diff --git a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java index bae6d13e..7b7085dd 100644 --- a/src/main/java/org/owasp/html/HtmlPolicyBuilder.java +++ b/src/main/java/org/owasp/html/HtmlPolicyBuilder.java @@ -870,7 +870,7 @@ private HtmlTagSkipType getHtmlTagSkipType(String elementName) { */ public final class AttributeBuilder { private final List attributeNames; - private AttributePolicy policy = AttributePolicy.IDENTITY_ATTRIBUTE_POLICY; + private AttributePolicy policy; AttributeBuilder(List attributeNames) { this.attributeNames = List.copyOf(attributeNames); @@ -884,7 +884,11 @@ public final class AttributeBuilder { * transformation by a previous policy. */ public AttributeBuilder matching(AttributePolicy attrPolicy) { - this.policy = AttributePolicy.Util.join(this.policy, attrPolicy); + if (this.policy == null) { + this.policy = attrPolicy; + } else { + this.policy = AttributePolicy.Util.join(this.policy, attrPolicy); + } return this; } diff --git a/src/test/java/org/owasp/html/SanitizersTest.java b/src/test/java/org/owasp/html/SanitizersTest.java index 5cdadace..e3239a5b 100644 --- a/src/test/java/org/owasp/html/SanitizersTest.java +++ b/src/test/java/org/owasp/html/SanitizersTest.java @@ -551,6 +551,29 @@ public static final void testStyleGlobally() { String want = "

This is some green text

"; assertEquals(want, policyBuilder.sanitize(input)); } + + @Test + public static final void testStyleWithOtherAttributesGlobally() { + PolicyFactory policyBuilder = new HtmlPolicyBuilder() + .allowAttributes("style", "align").globally() + .allowElements("a", "label", "h1", "h2", "h3", "h4", "h5", "h6") + .toFactory(); + String input = "

This is some green centered text

"; + String want = "

This is some green centered text

"; + assertEquals(want, policyBuilder.sanitize(input)); + } + + @Test + public static final void testStyleGloballyWithCustomPolicy() { + PolicyFactory policyBuilder = new HtmlPolicyBuilder() + .allowAttributes("style") + .matching(AttributePolicy.IDENTITY_ATTRIBUTE_POLICY).globally() + .allowElements("a", "label", "h1", "h2", "h3", "h4", "h5", "h6") + .toFactory(); + String input = "

This is some green centered text

"; + String want = "

This is some green centered text

"; + assertEquals(want, policyBuilder.sanitize(input)); + } static int fac(int n) { int ifac = 1;