mganss / HtmlSanitizer

Cleans HTML to avoid XSS attacks
MIT License
1.52k stars 198 forks source link

Unexpected results in page rule #438

Closed HWouters closed 11 months ago

HWouters commented 1 year ago

If I sanitize the following html, I get an unexpected result.

var input= "<style>@page { margin: 25mm }</style>";

var sanitizer = new HtmlSanitizer
{
    AllowedTags = { "style" },
    AllowedAtRules = { CssRuleType.Page },
};

var output= sanitizer.Sanitize(input);

It replaces margin with <style>@page { margin-top: 25mm margin-right: 25mm margin-bottom: 25mm margin-left: 25mm }</style>, but the semicolons are misssing.

If I replace the input html with <style>@page { margin-top: 25mm; margin-right: 25mm; margin-bottom: 25mm; margin-left: 25mm }</style>, it still removes the semicolons.

Am I doing something wrong?

mganss commented 1 year ago

This seems to be an issue within AngleSharp. I have reported at https://github.com/AngleSharp/AngleSharp.Css/issues/135.

HWouters commented 1 year ago

@mganss, it looks like this issue is not within AngleSharp. Could it be an issue in AngleSharp.Css?

tiesont commented 1 year ago

@HWouters Yep, most likely. Really wish they had just migrated the issue to the correct repository.

HtmlSanitizer doesn't do any brackets or CSS parsing on it's own - it's AngleSharp one way or another that handles translating a string of markup to something that can be processed.

mganss commented 1 year ago

@HWouters I've asked them if they want to transfer the issue. If not, I'll open a new one in AngleSharp.Css.

HWouters commented 11 months ago

@mganss this seems to be fixed in AngelSharp.Css (https://github.com/AngleSharp/AngleSharp.Css/issues/135). Is there anything left in this repo to be fixed? Or is it a matter of releasing a new version?

mganss commented 11 months ago

@HWouters A new version of AngleSharp.Css that includes the fix needs to be released.

mganss commented 11 months ago

I've released 8.0.690-beta which depends on AngleSharp.Css 1.0.0-alpha-99 and AngleSharp 1.0.4.