Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🐛Fix amp-inputmask attributes stripping in amp-mustache 0.2. #20515

Merged
merged 3 commits into from
Jan 29, 2019
Merged

🐛Fix amp-inputmask attributes stripping in amp-mustache 0.2. #20515

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dc499fb
Fix amp-inputmask attributes stripping in amp-mustache 0.2. Update ex…
cvializ Jan 24, 2019
1878e89
Only add the new attribute mask-output
cvializ Jan 28, 2019
e2f8128
Add test
cvializ Jan 29, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Only add the new attribute mask-output
  • Loading branch information
@cvializ
cvializ committed Jan 28, 2019
commit 1878e89ffece0e29d809eb40a5c1b9f86d2c4c35
2 changes: 0 additions & 2 deletions src/purifier.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,9 +163,7 @@ export const WHITELISTED_ATTRS_BY_TAGS = {
'target',
],
'input': [
'value',
'mask-output',
'mask',
],
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

value and mask should already be allowed: https://github.com/cure53/DOMPurify/blob/master/src/attrs.js

Try it out by adding a simple test case in test-purifier.js.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mask looks like it's only allowed for svg, and this is for an input tag. I'll check the error messages to see what the issue with value was.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DOMPurify doesn't use tag-specific whitelists for attributes. We should add a unit test for this change in test-purifier.js anyways.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. PTAL

'template': [
'type',
Expand Down