allow !important in CSS styles

Author: mikesamuel

src/main/java/org/owasp/html/StylingPolicy.java

@@ -73,6 +73,7 @@ String sanitizeCssProperties(String style) {
  int propertyStart = 0;
  boolean hasTokens;
  boolean inQuotedIdents;
+ String lastToken = null;
 
  private void emitToken(String token) {
  closeQuotedIdents();
@@ -109,6 +110,7 @@ public void url(String token) {
  sanitizeAndAppendUrl(urlContent);
  }
  }
+ lastToken = token;
  }
 
  public void startProperty(String propertyName) {
@@ -134,6 +136,7 @@ public void startFunction(String uncanonToken) {
  if (cssProperty != CssSchema.DISALLOWED) {
  emitToken(token);
  }
+ lastToken = token;
  }
 
  public void quotedString(String token) {
@@ -156,6 +159,7 @@ && isAlphanumericOrSpace(token, 1, token.length() - 1)) {
  sanitizeAndAppendUrl(CssGrammar.cssContent(token));
  }
  }
+ lastToken = token;
  }
 
  public void quantity(String token) {
@@ -166,20 +170,24 @@ public void quantity(String token) {
  || cssProperty.literals.contains(token)) {
  emitToken(token);
  }
+ lastToken = token;
  }
 
  public void punctuation(String token) {
  closeQuotedIdents();
  if (cssProperty.literals.contains(token)) {
  emitToken(token);
  }
+ lastToken = token;
  }
 
  private static final int IDENT_TO_STRING =
  CssSchema.BIT_UNRESERVED_WORD | CssSchema.BIT_STRING;
  public void identifier(String uncanonToken) {
  String token = Strings.toLowerCase(uncanonToken);
- if (cssProperty.literals.contains(token)) {
+ if ("!".equals(lastToken) && "important".equals(token)) {
+ emitToken("!important");
+ } else if (cssProperty.literals.contains(token)) {
  emitToken(token);
  } else if ((cssProperty.bits & IDENT_TO_STRING) == IDENT_TO_STRING) {
  if (!inQuotedIdents) {
@@ -192,13 +200,15 @@ public void identifier(String uncanonToken) {
  }
  sanitizedCss.append(Strings.toLowerCase(token));
  }
+ lastToken = token;
  }
 
  public void hash(String token) {
  closeQuotedIdents();
  if ((cssProperty.bits & CssSchema.BIT_HASH_VALUE) != 0) {
  emitToken(Strings.toLowerCase(token));
  }
+ lastToken = token;
  }
 
  public void endProperty() {
@@ -207,11 +217,13 @@ public void endProperty() {
  } else {
  closeQuotedIdents();
  }
+ lastToken = null;
  }
 
  public void endFunction(String token) {
  if (cssProperty != CssSchema.DISALLOWED) { emitToken(")"); }
  cssProperty = cssProperties.remove(cssProperties.size() - 1);
+ lastToken = ")";
  }
  });
  return sanitizedCss.length() == 0 ? null : sanitizedCss.toString();

src/test/java/org/owasp/html/StylingPolicyTest.java

@@ -317,6 +317,19 @@ public static final void testUrls() {
  "background-image: URL( \"foo.gif\" )");
  }
 
+ @Test
+ public static final void testImportant() {
+ assertSanitizedCss(
+ "color:blue !important",
+ "color:blue !important");
+ assertSanitizedCss(
+ "color:red !important",
+ "color:red ! IMPORTANT");
+ assertSanitizedCss(
+ "color:purple",
+ "color:purple !foo(bar) important");
+ }
+
  private static void assertSanitizedCss(
  @Nullable String expectedCss, String css) {
  StylingPolicy stylingPolicy = new StylingPolicy(