Do not ignore attributes allowed globally together with 'style' (#237)#238
Do not ignore attributes allowed globally together with 'style' (#237)#238corebonts wants to merge 3 commits intoOWASP:mainfrom
Conversation
…P#237) Also, allowStyling() internally allows the 'style' attribute, so it is not necessary to ignore it.
|
Thanks for adding a testcase. The check for style as the zero-th element seems good to change, but what prompted this? Instead of using null for the policy, and checking |
|
First, thanks for reviewing it. For the first, I don't know, it's someone else's change and I don't know the reason behind it. For me it also feels a bit magical. And for your comment about the nullcheck, you're right, I will change that. |
| this.policy = attrPolicy; | ||
| } else { | ||
| this.policy = AttributePolicy.Util.join(this.policy, attrPolicy); | ||
| } |
There was a problem hiding this comment.
aalmiray
force-pushed
the
main
branch
6 times, most recently
from
9bb458a to
f40152f
Compare
2 participants
Also, allowStyling() internally allows the 'style' attribute, so it is not necessary to ignore it.