3842ba31ab0b697b0d4026b5751da7dac7c84e35 braney Tue Sep 29 13:49:49 2026 -0700 htmlSanitize: keep the stdTbl and copyLinkSpan class names, refs #38126 GenArk description pages use these two classes from our own stylesheet and scripts: stdTbl for bordered tables, and copyLinkSpan with data-target for the Copy button next to the share link. They now come through, and data-target gets the same prefix as the id it names. Style values are now read the same way on every pass, so a page that is saved again comes out unchanged. Over the 5390-page hub corpus, 278 pages change, all in class or data-target only, and no page's text changes. diff --git src/lib/tests/expected/htmlSanitizeTest src/lib/tests/expected/htmlSanitizeTest index 5a9d6b454ce..f1f789d8b08 100644 --- src/lib/tests/expected/htmlSanitizeTest +++ src/lib/tests/expected/htmlSanitizeTest @@ -62,31 +62,31 @@ in : <form action="/x"><input name="password"><button>Log in</button></form><p>after</p> out: <p>after</p> (removed the form element and everything inside it) in : <!DOCTYPE html><!-- <p>hidden</p> --><p>shown</p> out: <p>shown</p> in : <h2 id="methods">M</h2><a name="top">t</a><a href="#methods">same page</a> <a href="other.html#methods">other page</a><a href="#">to the top</a><div id="">no name at all</div> out: <h2 id="descPage-methods">M</h2><a name="descPage-top">t</a><a href="#descPage-methods">same page</a> <a href="other.html#methods">other page</a><a href="#">to the top</a><div>no name at all</div> in : <table border="1"><tr><td colspan="2" bgcolor="#eee">cell</td></tr></table> out: <table border="1"><tr><td colspan="2" bgcolor="#eee">cell</td></tr></table> in : <p style="list-style:url(http://example.com/x.png);color:red">a</p> -out: <p style="color:red">a</p> +out: <p style="color:red;">a</p> (removed the value of the style property list-style) in : <p style="font-family:'AT&T Sans'">a</p> out: <p style="font-family:'AT&T Sans';">a</p> in : <img src="first.png" src="second.png" alt="a" alt="b"><a href="javascript:alert(1)" href="https://example.com">x</a> out: <img src="first.png" alt="a"><a>x</a> (removed a link that used the javascript: scheme) in : <p>real</p><p title="oops>never printed</p> out: <p>real</p> (stopped at a tag that never ends, and printed nothing after it) in : <div>a < b</ <b>bold</b></div> out: <div>a < b</ <b>bold</b></div> @@ -108,15 +108,39 @@ (removed the script element and everything inside it) (removed a link that used the javascript: scheme) in : <svg><circle r="1" fill="url(https://example.com/x.svg#p)"/><rect stroke="url(https://example.com/y)" fill="#c00"/></svg> out: <svg><circle r="1"></circle><rect fill="#c00"></rect></svg> (removed the value of the svg attribute fill) (removed the value of the svg attribute stroke) in : <svg><defs><clipPath id="c"><path d="M0 0L9 9"/></clipPath></defs><rect width="9" height="9"/></svg> out: <svg><rect width="9" height="9"></rect></svg> (removed the defs element and everything inside it) in : <circle r="5"/>text after out: text after +in : <table class="stdTbl wide"><tr><td class="copyLinkSpanX">cell</td></tr></table> +out: <table class="stdTbl"><tr><td>cell</td></tr></table> + +in : <span id='urlText0'><em>https://http_host/h/GCA_1</em></span><span class='copyLinkSpan' data-target='urlText0'></span> +out: <span id="descPage-urlText0"><em>https://http_host/h/GCA_1</em></span><span class="copyLinkSpan" data-target="descPage-urlText0"></span> + +in : <p style='font-family:"Verdana",sans-serif;color:black'>a</p> +out: <p style="font-family:"Verdana",sans-serif;color:black;">a</p> + +in : <p style="list-style:url(http://example.com/x); color:green">a</p> +out: <p style="color:green;">a</p> + (removed the value of the style property list-style) + +in : <p style="color:red;text-align:center">a</p> +out: <p style="color:red;text-align:center;">a</p> + +in : <p style="list-style:url(//example.com/x.png);color:red">a</p> +out: <p style="color:red;">a</p> + (removed the value of the style property list-style) + +in : <p style="color:red&foo;position:fixed">a</p> +out: <p>a</p> + (removed the value of the style property color) +