Making Sanitize::stripScripts() to remove multi-line script and style…

… blocks. Fixes #657
cakephp · May 4, 2010 · ce10c85 · ce10c85
1 parent 95dbae8
commit ce10c85
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 1 deletion.
diff --git a/cake/libs/sanitize.php b/cake/libs/sanitize.php
@@ -156,7 +156,7 @@ function stripImages($str) {
  * @static
  */
 	function stripScripts($str) {
-		return preg_replace('/(<link[^>]+rel="[^"]*stylesheet"[^>]*>|<img[^>]*>|style="[^"]*")|<script[^>]*>.*?<\/script>|<style[^>]*>.*?<\/style>|<!--.*?-->/i', '', $str);
+		return preg_replace('/(<link[^>]+rel="[^"]*stylesheet"[^>]*>|<img[^>]*>|style="[^"]*")|<script[^>]*>.*?<\/script>|<style[^>]*>.*?<\/style>|<!--.*?-->/is', '', $str);
 	}
 
 /**

diff --git a/cake/tests/cases/libs/sanitize.test.php b/cake/tests/cases/libs/sanitize.test.php
@@ -346,6 +346,32 @@ function testStripScripts() {
 		$expected = '';
 		$result = Sanitize::stripScripts($string);
 		$this->assertEqual($result, $expected);
+
+		$string = <<<HTML
+text
+<style type="text/css">
+<!-- 
+#content { display:none; } 
+-->
+</style>
+text
+HTML;
+		$expected = "text\n\ntext";
+		$result = Sanitize::stripScripts($string);
+		$this->assertEqual($result, $expected);
+
+		$string = <<<HTML
+text
+<script type="text/javascript">
+<!-- 
+alert('wooo');
+-->
+</script>
+text
+HTML;
+		$expected = "text\n\ntext";
+		$result = Sanitize::stripScripts($string);
+		$this->assertEqual($result, $expected);
 	}
 
 /**