Unbreak CssSchema.withProperties(Map)

This method never worked before. Signed-off-by: Sven Strickroth <email@cs-ware.de>
OWASP · Feb 2, 2024 · e40658f · e40658f
1 parent e8aa0f1
commit e40658f
Show file tree

Hide file tree

Showing 2 changed files with 54 additions and 3 deletions.
diff --git a/src/main/java/org/owasp/html/CssSchema.java b/src/main/java/org/owasp/html/CssSchema.java
@@ -164,15 +164,16 @@ public static CssSchema withProperties(
     Map<String, Property> propertyMap =
         new HashMap<>();
     // check that all fnKeys are defined in properties.
-    for (Map.Entry<String, Property> e : propertyMap.entrySet()) {
+    for (Map.Entry<? extends String, ? extends Property> e : properties.entrySet()) {
       Property property = e.getValue();
       for (String fnKey : property.fnKeys.values()) {
-        if (!propertyMap.containsKey(fnKey)) {
+        if (!properties.containsKey(fnKey)) {
           throw new IllegalArgumentException(
               "Property map is not self contained.  " + e.getValue()
               + " depends on undefined function key " + fnKey);
         }
       }
+      propertyMap.put(e.getKey(), e.getValue());
     }
     return new CssSchema(Map.copyOf(propertyMap));
   }

diff --git a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
@@ -29,8 +29,10 @@
 package org.owasp.html;
 
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
 import java.util.Locale;
+import java.util.Map;
 import java.util.Set;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
@@ -250,7 +252,31 @@ public void testSpecificStyleFilterung() {
   }
 
   @Test
-  public void testUnionStyleFilterung() {
+  public void testCustomPropertyStyleFiltering() {
+    assertEquals(
+        Arrays.stream(new String[] {
+            "<h1>Header</h1>",
+            "<p>Paragraph 1</p>",
+            "<p>Click me out</p>",
+            "<p></p>",
+            "<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
+            "</p><p style=\"text-align:center\">Stylish Para 1</p>",
+            "<p>Stylish Para 2</p>",
+            ""}).collect(Collectors.joining("\n")),
+        apply(new HtmlPolicyBuilder()
+              .allowCommonInlineFormattingElements()
+              .allowCommonBlockElements()
+              .allowStyling(
+                  CssSchema.withProperties(
+                      Map.of("text-align",
+                          new CssSchema.Property(0,
+                              Set.of("center"),
+                              Collections.emptyMap()))))
+              .allowStandardUrlProtocols()));
+  }
+
+  @Test
+  public void testUnionStyleFiltering() {
     assertEquals(
         Arrays.stream(new String[] {
             "<h1>Header</h1>",
@@ -271,6 +297,30 @@ public void testUnionStyleFilterung() {
               .allowStandardUrlProtocols()));
   }
 
+  @Test
+  public void testCustomPropertyStyleFilteringDisallowed() {
+    assertEquals(
+        Arrays.stream(new String[] {
+            "<h1>Header</h1>",
+            "<p>Paragraph 1</p>",
+            "<p>Click me out</p>",
+            "<p></p>",
+            "<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
+            "</p><p>Stylish Para 1</p>",
+            "<p>Stylish Para 2</p>",
+            ""}).collect(Collectors.joining("\n")),
+        apply(new HtmlPolicyBuilder()
+              .allowCommonInlineFormattingElements()
+              .allowCommonBlockElements()
+              .allowStyling(
+                      CssSchema.withProperties(
+                          Map.of("text-align",
+                              new CssSchema.Property(0,
+                                  Set.of("left", "right"),
+                                  Collections.emptyMap()))))
+              .allowStandardUrlProtocols()));
+  }
+
   @Test
   public static final void testElementTransforming() {
     assertEquals(