loofah 2.2.3 → 2.9.0
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of loofah might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CHANGELOG.md +124 -31
- data/README.md +12 -16
- data/lib/loofah.rb +35 -18
- data/lib/loofah/elements.rb +74 -73
- data/lib/loofah/helpers.rb +18 -7
- data/lib/loofah/html/document.rb +1 -0
- data/lib/loofah/html/document_fragment.rb +4 -2
- data/lib/loofah/html5/libxml2_workarounds.rb +8 -7
- data/lib/loofah/html5/safelist.rb +819 -0
- data/lib/loofah/html5/scrub.rb +63 -46
- data/lib/loofah/instance_methods.rb +5 -3
- data/lib/loofah/metahelpers.rb +2 -1
- data/lib/loofah/scrubber.rb +8 -7
- data/lib/loofah/scrubbers.rb +12 -11
- data/lib/loofah/version.rb +5 -0
- data/lib/loofah/xml/document.rb +1 -0
- data/lib/loofah/xml/document_fragment.rb +2 -1
- metadata +40 -112
- data/.gemtest +0 -0
- data/Gemfile +0 -22
- data/Manifest.txt +0 -40
- data/Rakefile +0 -79
- data/benchmark/benchmark.rb +0 -149
- data/benchmark/fragment.html +0 -96
- data/benchmark/helper.rb +0 -73
- data/benchmark/www.slashdot.com.html +0 -2560
- data/lib/loofah/html5/whitelist.rb +0 -186
- data/test/assets/msword.html +0 -63
- data/test/assets/testdata_sanitizer_tests1.dat +0 -502
- data/test/helper.rb +0 -18
- data/test/html5/test_sanitizer.rb +0 -382
- data/test/integration/test_ad_hoc.rb +0 -204
- data/test/integration/test_helpers.rb +0 -43
- data/test/integration/test_html.rb +0 -72
- data/test/integration/test_scrubbers.rb +0 -400
- data/test/integration/test_xml.rb +0 -55
- data/test/unit/test_api.rb +0 -142
- data/test/unit/test_encoding.rb +0 -20
- data/test/unit/test_helpers.rb +0 -62
- data/test/unit/test_scrubber.rb +0 -229
- data/test/unit/test_scrubbers.rb +0 -14
data/lib/loofah/helpers.rb
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
1
2
|
module Loofah
|
|
2
3
|
module Helpers
|
|
3
4
|
class << self
|
|
@@ -27,7 +28,7 @@ module Loofah
|
|
|
27
28
|
#
|
|
28
29
|
# Loofah::Helpers.sanitize_css("display:block;background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg)") # => "display: block;"
|
|
29
30
|
#
|
|
30
|
-
def sanitize_css
|
|
31
|
+
def sanitize_css(style_string)
|
|
31
32
|
::Loofah::HTML5::Scrub.scrub_css style_string
|
|
32
33
|
end
|
|
33
34
|
|
|
@@ -46,8 +47,13 @@ module Loofah
|
|
|
46
47
|
@full_sanitizer ||= ::Loofah::Helpers::ActionView::FullSanitizer.new
|
|
47
48
|
end
|
|
48
49
|
|
|
50
|
+
def safe_list_sanitizer
|
|
51
|
+
@safe_list_sanitizer ||= ::Loofah::Helpers::ActionView::SafeListSanitizer.new
|
|
52
|
+
end
|
|
53
|
+
|
|
49
54
|
def white_list_sanitizer
|
|
50
|
-
|
|
55
|
+
warn "warning: white_list_sanitizer is deprecated, please use safe_list_sanitizer instead."
|
|
56
|
+
safe_list_sanitizer
|
|
51
57
|
end
|
|
52
58
|
end
|
|
53
59
|
|
|
@@ -63,7 +69,7 @@ module Loofah
|
|
|
63
69
|
# Loofah::Helpers::ActionView.set_as_default_sanitizer
|
|
64
70
|
#
|
|
65
71
|
class FullSanitizer
|
|
66
|
-
def sanitize
|
|
72
|
+
def sanitize(html, *args)
|
|
67
73
|
Loofah::Helpers.strip_tags html
|
|
68
74
|
end
|
|
69
75
|
end
|
|
@@ -73,21 +79,26 @@ module Loofah
|
|
|
73
79
|
#
|
|
74
80
|
# To use by default, call this in an application initializer:
|
|
75
81
|
#
|
|
76
|
-
# ActionView::Helpers::SanitizeHelper.
|
|
82
|
+
# ActionView::Helpers::SanitizeHelper.safe_list_sanitizer = ::Loofah::Helpers::ActionView::SafeListSanitizer.new
|
|
77
83
|
#
|
|
78
84
|
# Or, to generally opt-in to Loofah's view sanitizers:
|
|
79
85
|
#
|
|
80
86
|
# Loofah::Helpers::ActionView.set_as_default_sanitizer
|
|
81
87
|
#
|
|
82
|
-
class
|
|
83
|
-
def sanitize
|
|
88
|
+
class SafeListSanitizer
|
|
89
|
+
def sanitize(html, *args)
|
|
84
90
|
Loofah::Helpers.sanitize html
|
|
85
91
|
end
|
|
86
92
|
|
|
87
|
-
def sanitize_css
|
|
93
|
+
def sanitize_css(style_string, *args)
|
|
88
94
|
Loofah::Helpers.sanitize_css style_string
|
|
89
95
|
end
|
|
90
96
|
end
|
|
97
|
+
|
|
98
|
+
WhiteListSanitizer = SafeListSanitizer
|
|
99
|
+
if Object.respond_to?(:deprecate_constant)
|
|
100
|
+
deprecate_constant :WhiteListSanitizer
|
|
101
|
+
end
|
|
91
102
|
end
|
|
92
103
|
end
|
|
93
104
|
end
|
data/lib/loofah/html/document.rb
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
1
2
|
module Loofah
|
|
2
3
|
module HTML # :nodoc:
