Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: forbid <style> tags in DOMPurify config #1747

Merged
merged 2 commits into from
Nov 14, 2023
Merged

Conversation

abeatrix
Copy link
Contributor

Currently the <style> tag is breaking Cody as reported in https://sourcegraph.slack.com/archives/C03CSAER9LK/p1698893918877999:

This PR adds 'style' to the FORBID_TAGS array in the DOMPurify config to prevent style tags from being allowed.

Test plan

  1. Ask Cody :

Where is the styling defined for the code below?

<?xml version="1.0" encoding="utf-8"?>
<!-- Generator: Adobe Illustrator 27.5.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
	 viewBox="0 0 16 16" style="enable-background:new 0 0 16 16;" xml:space="preserve">
<style type="text/css">
	.st0{fill:none;stroke:#231F20;stroke-width:1.5;stroke-linecap:round;stroke-miterlimit:10;}
</style>
<path class="st0" d="M4,5.6h2.5"/>
<path class="st0" d="M11,3.8v2.5"/>
<path class="st0" d="M3.2,9.7c0,0,1.1,2.5,4.8,2.5s4.8-2.5,4.8-2.5"/>
</svg>

Before

image

After:

image

@abeatrix abeatrix requested review from kalanchan and a team November 14, 2023 21:53
@abeatrix abeatrix merged commit e899529 into main Nov 14, 2023
13 checks passed
@abeatrix abeatrix deleted the bee/block-style-tag branch November 14, 2023 22:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants