diff --git a/modules/markup/sanitizer.go b/modules/markup/sanitizer.go index 388af5671..57e88fdab 100644 --- a/modules/markup/sanitizer.go +++ b/modules/markup/sanitizer.go @@ -85,6 +85,12 @@ func createDefaultPolicy() *bluemonday.Policy { // Allow icons, emojis, chroma syntax and keyword markup on span policy.AllowAttrs("class").Matching(regexp.MustCompile(`^((icon(\s+[\p{L}\p{N}_-]+)+)|(emoji))$|^([a-z][a-z0-9]{0,2})$|^` + keywordClass + `$`)).OnElements("span") + // Allow 'style' attribute on text elements. + policy.AllowAttrs("style").OnElements("span", "p") + + // Allow 'color' property for the style attribute on text elements. + policy.AllowStyles("color").OnElements("span", "p") + // Allow generally safe attributes generalSafeAttrs := []string{ "abbr", "accept", "accept-charset", diff --git a/modules/markup/sanitizer_test.go b/modules/markup/sanitizer_test.go index 7dfca7a46..b3b07404b 100644 --- a/modules/markup/sanitizer_test.go +++ b/modules/markup/sanitizer_test.go @@ -45,6 +45,14 @@ func Test_Sanitizer(t *testing.T) { `unchecked`, `unchecked`, `NAUGHTY`, `NAUGHTY`, `contents`, `contents`, + + // Color property + `Hello World`, `Hello World`, + `
Hello World
`, `Hello World
`, + `Hello World
`, `Hello World
`,
+ `Hello World`, `Hello World`,
+ `Hello World
`, `Hello World
`, + `Hello World
`, `Hello World
`,
}
for i := 0; i < len(testCases); i += 2 {