Unbreak CssSchema.withProperties(Map) (OWASP#313)

This method never worked before. Signed-off-by: Sven Strickroth <email@cs-ware.de>

Author: csware

src/main/java/org/owasp/html/CssSchema.java

@@ -164,15 +164,16 @@ public static CssSchema withProperties(
  Map<String, Property> propertyMap =
  new HashMap<>();
  // check that all fnKeys are defined in properties.
- for (Map.Entry<String, Property> e : propertyMap.entrySet()) {
+ for (Map.Entry<? extends String, ? extends Property> e : properties.entrySet()) {
  Property property = e.getValue();
  for (String fnKey : property.fnKeys.values()) {
- if (!propertyMap.containsKey(fnKey)) {
+ if (!properties.containsKey(fnKey)) {
  throw new IllegalArgumentException(
  "Property map is not self contained. " + e.getValue()
  + " depends on undefined function key " + fnKey);
  }
  }
+ propertyMap.put(e.getKey(), e.getValue());
  }
  return new CssSchema(Map.copyOf(propertyMap));
  }

src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java

@@ -29,8 +29,10 @@
 package org.owasp.html;
 
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
 import java.util.Locale;
+import java.util.Map;
 import java.util.Set;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
@@ -250,7 +252,31 @@ public void testSpecificStyleFilterung() {
  }
 
  @Test
- public void testUnionStyleFilterung() {
+ public void testCustomPropertyStyleFiltering() {
+ assertEquals(
+ Arrays.stream(new String[] {
+ "<h1>Header</h1>",
+ "<p>Paragraph 1</p>",
+ "<p>Click me out</p>",
+ "<p></p>",
+ "<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
+ "</p><p style=\"text-align:center\">Stylish Para 1</p>",
+ "<p>Stylish Para 2</p>",
+ ""}).collect(Collectors.joining("\n")),
+ apply(new HtmlPolicyBuilder()
+ .allowCommonInlineFormattingElements()
+ .allowCommonBlockElements()
+ .allowStyling(
+ CssSchema.withProperties(
+ Map.of("text-align",
+ new CssSchema.Property(0,
+ Set.of("center"),
+ Collections.emptyMap()))))
+ .allowStandardUrlProtocols()));
+ }
+
+ @Test
+ public void testUnionStyleFiltering() {
  assertEquals(
  Arrays.stream(new String[] {
  "<h1>Header</h1>",
@@ -271,6 +297,30 @@ public void testUnionStyleFilterung() {
  .allowStandardUrlProtocols()));
  }
 
+ @Test
+ public void testCustomPropertyStyleFilteringDisallowed() {
+ assertEquals(
+ Arrays.stream(new String[] {
+ "<h1>Header</h1>",
+ "<p>Paragraph 1</p>",
+ "<p>Click me out</p>",
+ "<p></p>",
+ "<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
+ "</p><p>Stylish Para 1</p>",
+ "<p>Stylish Para 2</p>",
+ ""}).collect(Collectors.joining("\n")),
+ apply(new HtmlPolicyBuilder()
+ .allowCommonInlineFormattingElements()
+ .allowCommonBlockElements()
+ .allowStyling(
+ CssSchema.withProperties(
+ Map.of("text-align",
+ new CssSchema.Property(0,
+ Set.of("left", "right"),
+ Collections.emptyMap()))))
+ .allowStandardUrlProtocols()));
+ }
+
  @Test
  public static final void testElementTransforming() {
  assertEquals(