提交 0a0d151b 编写于 作者: T Timm

Now returning html if html is blank? in FullSanitizer and WhiteListSanitizer....

Now returning html if html is blank? in FullSanitizer and WhiteListSanitizer. This means it'll return false if called with false, however that is not a valid use case.
上级 5430487d
require 'active_support/core_ext/class/attribute' require 'active_support/core_ext/class/attribute'
require 'active_support/core_ext/object/blank'
require 'active_support/deprecation' require 'active_support/deprecation'
require 'action_view/helpers/sanitize_helper/scrubbers' require 'action_view/helpers/sanitize_helper/scrubbers'
...@@ -25,7 +26,7 @@ def remove_xpaths(html, xpaths) ...@@ -25,7 +26,7 @@ def remove_xpaths(html, xpaths)
class FullSanitizer < Sanitizer class FullSanitizer < Sanitizer
def sanitize(html, options = {}) def sanitize(html, options = {})
return unless html return unless html
return html if html.empty? return html if html.blank?
Loofah.fragment(html).tap do |fragment| Loofah.fragment(html).tap do |fragment|
remove_xpaths(fragment, XPATHS_TO_REMOVE) remove_xpaths(fragment, XPATHS_TO_REMOVE)
...@@ -51,6 +52,7 @@ def initialize ...@@ -51,6 +52,7 @@ def initialize
def sanitize(html, options = {}) def sanitize(html, options = {})
return unless html return unless html
return html if html.blank?
loofah_fragment = Loofah.fragment(html) loofah_fragment = Loofah.fragment(html)
......
...@@ -98,7 +98,7 @@ def test_strip_tags ...@@ -98,7 +98,7 @@ def test_strip_tags
assert_equal("This is a test.", sanitizer.sanitize("<p>This <u>is<u> a <a href='test.html'><strong>test</strong></a>.</p>")) assert_equal("This is a test.", sanitizer.sanitize("<p>This <u>is<u> a <a href='test.html'><strong>test</strong></a>.</p>"))
assert_equal("", sanitizer.sanitize("<<<bad html>")) assert_equal("", sanitizer.sanitize("<<<bad html>"))
assert_equal("This is a test.", sanitizer.sanitize("This is a test.")) assert_equal("This is a test.", sanitizer.sanitize("This is a test."))
assert_equal "This has a here.", sanitizer.sanitize("This has a <!-- comment --> here.") assert_equal "This has a here.", sanitizer.sanitize("This has a <!-- comment --> here.")
...@@ -219,7 +219,7 @@ def test_should_allow_custom_tags_with_custom_attributes ...@@ -219,7 +219,7 @@ def test_should_allow_custom_tags_with_custom_attributes
def test_should_raise_argument_error_if_tags_is_not_enumerable def test_should_raise_argument_error_if_tags_is_not_enumerable
sanitizer = ActionView::WhiteListSanitizer.new sanitizer = ActionView::WhiteListSanitizer.new
e = assert_raise(ArgumentError) do e = assert_raise(ArgumentError) do
sanitizer.sanitize('', :tags => 'foo') sanitizer.sanitize('<a>some html</a>', :tags => 'foo')
end end
assert_equal "You should pass :tags as an Enumerable", e.message assert_equal "You should pass :tags as an Enumerable", e.message
...@@ -228,7 +228,7 @@ def test_should_raise_argument_error_if_tags_is_not_enumerable ...@@ -228,7 +228,7 @@ def test_should_raise_argument_error_if_tags_is_not_enumerable
def test_should_raise_argument_error_if_attributes_is_not_enumerable def test_should_raise_argument_error_if_attributes_is_not_enumerable
sanitizer = ActionView::WhiteListSanitizer.new sanitizer = ActionView::WhiteListSanitizer.new
e = assert_raise(ArgumentError) do e = assert_raise(ArgumentError) do
sanitizer.sanitize('', :attributes => 'foo') sanitizer.sanitize('<a>some html</a>', :attributes => 'foo')
end end
assert_equal "You should pass :attributes as an Enumerable", e.message assert_equal "You should pass :attributes as an Enumerable", e.message
...@@ -242,7 +242,7 @@ def scrub(node); node.name = 'h1'; end ...@@ -242,7 +242,7 @@ def scrub(node); node.name = 'h1'; end
end end
assert_raise Loofah::ScrubberNotFound do assert_raise Loofah::ScrubberNotFound do
sanitizer.sanitize('', :scrubber => scrubber) sanitizer.sanitize('<a>some html</a>', :scrubber => scrubber)
end end
end end
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册