Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Valid font shorthand is filtered #554

Open
jonah1und1 opened this issue Feb 5, 2025 · 1 comment
Open

Valid font shorthand is filtered #554

jonah1und1 opened this issue Feb 5, 2025 · 1 comment

Comments

@jonah1und1
Copy link
Contributor

jonah1und1 commented Feb 5, 2025 •
edited
Loading

Antisamy seems to filter out a valid inline font shorthand if font-size and line-height are defined using the / syntax.

Expected behaviour
Given the default policy, the following inline style should not be filtered:

<p style="font: 12pt/14pt sans-serif">test</p>

Current behaviour
Scanning this inline style results in it getting removed and Antisamy stating:

The p tag had a style attribute, "font", that could not be allowed for security reasons.

Possible fix
The method :

CssValidator#lexicalValueToString(LexicalUnit lu)

is missing an entry for LexicalUnit.SAC_OPERATOR_SLASH, which seems to cause this bug.
I've created a PR to address this issue: #555.
Please feel free to review.
Thank you!
jonah1und1 added a commit to jonah1und1/antisamy that referenced this issue Feb 5, 2025
@jonah1und1
fix(nahsragh-554): add case for LexicalUnit.SAC_OPERATOR_SLASH in Css…
c4f596e 
…Validator to fix font shorthand parsing
@jonah1und1 jonah1und1 mentioned this issue Feb 5, 2025
Merged
@davewichers
Copy link
Collaborator

@spassarop - Can you look at this issue and the PR too?

jonah1und1 added a commit to jonah1und1/antisamy that referenced this issue Feb 19, 2025
@jonah1und1
Merge branch 'main' into nahsragh-554
6f2af66 
# Conflicts:
#	src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
davewichers pushed a commit that referenced this issue Feb 19, 2025
@jonah1und1
fix(gh-554): add case for LexicalUnit.SAC_OPERATOR_SLASH in CssValida…
9c1cd61 
…tor to fix font shorthand parsing (#555)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@davewichers @jonah1und1