jeff/umap
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #1801 from umap-project/1796-add-purify-attributes

Browse source 
fix: allow `dir` and `title` attributes
This commit is contained in:
David Larlet 2024-05-07 09:40:27 -04:00 committed by GitHub
commit dcad0e1bb2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
umap/static/umap/js/modules/utils.js
View file

@ -88,7 +88,7 @@ export function escapeHTML(s) {
'span', 'span',
], ],
ADD_ATTR: ['target', 'allow', 'allowfullscreen', 'frameborder', 'scrolling'], ADD_ATTR: ['target', 'allow', 'allowfullscreen', 'frameborder', 'scrolling'],
ALLOWED_ATTR: ['href', 'src', 'width', 'height', 'style'], ALLOWED_ATTR: ['href', 'src', 'width', 'height', 'style', 'dir', 'title'],
// Added: `geo:` URL scheme as defined in RFC5870: // Added: `geo:` URL scheme as defined in RFC5870:
// https://www.rfc-editor.org/rfc/rfc5870.html // https://www.rfc-editor.org/rfc/rfc5870.html
// The base RegExp comes from: // The base RegExp comes from:

7
umap/static/umap/unittests/utils.js
View file

@ -185,6 +185,13 @@ describe('Utils', function () {
assert.equal(Utils.escapeHTML('<a href="geo:1,2"></a>'), '<a href="geo:1,2"></a>') assert.equal(Utils.escapeHTML('<a href="geo:1,2"></a>'), '<a href="geo:1,2"></a>')
}) })
it('should not escape dir and title attributes', function () {
assert.equal(
Utils.escapeHTML('<a title="Title" dir="rtl"></a>'),
'<a dir="rtl" title="Title"></a>'
)
})
it('should not fail with int value', function () { it('should not fail with int value', function () {
assert.equal(Utils.escapeHTML(25), '25') assert.equal(Utils.escapeHTML(25), '25')
}) })