|
|
3
4
|
#
|
|
@@ -14,10 +15,10 @@ module Loofah
|
|
|
14
15
|
# constructor. Applications should use Loofah.fragment to
|
|
15
16
|
# parse a fragment.
|
|
16
17
|
#
|
|
17
|
-
def parse
|
|
18
|
+
def parse(tags, encoding = nil)
|
|
18
19
|
doc = Loofah::HTML::Document.new
|
|
19
20
|
|
|
20
|
-
encoding ||= tags.respond_to?(:encoding) ? tags.encoding.name :
|
|
21
|
+
encoding ||= tags.respond_to?(:encoding) ? tags.encoding.name : "UTF-8"
|
|
21
22
|
doc.encoding = encoding
|
|
22
23
|
|
|
23
24
|
new(doc, tags)
|
|
@@ -30,6 +31,7 @@ module Loofah
|
|
|
30
31
|
def to_s
|
|
31
32
|
serialize_root.children.to_s
|
|
32
33
|
end
|
|
34
|
+
|
|
33
35
|
alias :serialize :to_s
|
|
34
36
|
|
|
35
37
|
def serialize_root
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
# coding: utf-8
|
|
2
|
-
|
|
2
|
+
# frozen_string_literal: true
|
|
3
|
+
require "set"
|
|
3
4
|
|
|
4
5
|
module Loofah
|
|
5
6
|
#
|
|
@@ -16,11 +17,11 @@ module Loofah
|
|
|
16
17
|
# see comments about CVE-2018-8048 within the tests for more information
|
|
17
18
|
#
|
|
18
19
|
BROKEN_ESCAPING_ATTRIBUTES = Set.new %w[
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
BROKEN_ESCAPING_ATTRIBUTES_QUALIFYING_TAG = {"name" => "a"}
|
|
20
|
+
href
|
|
21
|
+
action
|
|
22
|
+
src
|
|
23
|
+
name
|
|
24
|
+
]
|
|
25
|
+
BROKEN_ESCAPING_ATTRIBUTES_QUALIFYING_TAG = { "name" => "a" }
|
|
25
26
|
end
|
|
26
27
|
end
|
|
@@ -0,0 +1,819 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
require "set"
|
|
3
|
+
|
|
4
|
+
module Loofah
|
|
5
|
+
module HTML5 # :nodoc:
