deac/instiki
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Better handling of SVG attributes which admit uri refs

Browse source 
Just strip out the URI ref, leaving alternates.
This commit is contained in:
Jacques Distler 2007-10-27 23:08:13 -05:00
parent 5208bbf0af
commit f24c60c3fb
2 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

6
vendor/plugins/HTML5lib/lib/html5/sanitizer.rb vendored
View file

@ -123,9 +123,9 @@ module HTML5
if val_unescaped =~ /^[a-z0-9][-+.a-z0-9]*:/ and !self.class.const_get("ALLOWED_PROTOCOLS").include?(val_unescaped.split(':')[0])
attrs.delete attr
end
SVG_ATTR_VAL_ALLOWS_REF.each do |attr|
attrs.delete attr if attrs[attr].to_s.downcase =~ /url\(\s*[^#]/m
end
end
SVG_ATTR_VAL_ALLOWS_REF.each do |attr|
attrs[attr] = attrs[attr].to_s.gsub(/url\s*\(\s*[^#\s][^)]+?\)/m, ' ') if attrs[attr]
end
if attrs['style']
attrs['style'] = sanitize_css(attrs['style'])