From 6e7247ef0b0e9204765ba99f2bc7a162ef137c59 Mon Sep 17 00:00:00 2001
From: K <z@kwi.li>
Date: Thu, 30 Dec 2021 17:05:37 -0500
Subject: [PATCH] Remove duplicate vals

---
 sanitize.go      | 6 +++++-
 sanitize_test.go | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/sanitize.go b/sanitize.go
index b888625..9bd91ab 100644
--- a/sanitize.go
+++ b/sanitize.go
@@ -815,9 +815,13 @@ attrsLoop:
 			if htmlAttr.Key == "sandbox" {
 				sandboxFound = true
 				var cleanVals []string
+				cleanValsSet := make(map[string]bool)
 				for _, val := range strings.Fields(htmlAttr.Val) {
 					if p.requireSandboxOnIFrame[val] {
-						cleanVals = append(cleanVals, val)
+						if !cleanValsSet[val] {
+							cleanVals = append(cleanVals, val)
+							cleanValsSet[val] = true
+						}
 					}
 				}
 				cleanAttrs[i].Val = strings.Join(cleanVals, " ")
diff --git a/sanitize_test.go b/sanitize_test.go
index c322ae5..fa9e641 100644
--- a/sanitize_test.go
+++ b/sanitize_test.go
@@ -1876,7 +1876,7 @@ func TestIFrameSandbox(t *testing.T) {
 	p.AllowAttrs("sandbox").OnElements("iframe")
 	p.RequireSandboxOnIFrame(SandboxAllowDownloads)
 
-	in := `<iframe src="http://example.com" sandbox="allow-forms allow-downloads"></iframe>`
+	in := `<iframe src="http://example.com" sandbox="allow-forms allow-downloads allow-downloads"></iframe>`
 	expected := `<iframe sandbox="allow-downloads"></iframe>`
 	out := p.Sanitize(in)
 	if out != expected {