|
|
6
|
+
#
|
|
7
|
+
# HTML safelist lifted from HTML5lib sanitizer code:
|
|
8
|
+
#
|
|
9
|
+
# http://code.google.com/p/html5lib/
|
|
10
|
+
#
|
|
11
|
+
# <html5_license>
|
|
12
|
+
#
|
|
13
|
+
# Copyright (c) 2006-2008 The Authors
|
|
14
|
+
#
|
|
15
|
+
# Contributors:
|
|
16
|
+
# James Graham - jg307@cam.ac.uk
|
|
17
|
+
# Anne van Kesteren - annevankesteren@gmail.com
|
|
18
|
+
# Lachlan Hunt - lachlan.hunt@lachy.id.au
|
|
19
|
+
# Matt McDonald - kanashii@kanashii.ca
|
|
20
|
+
# Sam Ruby - rubys@intertwingly.net
|
|
21
|
+
# Ian Hickson (Google) - ian@hixie.ch
|
|
22
|
+
# Thomas Broyer - t.broyer@ltgt.net
|
|
23
|
+
# Jacques Distler - distler@golem.ph.utexas.edu
|
|
24
|
+
# Henri Sivonen - hsivonen@iki.fi
|
|
25
|
+
# The Mozilla Foundation (contributions from Henri Sivonen since 2008)
|
|
26
|
+
#
|
|
27
|
+
# Permission is hereby granted, free of charge, to any person
|
|
28
|
+
# obtaining a copy of this software and associated documentation
|
|
29
|
+
# files (the "Software"), to deal in the Software without
|
|
30
|
+
# restriction, including without limitation the rights to use, copy,
|
|
31
|
+
# modify, merge, publish, distribute, sublicense, and/or sell copies
|
|
32
|
+
# of the Software, and to permit persons to whom the Software is
|
|
33
|
+
# furnished to do so, subject to the following conditions:
|
|
34
|
+
#
|
|
35
|
+
# The above copyright notice and this permission notice shall be
|
|
36
|
+
# included in all copies or substantial portions of the Software.
|
|
37
|
+
#
|
|
38
|
+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
39
|
+
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
40
|
+
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
41
|
+
# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
|
42
|
+
# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
43
|
+
# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
44
|
+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
|
|
45
|
+
# DEALINGS IN THE SOFTWARE.
|
|
46
|
+
#
|
|
47
|
+
# </html5_license>
|
|
48
|
+
module SafeList
|
|
49
|
+
ACCEPTABLE_ELEMENTS = Set.new([
|
|
50
|
+
"a",
|
|
51
|
+
"abbr",
|
|
52
|
+
"acronym",
|
|
53
|
+
"address",
|
|
54
|
+
"area",
|
|
55
|
+
"article",
|
|
56
|
+
"aside",
|
|
57
|
+
"audio",
|
|
58
|
+
"b",
|
|
59
|
+
"bdi",
|
|
60
|
+
"bdo",
|
|
61
|
+
"big",
|
|
62
|
+
"blockquote",
|
|
63
|
+
"br",
|
|
64
|
+
"button",
|
|
65
|
+
"canvas",
|
|
66
|
+
"caption",
|
|
67
|
+
"center",
|
|
68
|
+
"cite",
|
|
69
|
+
"code",
|
|
70
|
+
"col",
|
|
71
|
+
"colgroup",
|
|
72
|
+
"command",
|
|
73
|
+
"datalist",
|
|
74
|
+
"dd",
|
|
75
|
+
"del",
|
|
76
|
+
"details",
|
|
77
|
+
"dfn",
|
|
78
|
+
"dir",
|
|
79
|
+
"div",
|
|
80
|
+
"dl",
|
|
81
|
+
"dt",
|
|
82
|
+
"em",
|
|
83
|
+
"fieldset",
|
|
84
|
+
"figcaption",
|
|
85
|
+
"figure",
|
|
86
|
+
"font",
|
|
87
|
+
"footer",
|
|
88
|
+
"form",
|
|
89
|
+
"h1",
|
|
90
|
+
"h2",
|
|
91
|
+
"h3",
|
|
92
|
+
"h4",
|
|
93
|
+
"h5",
|
|
94
|
+
"h6",
|
|
95
|
+
"header",
|
|
96
|
+
"hr",
|
|
97
|
+
"i",
|
|
98
|
+
"img",
|
|
99
|
+
"input",
|
|
100
|
+
"ins",
|
|
101
|
+
"kbd",
|
|
102
|
+
"label",
|
|
103
|
+
"legend",
|
|
104
|
+
"li",
|
|
105
|
+
"main",
|
|
106
|
+
"map",
|
|
107
|
+
"mark",
|
|
108
|
+
"menu",
|
|
109
|
+
"meter",
|
|
110
|
+
"nav",
|
|
111
|
+
"ol",
|
|
112
|
+
"optgroup",
|
|
113
|
+
"option",
|
|
114
|
+
"output",
|
|
115
|
+
"p",
|
|
116
|
+
"pre",
|
|
117
|
+
"q",
|
|
118
|
+
