Closed
Description
The output of sanitize does't encode double quotes when it is inside a tag attribute
eg input : <span style="color:blue ; test : @ ">This is blue " with a @</span>
gives output : <span style="color:blue ; test : @">This is blue " with a @</span>
it left the double quotes after the style= unchanged.
I am using a custom policy
` PolicyFactory policyBuilder = new HtmlPolicyBuilder()
.allowAttributes("src").onElements("img","video","source")
.allowAttributes("controls","type","width").onElements("video")
.allowAttributes("type").onElements("source")
.allowAttributes("href","target").onElements("a")
.allowAttributes("class").globally()
.allowAttributes("style").globally()
.allowStandardUrlProtocols()
.allowElements(
"a", "label", "h1", "h2", "h3", "h4", "h5", "h6",
"p", "i", "b", "u", "strong", "em", "small", "big", "pre", "code",
"cite", "samp", "sub", "sup", "strike", "center", "blockquote",
"hr", "br", "col", "font", "span", "div", "img",
"ul", "ol", "li", "dd", "dt", "dl", "tbody", "thead", "tfoot",
"table", "td", "th", "tr", "colgroup", "fieldset", "legend","video", "source"
).toFactory();
String value = "<span style=\"color:blue ; test : @\">This is blue \" with @</span>";
System.out.println( policyBuilder.sanitize(value));
Metadata
Metadata
Assignees
Labels
No labels