You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As you can see, loofah is removing the css shorthand properties that contain >2 decimals, but does not remove css properties with >2 decimals that are not shorthand (such as text-indent).
Neither loofah or html5lib's documentation indicate this would be the expected outcome.
Is this the expected behavior of loofah? If so, then why?
I also submitted a PR for the change if that helps speed up the process. #150
The text was updated successfully, but these errors were encountered:
The current HTML sanitizer removes CSS shorthand properties with a float value that has more than 2 decimals of precision. From my testing, this only applies to the shorthand properties.
I wrote a ruby script that tests a couple of simple cases and illustrates the problem: https://gist.github.com/danfstucky/ea3115cf63e636bc4aa887d8b0c7fabd
Here is a screenshot of the output from running that script:
As you can see, loofah is removing the css shorthand properties that contain >2 decimals, but does not remove css properties with >2 decimals that are not shorthand (such as text-indent).
Neither loofah or html5lib's documentation indicate this would be the expected outcome.
Is this the expected behavior of loofah? If so, then why?
I also submitted a PR for the change if that helps speed up the process. #150
The text was updated successfully, but these errors were encountered: