEMENTS + TAGS_SAFE_WITH_LIBXML2
|
|
1049
|
+
end
|
|
1050
|
+
|
|
1051
|
+
WhiteList = SafeList
|
|
1052
|
+
if Object.respond_to?(:deprecate_constant)
|
|
1053
|
+
deprecate_constant :WhiteList
|
|
1054
|
+
end
|
|
1055
|
+
|
|
1056
|
+
::Loofah::MetaHelpers.add_downcased_set_members_to_all_set_constants(::Loofah::HTML5::SafeList)
|
|
1057
|
+
end
|
|
1058
|
+
end
|