diff --git a/spec/lib/sanitize_spec.rb b/spec/lib/sanitize_spec.rb index 732874a9bef6..b37bcd3e0a93 100644 --- a/spec/lib/sanitize_spec.rb +++ b/spec/lib/sanitize_spec.rb @@ -74,6 +74,13 @@ res.should match(/width/) end + it "should allow negative values" do + str = "
" + res = Sanitize.clean(str, Instructure::SanitizeField::SANITIZE) + res.should match(/margin/) + res.should match(/height/) + end + it "should remove non-whitelisted css attributes" do str = "
" res = Sanitize.clean(str, Instructure::SanitizeField::SANITIZE) diff --git a/vendor/plugins/sanitize_field/lib/sanitize_field.rb b/vendor/plugins/sanitize_field/lib/sanitize_field.rb index 94c9362c8afc..882a3f555ec6 100644 --- a/vendor/plugins/sanitize_field/lib/sanitize_field.rb +++ b/vendor/plugins/sanitize_field/lib/sanitize_field.rb @@ -34,7 +34,7 @@ def self.sanitize_style(env) style = node['style'] || "" # taken from https://github.com/flavorjones/loofah/blob/master/lib/loofah/html5/scrub.rb # the gauntlet - style = '' unless style =~ /\A([:,\;#%.\(\)\/\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*\z/ + style = '' unless style =~ /\A([-:,\;#%.\(\)\/\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*\z/ style = '' unless style =~ /\A\s*([-\w]+\s*:[^\;]*(\;\s*|$))*\z/ config = env[:config]