Merge pull request #162 from jaredbeck/allow_list-style

Allow CSS property `list-style`
flavorjones · Apr 23, 2019 · 8220c70 · 8220c70
2 parents 5e014f5 + 1a82f4d
commit 8220c70
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,7 @@
 * Expand set of allowed protocols to include `tel:` and `line:`. [#104, #147]
 * Expand set of allowed CSS functions. [related to #122]
 * Allow greater precision in shorthand CSS values. [#149] (Thanks, @danfstucky!)
+* Allow CSS property `list-style`
 
 
 ### Bug fixes

diff --git a/lib/loofah/html5/whitelist.rb b/lib/loofah/html5/whitelist.rb
@@ -574,6 +574,7 @@ module WhiteList
                                             "height",
                                             "letter-spacing",
                                             "line-height",
+                                            "list-style",
                                             "list-style-type",
                                             "overflow",
                                             "pause",

diff --git a/test/html5/test_sanitizer.rb b/test/html5/test_sanitizer.rb
@@ -263,6 +263,12 @@ def test_figure_element_is_valid
     end
   end
 
+  def test_css_list_style
+    html = '<ul style="list-style: none"></ul>'
+    sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :escape).to_xml)
+    assert_match %r/list-style/, sane.inner_html
+  end
+
   def test_css_negative_value_sanitization
     html = "<span style=\"letter-spacing:-0.03em;\">"
     sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :escape).to_xml)