"s",
|
|
119
|
+
"samp",
|
|
120
|
+
"section",
|
|
121
|
+
"select",
|
|
122
|
+
"small",
|
|
123
|
+
"span",
|
|
124
|
+
"strike",
|
|
125
|
+
"strong",
|
|
126
|
+
"sub",
|
|
127
|
+
"summary",
|
|
128
|
+
"sup",
|
|
129
|
+
"table",
|
|
130
|
+
"tbody",
|
|
131
|
+
"td",
|
|
132
|
+
"textarea",
|
|
133
|
+
"tfoot",
|
|
134
|
+
"th",
|
|
135
|
+
"thead",
|
|
136
|
+
"time",
|
|
137
|
+
"tr",
|
|
138
|
+
"tt",
|
|
139
|
+
"u",
|
|
140
|
+
"ul",
|
|
141
|
+
"var",
|
|
142
|
+
"video",
|
|
143
|
+
])
|
|
144
|
+
|
|
145
|
+
MATHML_ELEMENTS = Set.new([
|
|
146
|
+
"annotation",
|
|
147
|
+
"annotation-xml",
|
|
148
|
+
"maction",
|
|
149
|
+
"math",
|
|
150
|
+
"merror",
|
|
151
|
+
"mfenced",
|
|
152
|
+
"mfrac",
|
|
153
|
+
"mi",
|
|
154
|
+
"mmultiscripts",
|
|
155
|
+
"mn",
|
|
156
|
+
"mo",
|
|
157
|
+
"mover",
|
|
158
|
+
"mpadded",
|
|
159
|
+
"mphantom",
|
|
160
|
+
"mprescripts",
|
|
161
|
+
"mroot",
|
|
162
|
+
"mrow",
|
|
163
|
+
"mspace",
|
|
164
|
+
"msqrt",
|
|
165
|
+
"mstyle",
|
|
166
|
+
"msub",
|
|
167
|
+
"msubsup",
|
|
168
|
+
"msup",
|
|
169
|
+
"mtable",
|
|
170
|
+
"mtd",
|
|
171
|
+
"mtext",
|
|
172
|
+
"mtr",
|
|
173
|
+
"munder",
|
|
174
|
+
"munderover",
|
|
175
|
+
"none",
|
|
176
|
+
"semantics",
|
|
177
|
+
])
|
|
178
|
+
|
|
179
|
+
SVG_ELEMENTS = Set.new([
|
|
180
|
+
"a",
|
|
181
|
+
"animate",
|
|
182
|
+
"animateColor",
|
|
183
|
+
"animateMotion",
|
|
184
|
+
"animateTransform",
|
|
185
|
+
"circle",
|
|
186
|
+
"clipPath",
|
|
187
|
+
"defs",
|
|
188
|
+
"desc",
|
|
189
|
+
"ellipse",
|
|
190
|
+
"feGaussianBlur",
|
|
191
|
+
"filter",
|
|
192
|
+
"font-face",
|
|
193
|
+
"font-face-name",
|
|
194
|
+
"font-face-src",
|
|
195
|
+
"foreignObject",
|
|
196
|
+
"g",
|
|
197
|
+
"glyph",
|
|
198
|
+
"hkern",
|
|
199
|
+
"line",
|
|
200
|
+
"linearGradient",
|
|
201
|
+
"marker",
|
|
202
|
+
"mask",
|
|
203
|
+
"metadata",
|
|
204
|
+
"missing-glyph",
|
|
205
|
+
"mpath",
|
|
206
|
+
"path",
|
|
207
|
+
"polygon",
|
|
208
|
+
"polyline",
|
|
209
|
+
"radialGradient",
|
|
210
|
+
"rect",
|
|
211
|
+
"set",
|
|
212
|
+
"stop",
|
|
213
|
+
"svg",
|
|
214
|
+
"switch",
|
|
215
|
+
"symbol",
|
|
216
|
+
"text",
|
|
217
|
+
"textPath",
|
|
218
|
+
"title",
|
|
219
|
+
"tspan",
|
|
220
|
+
"use",
|
|
221
|
+
])
|
|
222
|
+
|
|
223
|
+
ACCEPTABLE_ATTRIBUTES = Set.new([
|
|
224
|
+
"abbr",
|
|
225
|
+
"accept",
|
|
226
|
+
"accept-charset",
|
|
227
|
+
"accesskey",
|
|
228
|
+
"action",
|
|
229
|
+
"align",
|
|
230
|
+
"alt",
|
|
231
|
+
"axis",
|
|
232
|
+
"border",
|
|
233
|
+
"cellpadding",
|
|
234
|
+
"cellspacing",
|
|
235
|
+
"char",
|
|
236
|
+
"charoff",
|
|
237
|
+
"charset",
|
|
238
|
+
"checked",
|
|
239
|
+
"cite",
|
|
240
|
+
"class",
|
|
241
|
+
"clear",
|
|
242
|
+
"color",
|
|
243
|
+
"cols",
|
|
244
|
+
"colspan",
|
|
245
|
+
"compact",
|
|
246
|
+
"contenteditable",
|
|
247
|
+
"coords",
|
|
248
|
+
"datetime",
|
|
249
|
+
"dir",
|
|
250
|
+
"disabled",
|
|
251
|
+
"enctype",
|
|
252
|
+
"for",
|
|
253
|
+
"frame",
|
|
254
|
+
"headers",
|
|
255
|
+
"height",
|
|
256
|
+
"href",
|
|
257
|
+
"hreflang",
|
|
258
|
+
"hspace",
|
|
259
|
+
"id",
|
|
260
|
+
"ismap",
|
|
261
|
+
"label",
|
|
262
|
+
"lang",
|
|
263
|
+
"longdesc",
|
|
264
|
+
"loop",
|
|
265
|
+
"loopcount",
|
|
266
|
+
"loopend",
|
|
267
|
+
"loopstart",
|
|
268
|
+
"maxlength",
|
|
269
|
+
"media",
|
|
270
|
+
"method",
|
|
271
|
+
"multiple",
|
|
272
|
+
"name",
|
|
273
|
+
"nohref",
|
