java-html-sanitizer
java-html-sanitizer copied to clipboard
allowAttributes("style").globally() shouldn't imply allowStyling() - Regression with 2024 version
This recent breaking changes
- Forces validating global style content with CSSSchema - Earlier we had better options seperately allowAttributes("style").globally() - doesn't sanitize, allowStyling() - did sanitize.
- make disallowAttribute("style").globally() now does allowStyling() as pointed out in the PR by someone.
@mikesamuel @jmanico : Can you kindly have a look as we are facing issues after 2024 version upgrade.
Fixes https://github.com/OWASP/java-html-sanitizer/issues/331
@mikesamuel
Please also add test cases for the cases that must not happen.
@mikesamuel