diff --git a/src/tools/kcSanitize/KcSanitizerPolicy.ts b/src/tools/kcSanitize/KcSanitizerPolicy.ts index 4832ae10..d4d2adda 100644 --- a/src/tools/kcSanitize/KcSanitizerPolicy.ts +++ b/src/tools/kcSanitize/KcSanitizerPolicy.ts @@ -46,12 +46,12 @@ export class KcSanitizerPolicy { public static readonly NAME = new RegExp("[a-zA-Z0-9\\-_\\$]+"); public static readonly ALIGN = new RegExp( - "center|left|right|justify|char", + "\\b(center|left|right|justify|char)\\b", "i" // Case-insensitive flag ); public static readonly VALIGN = new RegExp( - "baseline|bottom|middle|top", + "\\b(baseline|bottom|middle|top)\\b", "i" // Case-insensitive flag ); diff --git a/test/kcSanitize/KcSanitizer.spec.ts b/test/kcSanitize/KcSanitizer.spec.ts index 63896a32..5260b17f 100644 --- a/test/kcSanitize/KcSanitizer.spec.ts +++ b/test/kcSanitize/KcSanitizer.spec.ts @@ -75,6 +75,20 @@ describe("KeycloakSanitizerMethod", () => { html ); }); + + it("should handle ordinary texts correctly", () => { + let html: string = ""; + + html = "Some text"; + assertResult("Some text", html); + + html = `text with "double quotation"`; + assertResult(`text with "double quotation"`, html); + + html = `text with 'single quotation'`; + assertResult(`text with 'single quotation'`, html); + }); + it("should handle text styles correctly", () => { let html: string = ""; @@ -90,6 +104,15 @@ describe("KeycloakSanitizerMethod", () => { html = `

red text

`; assertResult(`

red text

`, html); + html = `

Case-insensitive

`; + assertResult(`

Case-insensitive

`, html); + + html = `

wrong value for align

`; + assertResult(`

wrong value for align

`, html); + + html = `

wrong value for align

`; + assertResult(`

wrong value for align

`, html); + html = `

This is a paragraph with larger text.

`; assertResult( `

This is a paragraph with larger text.

`, @@ -100,13 +123,23 @@ describe("KeycloakSanitizerMethod", () => { assertResult(`

או נושא שתבחר

`, html); }); + it("should handle styles correctly", () => { + let html = ""; + html = `
`; + assertResult(`
`, html); + + html = `
`; + assertResult(`
`, html); + + html = ` Content `; + assertResult(` Content `, html); + }); + function assertResult(expectedResult: string | null, html: string | null): void { if (expectedResult === null) { expect(KcSanitizer.sanitize(html)).toThrow("Cannot escape null value."); } else { const result = KcSanitizer.sanitize(html); - console.log("expectedResult is ", expectedResult); - console.log("Result is ", result); expect(result).toBe(expectedResult); } }