Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Making Sanitize::stripScripts() to remove multi-line script and style…

… blocks. Fixes #657
  • Loading branch information...
commit ce10c85367d7f3d46094d4193c9a44a2119a0a42 1 parent 95dbae8
@markstory markstory authored
Showing with 27 additions and 1 deletion.
  1. +1 −1  cake/libs/sanitize.php
  2. +26 −0 cake/tests/cases/libs/sanitize.test.php
View
2  cake/libs/sanitize.php
@@ -156,7 +156,7 @@ function stripImages($str) {
* @static
*/
function stripScripts($str) {
- return preg_replace('/(<link[^>]+rel="[^"]*stylesheet"[^>]*>|<img[^>]*>|style="[^"]*")|<script[^>]*>.*?<\/script>|<style[^>]*>.*?<\/style>|<!--.*?-->/i', '', $str);
+ return preg_replace('/(<link[^>]+rel="[^"]*stylesheet"[^>]*>|<img[^>]*>|style="[^"]*")|<script[^>]*>.*?<\/script>|<style[^>]*>.*?<\/style>|<!--.*?-->/is', '', $str);
}
/**
View
26 cake/tests/cases/libs/sanitize.test.php
@@ -346,6 +346,32 @@ function testStripScripts() {
$expected = '';
$result = Sanitize::stripScripts($string);
$this->assertEqual($result, $expected);
+
+ $string = <<<HTML
+text
+<style type="text/css">
+<!--
+#content { display:none; }
+-->
+</style>
+text
+HTML;
+ $expected = "text\n\ntext";
+ $result = Sanitize::stripScripts($string);
+ $this->assertEqual($result, $expected);
+
+ $string = <<<HTML
+text
+<script type="text/javascript">
+<!--
+alert('wooo');
+-->
+</script>
+text
+HTML;
+ $expected = "text\n\ntext";
+ $result = Sanitize::stripScripts($string);
+ $this->assertEqual($result, $expected);
}
/**
Please sign in to comment.
Something went wrong with that request. Please try again.