diff --git a/config/initializers/html_sanitizer.rb b/config/initializers/html_sanitizer.rb index f4e64ce86..0ee420b05 100644 --- a/config/initializers/html_sanitizer.rb +++ b/config/initializers/html_sanitizer.rb @@ -132,17 +132,22 @@ Rails.application.config.html_sanitizer_css_values_blocklist = { 'table' => [ 'font-size:0', 'font-size:0px', + 'font-size:0pt', 'font-size:0em', 'font-size:0%', + 'font-size:1', 'font-size:1px', + 'font-size:1pt', 'font-size:1em', 'font-size:1%', 'font-size:2', 'font-size:2px', + 'font-size:2pt', 'font-size:2em', 'font-size:2%', 'font-size:3', 'font-size:3px', + 'font-size:3pt', 'font-size:3em', 'font-size:3%', 'display:none', @@ -151,17 +156,22 @@ Rails.application.config.html_sanitizer_css_values_blocklist = { 'th' => [ 'font-size:0', 'font-size:0px', + 'font-size:0pt', 'font-size:0em', 'font-size:0%', + 'font-size:1', 'font-size:1px', + 'font-size:1pt', 'font-size:1em', 'font-size:1%', 'font-size:2', 'font-size:2px', + 'font-size:2pt', 'font-size:2em', 'font-size:2%', 'font-size:3', 'font-size:3px', + 'font-size:3pt', 'font-size:3em', 'font-size:3%', 'display:none', @@ -170,18 +180,22 @@ Rails.application.config.html_sanitizer_css_values_blocklist = { 'tr' => [ 'font-size:0', 'font-size:0px', + 'font-size:0pt', 'font-size:0em', 'font-size:0%', 'font-size:1', 'font-size:1px', + 'font-size:1pt', 'font-size:1em', 'font-size:1%', 'font-size:2', 'font-size:2px', + 'font-size:2pt', 'font-size:2em', 'font-size:2%', 'font-size:3', 'font-size:3px', + 'font-size:3pt', 'font-size:3em', 'font-size:3%', 'display:none', @@ -190,17 +204,22 @@ Rails.application.config.html_sanitizer_css_values_blocklist = { 'td' => [ 'font-size:0', 'font-size:0px', + 'font-size:0pt', 'font-size:0em', 'font-size:0%', + 'font-size:1', 'font-size:1px', + 'font-size:1pt', 'font-size:1em', 'font-size:1%', 'font-size:2', 'font-size:2px', + 'font-size:2pt', 'font-size:2em', 'font-size:2%', 'font-size:3', 'font-size:3px', + 'font-size:3pt', 'font-size:3em', 'font-size:3%', 'display:none', diff --git a/test/unit/html_sanitizer_test.rb b/test/unit/html_sanitizer_test.rb index 9ae2377d7..0b530ae42 100644 --- a/test/unit/html_sanitizer_test.rb +++ b/test/unit/html_sanitizer_test.rb @@ -134,6 +134,7 @@ test 123 abc') assert_equal(HtmlSanitizer.strict('
123
'), '
123
') assert_equal(HtmlSanitizer.strict('
123
'), '
123
') + assert_equal(HtmlSanitizer.strict('
123
'), '
123
') assert_equal(HtmlSanitizer.strict('
123
'), '
123
') assert_equal(HtmlSanitizer.strict('
123
'), '
123
') assert_equal(HtmlSanitizer.strict('
123
'), '
123
')