Fixed allowAtributes("style").globally() (OWASP#218)

* allowAtributes("style") * Global style test

Author: aakritisi

src/main/java/org/owasp/html/HtmlPolicyBuilder.java

@@ -968,8 +968,12 @@ public AttributeBuilder matching(
  */
  @SuppressWarnings("synthetic-access")
  public HtmlPolicyBuilder globally() {
- return HtmlPolicyBuilder.this.allowAttributesGlobally(
- policy, attributeNames);
+ if(attributeNames.get(0).equals("style")) {
+ return allowStyling();
+ } else {
+ return HtmlPolicyBuilder.this.allowAttributesGlobally(
+ policy, attributeNames);
+ }
  }
 
  /**
@@ -1142,4 +1146,4 @@ final class AttributeGuardIntermediates {
  this.styleUrlPolicy = styleUrlPolicy;
  this.cssSchema = cssSchema;
  }
-}
+}

src/test/java/org/owasp/html/SanitizersTest.java

@@ -434,6 +434,17 @@ public static final void testStyleTagInTable() {
  pf.sanitize(input));
  }
 
+ @Test
+ public static final void testStyleGlobally() {
+ PolicyFactory policyBuilder = new HtmlPolicyBuilder()
+ .allowAttributes("style").globally()
+ .allowElements("a", "label", "h1", "h2", "h3", "h4", "h5", "h6")
+ .toFactory();
+ String input = "<h1 style=\"color:green ;name:user ;\">This is some green text</h1>";
+ String want = "<h1 style=\"color:green\">This is some green text</h1>";
+ assertEquals(want, policyBuilder.sanitize(input));
+ }
+ 
  static int fac(int n) {
  int ifac = 1;
  for (int i = 1; i <= n; ++i) {