|
274
|
+
"noshade",
|
|
275
|
+
"nowrap",
|
|
276
|
+
"poster",
|
|
277
|
+
"preload",
|
|
278
|
+
"prompt",
|
|
279
|
+
"readonly",
|
|
280
|
+
"rel",
|
|
281
|
+
"rev",
|
|
282
|
+
"rows",
|
|
283
|
+
"rowspan",
|
|
284
|
+
"rules",
|
|
285
|
+
"scope",
|
|
286
|
+
"selected",
|
|
287
|
+
"shape",
|
|
288
|
+
"size",
|
|
289
|
+
"span",
|
|
290
|
+
"src",
|
|
291
|
+
"start",
|
|
292
|
+
"style",
|
|
293
|
+
"summary",
|
|
294
|
+
"tabindex",
|
|
295
|
+
"target",
|
|
296
|
+
"title",
|
|
297
|
+
"type",
|
|
298
|
+
"usemap",
|
|
299
|
+
"valign",
|
|
300
|
+
"value",
|
|
301
|
+
"vspace",
|
|
302
|
+
"width",
|
|
303
|
+
"xml:lang",
|
|
304
|
+
])
|
|
305
|
+
|
|
306
|
+
MATHML_ATTRIBUTES = Set.new([
|
|
307
|
+
"actiontype",
|
|
308
|
+
"align",
|
|
309
|
+
"close",
|
|
310
|
+
"columnalign",
|
|
311
|
+
"columnlines",
|
|
312
|
+
"columnspacing",
|
|
313
|
+
"columnspan",
|
|
314
|
+
"depth",
|
|
315
|
+
"display",
|
|
316
|
+
"displaystyle",
|
|
317
|
+
"encoding",
|
|
318
|
+
"equalcolumns",
|
|
319
|
+
"equalrows",
|
|
320
|
+
"fence",
|
|
321
|
+
"fontstyle",
|
|
322
|
+
"fontweight",
|
|
323
|
+
"frame",
|
|
324
|
+
"height",
|
|
325
|
+
"linethickness",
|
|
326
|
+
"lspace",
|
|
327
|
+
"mathbackground",
|
|
328
|
+
"mathcolor",
|
|
329
|
+
"mathvariant",
|
|
330
|
+
"maxsize",
|
|
331
|
+
"minsize",
|
|
332
|
+
"open",
|
|
333
|
+
"other",
|
|
334
|
+
"rowalign",
|
|
335
|
+
"rowlines",
|
|
336
|
+
"rowspacing",
|
|
337
|
+
"rowspan",
|
|
338
|
+
"rspace",
|
|
339
|
+
"scriptlevel",
|
|
340
|
+
"selection",
|
|
341
|
+
"separator",
|
|
342
|
+
"separators",
|
|
343
|
+
"stretchy",
|
|
344
|
+
"width",
|
|
345
|
+
"xlink:href",
|
|
346
|
+
"xlink:show",
|
|
347
|
+
"xlink:type",
|
|
348
|
+
"xmlns",
|
|
349
|
+
"xmlns:xlink",
|
|
350
|
+
])
|
|
351
|
+
|
|
352
|
+
SVG_ATTRIBUTES = Set.new([
|
|
353
|
+
"accent-height",
|
|
354
|
+
"accumulate",
|
|
355
|
+
"additive",
|
|
356
|
+
"alphabetic",
|
|
357
|
+
"arabic-form",
|
|
358
|
+
"ascent",
|
|
359
|
+
"attributeName",
|
|
360
|
+
"attributeType",
|
|
361
|
+
"baseProfile",
|
|
362
|
+
"bbox",
|
|
363
|
+
"begin",
|
|
364
|
+
"calcMode",
|
|
365
|
+
"cap-height",
|
|
366
|
+
"class",
|
|
367
|
+
"clip-path",
|
|
368
|
+
"clip-rule",
|
|
369
|
+
"color",
|
|
370
|
+
"color-interpolation-filters",
|
|
371
|
+
"color-rendering",
|
|
372
|
+
"content",
|
|
373
|
+
"cx",
|
|
374
|
+
"cy",
|
|
375
|
+
"d",
|
|
376
|
+
"descent",
|
|
377
|
+
"display",
|
|
378
|
+
"dur",
|
|
379
|
+
"dx",
|
|
380
|
+
"dy",
|
|
381
|
+
"end",
|
|
382
|
+
"fill",
|
|
383
|
+
"fill-opacity",
|
|
384
|
+
"fill-rule",
|
|
385
|
+
"filterRes",
|
|
386
|
+
"filterUnits",
|
|
387
|
+
"font-family",
|
|
388
|
+
"font-size",
|
|
389
|
+
"font-stretch",
|
|
390
|
+
"font-style",
|
|
391
|
+
"font-variant",
|
|
392
|
+
"font-weight",
|
|
393
|
+
"fx",
|
|
394
|
+
"fy",
|
|
395
|
+
"g1",
|
|
396
|
+
"g2",
|
|
397
|
+
"glyph-name",
|
|
398
|
+
"gradientUnits",
|
|
399
|
+
"hanging",
|
|
400
|
+
"height",
|
|
401
|
+
"horiz-adv-x",
|
|
402
|
+
"horiz-origin-x",
|
|
403
|
+
"id",
|
|
404
|
+
"ideographic",
|
|
405
|
+
"k",
|
|
406
|
+
"keyPoints",
|
|
407
|
+
"keySplines",
|
|
408
|
+
"keyTimes",
|
|
409
|
+
"lang",
|
|
410
|
+
"marker-end",
|
|
411
|
+
"marker-mid",
|
|
412
|
+
"marker-start",
|
|
413
|
+
"markerHeight",
|
|
414
|
+
"markerUnits",
|
|
415
|
+
"markerWidth",
|
|
416
|
+
"maskContentUnits",
|
|
417
|
+
"maskUnits",
|
|
418
|
+
"mathematical",
|
|
419
