diff --git a/src/main/resources/antisamy-anythinggoes.xml b/src/main/resources/antisamy-anythinggoes.xml index f23706f8..7ac09993 100644 --- a/src/main/resources/antisamy-anythinggoes.xml +++ b/src/main/resources/antisamy-anythinggoes.xml @@ -102,8 +102,8 @@ http://www.w3.org/TR/html401/struct/global.html - - + + diff --git a/src/main/resources/antisamy-ebay.xml b/src/main/resources/antisamy-ebay.xml index 839faea0..700ddb60 100644 --- a/src/main/resources/antisamy-ebay.xml +++ b/src/main/resources/antisamy-ebay.xml @@ -100,8 +100,8 @@ http://www.w3.org/TR/html401/struct/global.html - - + + diff --git a/src/main/resources/antisamy-myspace.xml b/src/main/resources/antisamy-myspace.xml index 88d4a143..166165ce 100644 --- a/src/main/resources/antisamy-myspace.xml +++ b/src/main/resources/antisamy-myspace.xml @@ -102,8 +102,8 @@ http://www.w3.org/TR/html401/struct/global.html - - + + diff --git a/src/main/resources/antisamy.xml b/src/main/resources/antisamy.xml index 917da876..c6e2304f 100644 --- a/src/main/resources/antisamy.xml +++ b/src/main/resources/antisamy.xml @@ -107,8 +107,8 @@ http://www.w3.org/TR/html401/struct/global.html - - + + diff --git a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java index 99ba9903..689402b0 100644 --- a/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java +++ b/src/test/java/org/owasp/validator/html/test/AntiSamyTest.java @@ -1509,5 +1509,23 @@ public void testGithubIssue99() throws ScanException, PolicyException { assertThat(as.scan("

This paragraph is defined as British English.

", policy, AntiSamy.DOM).getCleanHTML(), containsString("lang=\"en-GB\"")); assertThat(as.scan("

This paragraph is defined as British English.

", policy, AntiSamy.SAX).getCleanHTML(), containsString("lang=\"en-GB\"")); } + + @Test + public void testGithubIssue101() throws ScanException, PolicyException { + // Test that margin attribute is not removed when value has too much significant figures. + // Current behavior is that decimals like 0.0001 are internally translated to 1.0E-4, this + // is reflected on regex validation and actual output. The inconsistency is due to Batik CSS. + assertThat(as.scan("

Some text.

", policy, AntiSamy.DOM).getCleanHTML(), containsString("margin")); + assertThat(as.scan("

Some text.

", policy, AntiSamy.SAX).getCleanHTML(), containsString("margin")); + assertThat(as.scan("

Some text.

", policy, AntiSamy.DOM).getCleanHTML(), containsString("margin")); + assertThat(as.scan("

Some text.

", policy, AntiSamy.SAX).getCleanHTML(), containsString("margin")); + assertThat(as.scan("

Some text.

", policy, AntiSamy.DOM).getCleanHTML(), containsString("margin")); + assertThat(as.scan("

Some text.

", policy, AntiSamy.SAX).getCleanHTML(), containsString("margin")); + // When using exponential directly the "e" or "E" is internally considered as the start of + // the dimension/unit type. This creates inconsistencies that make the regex validation fail, + // also in cases like 1e4pt where "e" is considered as dimension instead of "pt". + assertThat(as.scan("

Some text.

", policy, AntiSamy.DOM).getCleanHTML(), not(containsString("margin"))); + assertThat(as.scan("

Some text.

", policy, AntiSamy.SAX).getCleanHTML(), not(containsString("margin"))); + } }