Skip to content

Conversation

xmo-odoo
Copy link
Contributor

Matches what I understand of Bleach's CSSSanitizer: CSS properties are filtered by name and global.

A few notes:

  • Although CSS sanitization is not enabled by default (since rework how bleach.clean sanitizes css mozilla/bleach#633), Bleach provides a default set of properties, maybe this should do the same?
  • Much like bleach, when filtering is enabled the declarations will be "normalised" even if accepted as part of processing the declarations-list, for the most part this consists of removing malformed declarations as well as constructs which currently make no sense at the declaration level (e.g. at-rules are allowed by the grammar but there is currently no valid declaration-level at-rule, so they will be stripped).
  • Technically Bleach provides a more flexibility since rework how bleach.clean sanitizes css mozilla/bleach#633 as CSS sanitizers work off of a protocol. I'm not sure how useful this is (are there examples of people leveraging it?) so this initial version does not support it, but I think that could be added (even later on) by storing a Box<dyn CSSSanitizer>, implementing CSSSanitizer for HashSet<&str>, and having filter_style_properties take a T: CSSSanitizer and box it?

Matches what I understand of Bleach's `CSSSanitizer`: CSS properties
are filtered by name and global.

Fixes rust-ammonia#179
@notriddle notriddle merged commit 7b0aaf4 into rust-ammonia:master Oct 29, 2024
7 checks passed
@xmo-odoo xmo-odoo deleted the style-sanitizer branch October 30, 2024 06:56
@xmo-odoo xmo-odoo mentioned this pull request Feb 18, 2025
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants