Skip to content

Commit 1048f32

Browse files
committed
Make sure dom sanitizer attributes are normalized to lower case
Fixes microsoft#259148
1 parent 01afdfd commit 1048f32

3 files changed

Lines changed: 29 additions & 1 deletion

File tree

src/vs/base/browser/domSanitize.ts

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -248,6 +248,17 @@ export function sanitizeHtml(untrusted: string, config?: DomSanitizerConfig): Tr
248248
}
249249
}
250250

251+
// All attr names are lower-case in the sanitizer hooks
252+
resolvedAttributes = resolvedAttributes.map((attr): string | SanitizeAttributeRule => {
253+
if (typeof attr === 'string') {
254+
return attr.toLowerCase();
255+
}
256+
return {
257+
attributeName: attr.attributeName.toLowerCase(),
258+
shouldKeep: attr.shouldKeep,
259+
};
260+
});
261+
251262
const allowedAttrNames = new Set(resolvedAttributes.map(attr => typeof attr === 'string' ? attr : attr.attributeName));
252263
const allowedAttrPredicates = new Map<string, SanitizeAttributeRule>();
253264
for (const attr of resolvedAttributes) {

src/vs/base/test/browser/domSanitize.test.ts

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,23 @@ suite('DomSanitize', () => {
6161
assert.ok(str.includes('custom-attr="value"'));
6262
});
6363

64+
test('Attributes in config should be case insensitive', () => {
65+
const html = '<div Custom-Attr="value">content</div>';
66+
67+
{
68+
const result = sanitizeHtml(html, {
69+
allowedAttributes: { override: ['custom-attr'] }
70+
});
71+
assert.ok(result.toString().includes('custom-attr="value"'));
72+
}
73+
{
74+
const result = sanitizeHtml(html, {
75+
allowedAttributes: { override: ['CUSTOM-ATTR'] }
76+
});
77+
assert.ok(result.toString().includes('custom-attr="value"'));
78+
}
79+
});
80+
6481
test('removes unsupported protocols for href by default', () => {
6582
const html = '<a href="javascript:alert(1)">bad link</a>';
6683
const result = sanitizeHtml(html);

src/vs/workbench/contrib/markdown/test/browser/__snapshots__/Markdown_Katex_Support_Test_Should_support_blocks_immediately_after_paragraph.0.snap

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<p>Block example:</p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math><semantics><mrow><msubsup><mo>∫</mo><mrow><mo>−</mo><mi>∞</mi></mrow><mi>∞</mi></msubsup><msup><mi>e</mi><mrow><mo>−</mo><msup><mi>x</mi><mn>2</mn></msup></mrow></msup><mi>d</mi><mi>x</mi><mo>=</mo><msqrt><mi>π</mi></msqrt></mrow><annotation encoding="application/x-tex">\int_{-\infty}^{\infty} e^{-x^2} dx = \sqrt{\pi}</annotation></semantics></math></span><span class="katex-html"><span class="base"><span style="height: 2.3846em; vertical-align: -0.9703em" class="strut"></span><span class="mop"><span style="margin-right: 0.44445em; position: relative; top: -0.0011em" class="mop op-symbol large-op">∫</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span style="height: 1.4143em" class="vlist"><span style="top: -1.7881em; margin-left: -0.4445em; margin-right: 0.05em"><span style="height: 2.7em" class="pstrut"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">−</span><span class="mord mtight">∞</span></span></span></span><span style="top: -3.8129em; margin-right: 0.05em"><span style="height: 2.7em" class="pstrut"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">∞</span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span style="height: 0.9703em" class="vlist"><span></span></span></span></span></span></span><span style="margin-right: 0.1667em" class="mspace"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span style="height: 1.0369em" class="vlist"><span style="top: -3.113em; margin-right: 0.05em"><span style="height: 2.7em" class="pstrut"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">−</span><span class="mord mtight"><span class="mord mathnormal mtight">x</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span style="height: 0.8913em" class="vlist"><span style="top: -2.931em; margin-right: 0.0714em"><span style="height: 2.5em" class="pstrut"></span><span class="sizing reset-size3 size1 mtight"><span class="mord mtight">2</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span><span class="mord mathnormal">d</span><span class="mord mathnormal">x</span><span style="margin-right: 0.2778em" class="mspace"></span><span class="mrel">=</span><span style="margin-right: 0.2778em" class="mspace"></span></span><span class="base"><span style="height: 1.04em; vertical-align: -0.1908em" class="strut"></span><span class="mord sqrt"><span class="vlist-t vlist-t2"><span class="vlist-r"><span style="height: 0.8492em" class="vlist"><span style="top: -3em" class="svg-align"><span style="height: 3em" class="pstrut"></span><span style="padding-left: 0.833em" class="mord"><span style="margin-right: 0.03588em" class="mord mathnormal">π</span></span></span><span style="top: -2.8092em"><span style="height: 3em" class="pstrut"></span><span style="min-width: 0.853em; height: 1.08em" class="hide-tail"><svg height="1.08em" width="400em"><path d="M95,702
1+
<p>Block example:</p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math><semantics><mrow><msubsup><mo>∫</mo><mrow><mo>−</mo><mi>∞</mi></mrow><mi>∞</mi></msubsup><msup><mi>e</mi><mrow><mo>−</mo><msup><mi>x</mi><mn>2</mn></msup></mrow></msup><mi>d</mi><mi>x</mi><mo>=</mo><msqrt><mi>π</mi></msqrt></mrow><annotation encoding="application/x-tex">\int_{-\infty}^{\infty} e^{-x^2} dx = \sqrt{\pi}</annotation></semantics></math></span><span class="katex-html"><span class="base"><span style="height: 2.3846em; vertical-align: -0.9703em" class="strut"></span><span class="mop"><span style="margin-right: 0.44445em; position: relative; top: -0.0011em" class="mop op-symbol large-op">∫</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span style="height: 1.4143em" class="vlist"><span style="top: -1.7881em; margin-left: -0.4445em; margin-right: 0.05em"><span style="height: 2.7em" class="pstrut"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">−</span><span class="mord mtight">∞</span></span></span></span><span style="top: -3.8129em; margin-right: 0.05em"><span style="height: 2.7em" class="pstrut"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">∞</span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span style="height: 0.9703em" class="vlist"><span></span></span></span></span></span></span><span style="margin-right: 0.1667em" class="mspace"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span style="height: 1.0369em" class="vlist"><span style="top: -3.113em; margin-right: 0.05em"><span style="height: 2.7em" class="pstrut"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">−</span><span class="mord mtight"><span class="mord mathnormal mtight">x</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span style="height: 0.8913em" class="vlist"><span style="top: -2.931em; margin-right: 0.0714em"><span style="height: 2.5em" class="pstrut"></span><span class="sizing reset-size3 size1 mtight"><span class="mord mtight">2</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span><span class="mord mathnormal">d</span><span class="mord mathnormal">x</span><span style="margin-right: 0.2778em" class="mspace"></span><span class="mrel">=</span><span style="margin-right: 0.2778em" class="mspace"></span></span><span class="base"><span style="height: 1.04em; vertical-align: -0.1908em" class="strut"></span><span class="mord sqrt"><span class="vlist-t vlist-t2"><span class="vlist-r"><span style="height: 0.8492em" class="vlist"><span style="top: -3em" class="svg-align"><span style="height: 3em" class="pstrut"></span><span style="padding-left: 0.833em" class="mord"><span style="margin-right: 0.03588em" class="mord mathnormal">π</span></span></span><span style="top: -2.8092em"><span style="height: 3em" class="pstrut"></span><span style="min-width: 0.853em; height: 1.08em" class="hide-tail"><svg preserveAspectRatio="xMinYMin slice" viewBox="0 0 400000 1080" height="1.08em" width="400em"><path d="M95,702
22
c-2.7,0,-7.17,-2.7,-13.5,-8c-5.8,-5.3,-9.5,-10,-9.5,-14
33
c0,-2,0.3,-3.3,1,-4c1.3,-2.7,23.83,-20.7,67.5,-54
44
c44.2,-33.3,65.8,-50.3,66.5,-51c1.3,-1.3,3,-2,5,-2c4.7,0,8.7,3.3,12,10

0 commit comments

Comments
 (0)