Permalink
Browse files

Making Sanitize::stripScripts() to remove multi-line script and style…

… blocks. Fixes #657
  • Loading branch information...
1 parent 95dbae8 commit ce10c85367d7f3d46094d4193c9a44a2119a0a42 @markstory markstory committed May 4, 2010
Showing with 27 additions and 1 deletion.
  1. +1 −1 cake/libs/sanitize.php
  2. +26 −0 cake/tests/cases/libs/sanitize.test.php
View
@@ -156,7 +156,7 @@ function stripImages($str) {
* @static
*/
function stripScripts($str) {
- return preg_replace('/(<link[^>]+rel="[^"]*stylesheet"[^>]*>|<img[^>]*>|style="[^"]*")|<script[^>]*>.*?<\/script>|<style[^>]*>.*?<\/style>|<!--.*?-->/i', '', $str);
+ return preg_replace('/(<link[^>]+rel="[^"]*stylesheet"[^>]*>|<img[^>]*>|style="[^"]*")|<script[^>]*>.*?<\/script>|<style[^>]*>.*?<\/style>|<!--.*?-->/is', '', $str);
}
/**
@@ -346,6 +346,32 @@ function testStripScripts() {
$expected = '';
$result = Sanitize::stripScripts($string);
$this->assertEqual($result, $expected);
+
+ $string = <<<HTML
+text
+<style type="text/css">
+<!--
+#content { display:none; }
+-->
+</style>
+text
+HTML;
+ $expected = "text\n\ntext";
+ $result = Sanitize::stripScripts($string);
+ $this->assertEqual($result, $expected);
+
+ $string = <<<HTML
+text
+<script type="text/javascript">
+<!--
+alert('wooo');
+-->
+</script>
+text
+HTML;
+ $expected = "text\n\ntext";
+ $result = Sanitize::stripScripts($string);
+ $this->assertEqual($result, $expected);
}
/**

0 comments on commit ce10c85

Please sign in to comment.