montagejs / montage

Montage is an elegant, open source HTML5 framework maintained by Montage Studio that rivals native SDKs, yet is easier to learn. It offers modular components, two-way data binding, and much more. Join us on irc.freenode.net#montage. Sign up for our beta to build Montage applications in the cloud.
http://montagestudio.com/montagejs
Other
1.5k stars 215 forks source link

Fix HtmlFragment attribute removal #1998

Closed tejaede closed 5 years ago

tejaede commented 5 years ago

HtmlFragment#_sanitizeNode() failed to reset shouldRemoveAttribute when considering the next attribute in the attributes array. This caused all attributes after a removed attribute to be removed as well.

For example, src and title are allowed attributes and class is not. If the attributes array is ["src", "class", "title"], title would be removed because it comes after class. Similarly, if the array was ["class", "src", "title"], all 3 attributes would be removed.

marchant commented 5 years ago

LGTM!