From fcce10fe70e737d7ca1fa67085aec026d7efb577 Mon Sep 17 00:00:00 2001 From: Tallys Martins Date: Mon, 14 Dec 2015 17:44:05 -0200 Subject: [PATCH] Fix XSS terminate removing custom attributes for Macros --- vendor/plugins/xss_terminate/lib/xss_terminate.rb | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/vendor/plugins/xss_terminate/lib/xss_terminate.rb b/vendor/plugins/xss_terminate/lib/xss_terminate.rb index 1f89200..e77ff8f 100644 --- a/vendor/plugins/xss_terminate/lib/xss_terminate.rb +++ b/vendor/plugins/xss_terminate/lib/xss_terminate.rb @@ -1,4 +1,6 @@ module XssTerminate + ALLOWED_CORE_ATTRIBUTES = %w(name href cite class title src xml:lang height datetime alt abbr width) + ALLOWED_CUSTOM_ATTRIBUTES = %w(data-macro) def self.sanitize_by_default=(value) @@sanitize_by_default = value @@ -38,21 +40,25 @@ module XssTerminate module InstanceMethods + def sanitize_allowed_attributes + ALLOWED_CORE_ATTRIBUTES | ALLOWED_CUSTOM_ATTRIBUTES + end + def sanitize_field(sanitizer, field, serialized = false) field = field.to_sym if serialized puts field self[field].each_key { |key| key = key.to_sym - self[field][key] = sanitizer.sanitize(self[field][key], scrubber: Rails::Html::PermitScrubber.new, encode_special_chars: false) + self[field][key] = sanitizer.sanitize(self[field][key], scrubber: Rails::Html::PermitScrubber.new, encode_special_chars: false, attributes: sanitize_allowed_attributes) } else if self[field] - self[field] = sanitizer.sanitize(self[field], scrubber: Rails::Html::PermitScrubber.new, encode_special_chars: false) + self[field] = sanitizer.sanitize(self[field], scrubber: Rails::Html::PermitScrubber.new, encode_special_chars: false, attributes: sanitize_allowed_attributes) else value = self.send("#{field}") return unless value - value = sanitizer.sanitize(value, scrubber: Rails::Html::PermitScrubber.new, encode_special_chars: false) + value = sanitizer.sanitize(value, scrubber: Rails::Html::PermitScrubber.new, encode_special_chars: false, attributes: sanitize_allowed_attributes) self.send("#{field}=", value) end end -- libgit2 0.21.2