|
+
"max",
|
|
420
|
+
"method",
|
|
421
|
+
"min",
|
|
422
|
+
"name",
|
|
423
|
+
"offset",
|
|
424
|
+
"opacity",
|
|
425
|
+
"orient",
|
|
426
|
+
"origin",
|
|
427
|
+
"overline-position",
|
|
428
|
+
"overline-thickness",
|
|
429
|
+
"panose-1",
|
|
430
|
+
"path",
|
|
431
|
+
"pathLength",
|
|
432
|
+
"patternContentUnits",
|
|
433
|
+
"patternTransform",
|
|
434
|
+
"patternUnits",
|
|
435
|
+
"points",
|
|
436
|
+
"preserveAspectRatio",
|
|
437
|
+
"primitiveUnits",
|
|
438
|
+
"r",
|
|
439
|
+
"refX",
|
|
440
|
+
"refY",
|
|
441
|
+
"repeatCount",
|
|
442
|
+
"repeatDur",
|
|
443
|
+
"requiredExtensions",
|
|
444
|
+
"requiredFeatures",
|
|
445
|
+
"restart",
|
|
446
|
+
"rotate",
|
|
447
|
+
"rx",
|
|
448
|
+
"ry",
|
|
449
|
+
"slope",
|
|
450
|
+
"spacing",
|
|
451
|
+
"startOffset",
|
|
452
|
+
"stdDeviation",
|
|
453
|
+
"stemh",
|
|
454
|
+
"stemv",
|
|
455
|
+
"stop-color",
|
|
456
|
+
"stop-opacity",
|
|
457
|
+
"strikethrough-position",
|
|
458
|
+
"strikethrough-thickness",
|
|
459
|
+
"stroke",
|
|
460
|
+
"stroke-dasharray",
|
|
461
|
+
"stroke-dashoffset",
|
|
462
|
+
"stroke-linecap",
|
|
463
|
+
"stroke-linejoin",
|
|
464
|
+
"stroke-miterlimit",
|
|
465
|
+
"stroke-opacity",
|
|
466
|
+
"stroke-width",
|
|
467
|
+
"systemLanguage",
|
|
468
|
+
"target",
|
|
469
|
+
"text-anchor",
|
|
470
|
+
"transform",
|
|
471
|
+
"type",
|
|
472
|
+
"u1",
|
|
473
|
+
"u2",
|
|
474
|
+
"underline-position",
|
|
475
|
+
"underline-thickness",
|
|
476
|
+
"unicode",
|
|
477
|
+
"unicode-range",
|
|
478
|
+
"units-per-em",
|
|
479
|
+
"version",
|
|
480
|
+
"viewBox",
|
|
481
|
+
"visibility",
|
|
482
|
+
"width",
|
|
483
|
+
"widths",
|
|
484
|
+
"x",
|
|
485
|
+
"x-height",
|
|
486
|
+
"x1",
|
|
487
|
+
"x2",
|
|
488
|
+
"xlink:actuate",
|
|
489
|
+
"xlink:arcrole",
|
|
490
|
+
"xlink:href",
|
|
491
|
+
"xlink:role",
|
|
492
|
+
"xlink:show",
|
|
493
|
+
"xlink:title",
|
|
494
|
+
"xlink:type",
|
|
495
|
+
"xml:base",
|
|
496
|
+
"xml:lang",
|
|
497
|
+
"xml:space",
|
|
498
|
+
"xmlns",
|
|
499
|
+
"xmlns:xlink",
|
|
500
|
+
"y",
|
|
501
|
+
"y1",
|
|
502
|
+
"y2",
|
|
503
|
+
"zoomAndPan",
|
|
504
|
+
])
|
|
505
|
+
|
|
506
|
+
ATTR_VAL_IS_URI = Set.new([
|
|
507
|
+
"action",
|
|
508
|
+
"cite",
|
|
509
|
+
"href",
|
|
510
|
+
"longdesc",
|
|
511
|
+
"poster",
|
|
512
|
+
"preload",
|
|
513
|
+
"src",
|
|
514
|
+
"xlink:href",
|
|
515
|
+
"xml:base",
|
|
516
|
+
])
|
|
517
|
+
|
|
518
|
+
SVG_ATTR_VAL_ALLOWS_REF = Set.new([
|
|
519
|
+
"clip-path",
|
|
520
|
+
"color-profile",
|
|
521
|
+
"cursor",
|
|
522
|
+
"fill",
|
|
523
|
+
"filter",
|
|
524
|
+
"marker",
|
|
525
|
+
"marker-end",
|
|
526
|
+
"marker-mid",
|
|
527
|
+
"marker-start",
|
|
528
|
+
"mask",
|
|
529
|
+
"stroke",
|
|
530
|
+
])
|
|
531
|
+
|
|
532
|
+
SVG_ALLOW_LOCAL_HREF = Set.new([
|
|
533
|
+
"altGlyph",
|
|
534
|
+
"animate",
|
|
535
|
+
"animateColor",
|
|
536
|
+
"animateMotion",
|
|
537
|
+
"animateTransform",
|
|
538
|
+
"cursor",
|
|
539
|
+
"feImage",
|
|
540
|
+
"filter",
|
|
541
|
+
"linearGradient",
|
|
542
|
+
"pattern",
|
|
543
|
+
"radialGradient",
|
|
544
|
+
"set",
|
|
545
|
+
"textpath",
|
|
546
|
+
"tref",
|
|
547
|
+
"use",
|
|
548
|
+
])
|
|
549
|
+
|
|
550
|
+
ACCEPTABLE_CSS_PROPERTIES = Set.new([
|
|
551
|
+
"azimuth",
|
|
552
|
+
"align-content",
|
|
553
|
+
"align-items",
|
|
554
|
+
"align-self",
|
|
555
|
+
"background-color",
|
|
556
|
+
"border-bottom-color",
|
|
557
|
+
