diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
index d5a5df05..1e3f65e6 100644
--- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
+++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlPolicyBuilder.java
@@ -874,10 +874,21 @@ private HtmlTagSkipType getHtmlTagSkipType(String elementName) {
public final class AttributeBuilder {
private final List attributeNames;
private AttributePolicy policy = AttributePolicy.IDENTITY_ATTRIBUTE_POLICY;
+ private boolean shouldSanitizeGlobalStyles = false;
AttributeBuilder(List extends String> attributeNames) {
this.attributeNames = j8().listCopyOf(attributeNames);
}
+
+ /**
+ * Determines whether allowAttributes("style").globally() should imply allowStyling()
+ * which sanitizes style attribute values
+ */
+ public AttributeBuilder sanitizeGlobalStyles() {
+ this.shouldSanitizeGlobalStyles = true;
+ return this;
+ }
+
/**
* Filters and/or transforms the attribute values
@@ -967,7 +978,7 @@ public AttributeBuilder matching(
*/
@SuppressWarnings("synthetic-access")
public HtmlPolicyBuilder globally() {
- if (attributeNames.contains("style")) {
+ if (attributeNames.contains("style") && shouldSanitizeGlobalStyles) {
allowStyling();
}
return HtmlPolicyBuilder.this.allowAttributesGlobally(
diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssSchemaTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssSchemaTest.java
index e3b8e2f9..3c6aa9af 100644
--- a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssSchemaTest.java
+++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/CssSchemaTest.java
@@ -97,4 +97,20 @@ public static final void testCustom() {
assertTrue("left in float", cssFloat.literals.contains("left"));
}
+ @Test
+ public static final void testStyleCasingWithoutAllowStyling() {
+ String input = "fourth line
";
+ PolicyFactory factory = new HtmlPolicyBuilder().allowElements("p","span").allowAttributes("test","style").globally().toFactory();
+ assertEquals(input, factory.sanitize(input));
+ }
+
+ @Test
+ public static final void testStyleCasingWithAllowStyling() {
+ String input = "fourth line
";
+ PolicyFactory factory = new HtmlPolicyBuilder().allowElements("p","span").allowAttributes("test","style").sanitizeGlobalStyles().globally().toFactory();
+ assertEquals("fourth line
"
+ , factory.sanitize(input));
+ }
+
+
}
diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
index 3ac35180..5ad8faa3 100644
--- a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
+++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
@@ -663,6 +663,19 @@ public String toString() {
input));
}
+ @Test
+ public static final void testGlobalStyleWithoutSanitization() {
+ PolicyFactory factory = new HtmlPolicyBuilder().allowElements("span").allowAttributes("test","style").globally().toFactory();
+ String input = "Strikethrough";
+ assertEquals(factory.sanitize(input), input);
+ }
+
+ @Test
+ public static final void testGlobalStyleWithSanitization() {
+ PolicyFactory factory = new HtmlPolicyBuilder().allowElements("span").allowAttributes("test","style").sanitizeGlobalStyles().globally().toFactory();
+ String input = "Strikethrough";
+ assertEquals("Strikethrough", factory.sanitize(input));
+ }
@Test
public final void testPostprocessors() {