OWASP / java-html-sanitizer

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.
Other
843 stars 213 forks source link

text-decoration properties not supported #228

Open myin142 opened 3 years ago

myin142 commented 3 years ago

It seems like other text-decoration properties are not supported, like text-decoration-line or text-decoration-color. I am using the default CssSchema with common blocks and inline formatting.

new HtmlPolicyBuilder()
    .allowCommonBlockElements()
    .allowCommonInlineFormattingElements()
    .allowStyling()

When sanitizing this HTML, the tag will be removed because the style is not supported.

<span style="text-decoration-line: line-through;">Strikethrough</span>

I think at least text-decoration-line should be supported. Because when someone copies HTML with text-decoration: line-through it gets converted to text-decoration-line: line-through when pasting to an input field. But based on my testing, it happens only from Chrome -> Chrome. If using Firefox on any side, it does not seem to get converted.

huytg1612 commented 9 months ago

Helpful, thanks you!!!