"border-collapse",
|
|
558
|
+
"border-color",
|
|
559
|
+
"border-left-color",
|
|
560
|
+
"border-right-color",
|
|
561
|
+
"border-top-color",
|
|
562
|
+
"clear",
|
|
563
|
+
"color",
|
|
564
|
+
"cursor",
|
|
565
|
+
"direction",
|
|
566
|
+
"display",
|
|
567
|
+
"elevation",
|
|
568
|
+
"flex",
|
|
569
|
+
"flex-basis",
|
|
570
|
+
"flex-direction",
|
|
571
|
+
"flex-flow",
|
|
572
|
+
"flex-grow",
|
|
573
|
+
"flex-shrink",
|
|
574
|
+
"flex-wrap",
|
|
575
|
+
"float",
|
|
576
|
+
"font",
|
|
577
|
+
"font-family",
|
|
578
|
+
"font-size",
|
|
579
|
+
"font-style",
|
|
580
|
+
"font-variant",
|
|
581
|
+
"font-weight",
|
|
582
|
+
"height",
|
|
583
|
+
"justify-content",
|
|
584
|
+
"letter-spacing",
|
|
585
|
+
"line-height",
|
|
586
|
+
"list-style",
|
|
587
|
+
"list-style-type",
|
|
588
|
+
"max-width",
|
|
589
|
+
"order",
|
|
590
|
+
"overflow",
|
|
591
|
+
"page-break-after",
|
|
592
|
+
"page-break-before",
|
|
593
|
+
"page-break-inside",
|
|
594
|
+
"pause",
|
|
595
|
+
"pause-after",
|
|
596
|
+
"pause-before",
|
|
597
|
+
"pitch",
|
|
598
|
+
"pitch-range",
|
|
599
|
+
"richness",
|
|
600
|
+
"speak",
|
|
601
|
+
"speak-header",
|
|
602
|
+
"speak-numeral",
|
|
603
|
+
"speak-punctuation",
|
|
604
|
+
"speech-rate",
|
|
605
|
+
"stress",
|
|
606
|
+
"text-align",
|
|
607
|
+
"text-decoration",
|
|
608
|
+
"text-indent",
|
|
609
|
+
"unicode-bidi",
|
|
610
|
+
"vertical-align",
|
|
611
|
+
"voice-family",
|
|
612
|
+
"volume",
|
|
613
|
+
"white-space",
|
|
614
|
+
"width",
|
|
615
|
+
])
|
|
616
|
+
|
|
617
|
+
ACCEPTABLE_CSS_KEYWORDS = Set.new([
|
|
618
|
+
"!important",
|
|
619
|
+
"aqua",
|
|
620
|
+
"auto",
|
|
621
|
+
"black",
|
|
622
|
+
"block",
|
|
623
|
+
"blue",
|
|
624
|
+
"bold",
|
|
625
|
+
"both",
|
|
626
|
+
"bottom",
|
|
627
|
+
"brown",
|
|
628
|
+
"center",
|
|
629
|
+
"collapse",
|
|
630
|
+
"dashed",
|
|
631
|
+
"dotted",
|
|
632
|
+
"double",
|
|
633
|
+
"fuchsia",
|
|
634
|
+
"gray",
|
|
635
|
+
"green",
|
|
636
|
+
"groove",
|
|
637
|
+
"hidden",
|
|
638
|
+
"inset",
|
|
639
|
+
"italic",
|
|
640
|
+
"left",
|
|
641
|
+
"lime",
|
|
642
|
+
"maroon",
|
|
643
|
+
"medium",
|
|
644
|
+
"navy",
|
|
645
|
+
"none",
|
|
646
|
+
"normal",
|
|
647
|
+
"nowrap",
|
|
648
|
+
"olive",
|
|
649
|
+
"outset",
|
|
650
|
+
"pointer",
|
|
651
|
+
"purple",
|
|
652
|
+
"red",
|
|
653
|
+
"ridge",
|
|
654
|
+
"right",
|
|
655
|
+
"silver",
|
|
656
|
+
"solid",
|
|
657
|
+
"teal",
|
|
658
|
+
"thin",
|
|
659
|
+
"thick",
|
|
660
|
+
"top",
|
|
661
|
+
"transparent",
|
|
662
|
+
"underline",
|
|
663
|
+
"white",
|
|
664
|
+
"yellow",
|
|
665
|
+
])
|
|
666
|
+
|
|
667
|
+
# see https://www.quackit.com/css/functions/
|
|
668
|
+
# omit `url` and `image` from that list
|
|
669
|
+
ACCEPTABLE_CSS_FUNCTIONS = Set.new([
|
|
670
|
+
"attr",
|
|
671
|
+
"blur",
|
|
672
|
+
"brightness",
|
|
673
|
+
"calc",
|
|
674
|
+
"circle",
|
|
675
|
+
"contrast",
|
|
676
|
+
"counter",
|
|
677
|
+
"counters",
|
|
678
|
+
"cubic-bezier",
|
|
679
|
+
"drop-shadow",
|
|
680
|
+
"ellipse",
|
|
681
|
+
"grayscale",
|
|
682
|
+
"hsl",
|
|
683
|
+
"hsla",
|
|
684
|
+
"hue-rotate",
|
|
685
|
+
"hwb",
|
|
686
|
+
"inset",
|
|
687
|
+
"invert",
|
|
688
|
+
"linear-gradient",
|
|
689
|
+
"matrix",
|
|
690
|
+
"matrix3d",
|
|
691
|
+
"opacity",
|
|
692
|
+
"perspective",
|
|
693
|
+
"polygon",
|
|
694
|
+
"radial-gradient",
|
|
695
|
+
"repeating-linear-gradient",
|
|
696
|
+
"repeating-radial-gradient",
