Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Quotes on quoted url on background-image from IE9 gets encoded instead of replaced #48

Closed
brunomlopes opened this issue Oct 29, 2015 · 3 comments

Comments

@brunomlopes
Copy link

I'm not 100% sure this is a bug, but it's an issue we've faced.
When inserting a background-image style attribute on IE9, the browser always quotes it with double quotes (").
However, when sanitizing, double quotes get translated into single quotes, and the single quotes on background-image get encoded.

Here's a test case:

        [Test]
        public void QuotedBackgroundImageFromIE9()
        {
            // Arrange
            var s = new HtmlSanitizer();

            // Act
            var htmlFragment = "<span style='background-image: url(\"/api/users/defaultAvatar\");'></span>";
            var actual = s.Sanitize(htmlFragment);

            // Assert
            var expected = "<span style=\"background-image: url('/api/users/defaultAvatar')\"></span>";
            Assert.That(actual, Is.EqualTo(expected).IgnoreCase);
        }

I was able to work around this, and will be improving the solution to avoid false matches, but it doesn't feel right:

            s.PostProcessNode +=
                (sender, args) =>
                {
                    if (!args.Node.HasStyle("background-image")) return;
                    args.Node.Style["background-image"] =
                        args.Node.Style["background-image"].Replace("url(%22", "url('").Replace("%22)", "')");
                };

Opinions?

@304NotModified
Copy link
Contributor

I think this is a bug.

@mganss mganss closed this as completed in 41de103 Oct 30, 2015
@mganss
Copy link
Owner

mganss commented Oct 30, 2015

Yes, this bug was introduced when #44 was (improperly) fixed. Sorry.

@304NotModified
Copy link
Contributor

Respect for the quick fix :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants