diff --git a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java index 52524c5d..82ee2554 100644 --- a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java +++ b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java @@ -964,12 +964,11 @@ public AttributeBuilder matching( */ @SuppressWarnings("synthetic-access") public HtmlPolicyBuilder globally() { - if(attributeNames.get(0).equals("style")) { - return allowStyling(); - } else { - return HtmlPolicyBuilder.this.allowAttributesGlobally( - policy, attributeNames); + if (attributeNames.contains("style")) { + allowStyling(); } + return HtmlPolicyBuilder.this.allowAttributesGlobally( + policy, attributeNames); } /** diff --git a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java index f19b28d6..3f04d98d 100644 --- a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java +++ b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java @@ -1007,6 +1007,12 @@ public static final void testTextareaIsNotTextArea() { assertEquals("x", textAreaPolicy.sanitize(input)); } + @Test + public static final void testHtmlPolicyBuilderDefinitionWithNoAttributesDefinedGlobally() { + // Does not crash with a runtime exception + new HtmlPolicyBuilder().allowElements().allowAttributes().globally().toFactory(); + } + @Test public static final void testCSSFontSize() { HtmlPolicyBuilder builder = new HtmlPolicyBuilder();