OWASP / java-html-sanitizer

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.
Other
834 stars 209 forks source link

Sanitizer converting font names in 'style' attribute value to lower case #289

Open anupbhore opened 10 months ago

anupbhore commented 10 months ago

HTML sanitizer is converting the font names in 'style' attribute of HTML element to lower case. This results in content rendered not using right font.

Sample Input : <p><span style="font-family:Times New Roman,Times,serif;">fourth line</span></p> Expected Output: <p><span style="font-family:'Times New Roman' , 'Times' , serif">fourth line</span></p> Actual output : <p><span style="font-family:'times new roman' , 'times' , serif">fourth line</span></p>

Use following code to reproduce : public void testLowerCasingOfFont() { String text = "<p><span style=\"font-family:Times New Roman,Times,serif;\">text</span></p>"; String output = new HtmlPolicyBuilder().allowStyling().allowElements("p", "span").allowAttributes("style").onElements( "p").toFactory().sanitize(text); System.out.println(output); }