Skip to content

Commit 9180953

Browse files
committed
fix important bug when removeInlineEventListeners break html
1 parent c632cba commit 9180953

File tree

2 files changed

+5
-5
lines changed

2 files changed

+5
-5
lines changed

src/Cleaner.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ class Cleaner
1414
/**
1515
* @var string
1616
*/
17-
protected $inlineListenersPattern = '/on.*=\".*\"(?=.*>)/isU';
17+
protected $inlineListenersPattern = '/on[A-z]+=\".*\"(?=.*>)/isU';
1818

1919
/**
2020
* Clean

tests/FilterXSSTest.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,13 +76,13 @@ public function it_escapes_script_tags()
7676
public function it_doesnt_change_non_script_html_inputs()
7777
{
7878
$this->responseFromMiddlewareWithInput([
79-
'html_with_script_src' => '<div class="some-class"><a href="http://example.test" class="link">link text</a>Before text <script src="app.js"></script> after text</div>',
80-
'html_with_script_multiline' => "<div class=\"some-class\">\n<a href=\"http://example.test\" class=\"link\">link text</a>\n Before text \n <script>\n let f = () => alert(1); f(); \n </script>\n After text</div>",
79+
'html_with_script_src' => '<div class="some-class"><a href="http://example.test" class="link">link text</a>Before text <script src="app.js"></script> after text</div> test on some text <span>test</span> <span style="color: red;">test</span> test',
80+
'html_with_script_multiline' => "<div class=\"some-class\">\n<a href=\"http://example.test\" class=\"link\">link text</a>\n Before text \n <script>\n let f = () => alert(1); f(); \n </script>\n After text</div> \n test on some text <span>test</span> <span style='color: red;'>test</span> test",
8181
]);
8282

8383
$this->assertEquals([
84-
'html_with_script_src' => '<div class="some-class"><a href="http://example.test" class="link">link text</a>Before text ' . e('<script src="app.js"></script>') . ' after text</div>',
85-
'html_with_script_multiline' => "<div class=\"some-class\">\n<a href=\"http://example.test\" class=\"link\">link text</a>\n Before text \n " . e("<script>\n let f = () => alert(1); f(); \n </script>") . "\n After text</div>",
84+
'html_with_script_src' => '<div class="some-class"><a href="http://example.test" class="link">link text</a>Before text ' . e('<script src="app.js"></script>') . ' after text</div> test on some text <span>test</span> <span style="color: red;">test</span> test',
85+
'html_with_script_multiline' => "<div class=\"some-class\">\n<a href=\"http://example.test\" class=\"link\">link text</a>\n Before text \n " . e("<script>\n let f = () => alert(1); f(); \n </script>") . "\n After text</div> \n test on some text <span>test</span> <span style='color: red;'>test</span> test",
8686
], $this->request->all());
8787
}
8888

0 commit comments

Comments
 (0)