Sanitizer: fix logic and add a test. (#35133)

This was broken in 2596c97 inadvertently.
Added a test so that we don't hit this in the future.

diff --git a/js/src/util/sanitizer.js b/js/src/util/sanitizer.js
index f5a8287cd02bb0c43126ad9f85754e4c758e041f..232416f3ab63c35d1472b19f5088efb6df5c0fd4 100644 (file)
--- a/js/src/util/sanitizer.js
+++ b/js/src/util/sanitizer.js
@@ -45,7 +45,7 @@ const allowedAttribute = (attribute, allowedAttributeList) => {
 
   // Check if a regular expression validates the attribute.
   return allowedAttributeList.filter(attributeRegex => attributeRegex instanceof RegExp)
-    .every(regex => regex.test(attributeName))
+    .some(regex => regex.test(attributeName))
 }
 
 export const DefaultAllowlist = {

diff --git a/js/tests/unit/util/sanitizer.spec.js b/js/tests/unit/util/sanitizer.spec.js
index 7379d221f478e2054ffcb31736c944365e7cff49..28d624c878faf2ed74fa738546035c6447533852 100644 (file)
--- a/js/tests/unit/util/sanitizer.spec.js
+++ b/js/tests/unit/util/sanitizer.spec.js
@@ -23,6 +23,31 @@ describe('Sanitizer', () => {
       expect(result).not.toContain('href="javascript:alert(7)')
     })
 
+    it('should sanitize template and work with multiple regex', () => {
+      const template = [
+        '<div>',
+        '  <a href="javascript:alert(7)" aria-label="This is a link" data-foo="bar">Click me</a>',
+        '  <span>Some content</span>',
+        '</div>'
+      ].join('')
+
+      const myDefaultAllowList = DefaultAllowlist
+      // With the default allow list
+      let result = sanitizeHtml(template, myDefaultAllowList, null)
+
+      // `data-foo` won't be present
+      expect(result).not.toContain('data-foo="bar"')
+
+      // Add the following regex too
+      myDefaultAllowList['*'].push(/^data-foo/)
+
+      result = sanitizeHtml(template, myDefaultAllowList, null)
+
+      expect(result).not.toContain('href="javascript:alert(7)') // This is in the default list
+      expect(result).toContain('aria-label="This is a link"') // This is in the default list
+      expect(result).toContain('data-foo="bar"') // We explicitly allow this
+    })
+
     it('should allow aria attributes and safe attributes', () => {
       const template = [
         '<div aria-pressed="true">',