Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add overflow-wrap to CssSchema definition list #312

Merged
merged 2 commits into from
Feb 2, 2024
+35 −0
Merged

Add overflow-wrap to CssSchema definition list #312

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0ea456b
Add overflow-wrap to CssSchema definition list
csware Jan 29, 2024
798aa06
Merge branch 'main' into overflow-wrap
mikesamuel Feb 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/main/java/org/owasp/html/CssSchema.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -424,6 +424,8 @@ Property forKey(String propertyName) {
"auto", "inherit", "none");
Set<String> overflowLiterals0 = Set.of(
"auto", "hidden", "inherit", "scroll", "visible");
Set<String> overflowWrapLiterals0 = Set.of(
"normal", "break-word", "anywhere", "inherit");
Copy link
Contributor Author

@csware csware Jan 30, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about other valid values such as "initial" , "revert" , "revert-layer", "unset" ((listed as "global values" on https://developer.mozilla.org/en-US/docs/Web/CSS/overflow-wrap?

Thoase are also not listed for the other properties.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think revert and revert-layer were added before the last time this property list was thoroughly revamped. I don't quite understand the semantics, but I would worry about adding it everywhere that inherit appears in case it allows working around visual containment and event capturing measures like clipping, position, and overflow.

Set<String> overflowXLiterals0 = Set.of(
"no-content", "no-display");
Set<String> overflowXLiterals1 = Set.of(
Expand Down Expand Up @@ -668,6 +670,7 @@ Property forKey(String propertyName) {
Property opacity = new Property(1, mozOpacityLiterals0, zeroFns);
builder.put("opacity", opacity);
builder.put("overflow", new Property(0, overflowLiterals0, zeroFns));
builder.put("overflow-wrap", new Property(0, overflowWrapLiterals0, zeroFns));
@SuppressWarnings("unchecked")
Property overflowX = new Property(
0, union(overflowXLiterals0, overflowXLiterals1), zeroFns);
Expand Down
32 changes: 32 additions & 0 deletions src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1029,6 +1029,38 @@ public static final void testSkipAndRequireRels() {
pf.sanitize("<a href=\"http://example.com\" rel=noopener target=\"_blank\">eg</a>"));
}

@Test
public static final void testOverflowWrap() {
PolicyFactory pf = new HtmlPolicyBuilder()
.allowElements("span")
.allowStyling(CssSchema.union(CssSchema.DEFAULT, CssSchema.withProperties(List.of("overflow-wrap"))))
.toFactory();

assertEquals(
"<span style=\"overflow-wrap:anywhere\">Something</span>",
pf.sanitize("<span style=\"overflow-wrap: anywhere\">Something</span>"));

assertEquals(
"<span style=\"overflow-wrap:inherit\">Something</span>",
pf.sanitize("<span style=\"overflow-wrap: inherit\">Something</span>"));

assertEquals(
"Something",
pf.sanitize("<span style=\"overflow-wrap: something\">Something</span>"));
}

@Test
public static final void testOverflowWrapNotAllowed() {
PolicyFactory pf = new HtmlPolicyBuilder()
.allowElements("span")
.allowStyling()
.toFactory();

assertEquals(
"Something",
pf.sanitize("<span style=\"overflow-wrap: anywhere\">Something</span>"));
}

@Test
public static final void testExplicitRelsSkip() {
PolicyFactory pf = new HtmlPolicyBuilder()
Expand Down
Loading