|
|
697
|
+
"rgb",
|
|
698
|
+
"rgba",
|
|
699
|
+
"rotate",
|
|
700
|
+
"rotate3d",
|
|
701
|
+
"rotateX",
|
|
702
|
+
"rotateY",
|
|
703
|
+
"rotateZ",
|
|
704
|
+
"saturate",
|
|
705
|
+
"sepia",
|
|
706
|
+
"scale",
|
|
707
|
+
"scale3d",
|
|
708
|
+
"scaleX",
|
|
709
|
+
"scaleY",
|
|
710
|
+
"scaleZ",
|
|
711
|
+
"skew",
|
|
712
|
+
"skewX",
|
|
713
|
+
"skewY",
|
|
714
|
+
"symbols",
|
|
715
|
+
"translate",
|
|
716
|
+
"translate3d",
|
|
717
|
+
"translateX",
|
|
718
|
+
"translateY",
|
|
719
|
+
"translateZ",
|
|
720
|
+
])
|
|
721
|
+
|
|
722
|
+
SHORTHAND_CSS_PROPERTIES = Set.new([
|
|
723
|
+
"background",
|
|
724
|
+
"border",
|
|
725
|
+
"margin",
|
|
726
|
+
"padding",
|
|
727
|
+
])
|
|
728
|
+
|
|
729
|
+
ACCEPTABLE_SVG_PROPERTIES = Set.new([
|
|
730
|
+
"fill",
|
|
731
|
+
"fill-opacity",
|
|
732
|
+
"fill-rule",
|
|
733
|
+
"stroke",
|
|
734
|
+
"stroke-width",
|
|
735
|
+
"stroke-linecap",
|
|
736
|
+
"stroke-linejoin",
|
|
737
|
+
"stroke-opacity",
|
|
738
|
+
])
|
|
739
|
+
|
|
740
|
+
PROTOCOL_SEPARATOR = /:|(�*58)|(p)|(�*3a)|(%|%)3A/i
|
|
741
|
+
|
|
742
|
+
ACCEPTABLE_PROTOCOLS = Set.new([
|
|
743
|
+
"afs",
|
|
744
|
+
"aim",
|
|
745
|
+
"callto",
|
|
746
|
+
"data",
|
|
747
|
+
"ed2k",
|
|
748
|
+
"feed",
|
|
749
|
+
"ftp",
|
|
750
|
+
"gopher",
|
|
751
|
+
"http",
|
|
752
|
+
"https",
|
|
753
|
+
"irc",
|
|
754
|
+
"line",
|
|
755
|
+
"mailto",
|
|
756
|
+
"news",
|
|
757
|
+
"nntp",
|
|
758
|
+
"rsync",
|
|
759
|
+
"rtsp",
|
|
760
|
+
"sftp",
|
|
761
|
+
"ssh",
|
|
762
|
+
"tag",
|
|
763
|
+
"tel",
|
|
764
|
+
"telnet",
|
|
765
|
+
"urn",
|
|
766
|
+
"webcal",
|
|
767
|
+
"xmpp",
|
|
768
|
+
])
|
|
769
|
+
|
|
770
|
+
ACCEPTABLE_URI_DATA_MEDIATYPES = Set.new([
|
|
771
|
+
"image/gif",
|
|
772
|
+
"image/jpeg",
|
|
773
|
+
"image/png",
|
|
774
|
+
"image/svg+xml",
|
|
775
|
+
"text/css",
|
|
776
|
+
"text/plain",
|
|
777
|
+
])
|
|
778
|
+
|
|
779
|
+
# subclasses may define their own versions of these constants
|
|
780
|
+
ALLOWED_ELEMENTS = ACCEPTABLE_ELEMENTS + MATHML_ELEMENTS + SVG_ELEMENTS
|
|
781
|
+
ALLOWED_ATTRIBUTES = ACCEPTABLE_ATTRIBUTES + MATHML_ATTRIBUTES + SVG_ATTRIBUTES
|
|
782
|
+
ALLOWED_CSS_PROPERTIES = ACCEPTABLE_CSS_PROPERTIES
|
|
783
|
+
ALLOWED_CSS_KEYWORDS = ACCEPTABLE_CSS_KEYWORDS
|
|
784
|
+
ALLOWED_CSS_FUNCTIONS = ACCEPTABLE_CSS_FUNCTIONS
|
|
785
|
+
ALLOWED_SVG_PROPERTIES = ACCEPTABLE_SVG_PROPERTIES
|
|
786
|
+
ALLOWED_PROTOCOLS = ACCEPTABLE_PROTOCOLS
|
|
787
|
+
ALLOWED_URI_DATA_MEDIATYPES = ACCEPTABLE_URI_DATA_MEDIATYPES
|
|
788
|
+
|
|
789
|
+
VOID_ELEMENTS = Set.new([
|
|
790
|
+
"area",
|
|
791
|
+
"base",
|
|
792
|
+
"br",
|
|
793
|
+
"col",
|
|
794
|
+
"embed",
|
|
795
|
+
"hr",
|
|
796
|
+
"img",
|
|
797
|
+
"input",
|
|
798
|
+
"link",
|
|
799
|
+
"meta",
|
|
800
|
+
"param",
|
|
801
|
+
])
|
|
802
|
+
|
|
803
|
+
# additional tags we should consider safe since we have libxml2 fixing up our documents.
|
|
804
|
+
TAGS_SAFE_WITH_LIBXML2 = Set.new([
|
|
805
|
+
"body",
|
|
806
|
+
"head",
|
|
807
|
+
"html",
|
|
808
|
+
])
|
|
809
|
+
ALLOWED_ELEMENTS_WITH_LIBXML2 = ALLOWED_ELEMENTS + TAGS_SAFE_WITH_LIBXML2
|
|
810
|
+
end
|
|
811
|
+
|
|
812
|
+
WhiteList = SafeList
|
|
813
|
+
if Object.respond_to?(:deprecate_constant)
|
|
814
|
+
deprecate_constant :WhiteList
|
|
815
|
+
end
|
|
816
|
+
|
|
817
|
+
::Loofah::MetaHelpers.add_downcased_set_members_to_all_set_constants ::Loofah::HTML5::SafeList
|
|
818
|
+
end
|
|
819
|
+
end
|