Fix : Support xxx-large and medium css font-size values. (#294)

* Fix : Support xxx-large and medium css font-size https://developer.mozilla.org/en-US/docs/Web/CSS/font-size xxx-large and medium are valid font-size values. * Test : Add tests related to xxx-large and medium font-size CSS * Added spaces between list items --------- Co-authored-by: Mike Samuel <[email protected]>
OWASP · Jan 9, 2024 · 5b420f9 · 5b420f9
1 parent 35c506c
commit 5b420f9
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 1 deletion.
diff --git a/src/main/java/org/owasp/html/CssSchema.java b/src/main/java/org/owasp/html/CssSchema.java
@@ -383,7 +383,7 @@ Property forKey(String propertyName) {
         "bolder", "lighter");
     ImmutableSet<String> fontLiterals1 = ImmutableSet.of(
         "large", "larger", "small", "smaller", "x-large", "x-small",
-        "xx-large", "xx-small");
+        "xx-large", "xx-small", "xxx-large", "medium");
     ImmutableSet<String> fontLiterals2 = ImmutableSet.of(
         "caption", "icon", "menu", "message-box", "small-caption",
         "status-bar");

diff --git a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
@@ -994,6 +994,20 @@ public static final void testTextareaIsNotTextArea() {
     assertEquals("x<textArea>y</textArea>", textAreaPolicy.sanitize(input));
   }
 
+   @Test
+  public static final void testCSSFontSize() {
+	 HtmlPolicyBuilder builder = new HtmlPolicyBuilder();
+ 	 PolicyFactory factory = builder.allowElements("span")
+ 	 .allowAttributes("style").onElements("span").allowStyling()
+ 	.toFactory();
+ 	 String toSanitizeXXXLarge = "the <span style=\"font-size:xxx-large\">large</span> formatting issue with chrome";
+ 	 assertEquals(toSanitizeXXXLarge, factory.sanitize(toSanitizeXXXLarge)); 
+
+ 	 String toSanitizeMedium = "the <span style=\"font-size:medium\">medium</span> formatting issue with chrome";
+ 	 assertEquals(toSanitizeMedium, factory.sanitize(toSanitizeMedium)); 
+  }
+
+
   private static String apply(HtmlPolicyBuilder b) {
     return apply(b, EXAMPLE);
   }