diff --git a/core/lib/presentation/utils/html_transformer/text/standardize_html_sanitizing_transformers.dart b/core/lib/presentation/utils/html_transformer/text/standardize_html_sanitizing_transformers.dart
index 0f6ebe092..9ff53ac2a 100644
--- a/core/lib/presentation/utils/html_transformer/text/standardize_html_sanitizing_transformers.dart
+++ b/core/lib/presentation/utils/html_transformer/text/standardize_html_sanitizing_transformers.dart
@@ -20,6 +20,9 @@ class StandardizeHtmlSanitizingTransformers extends TextTransformer {
'style',
'body',
'section',
+ 'google-sheets-html-origin',
+ 'colgroup',
+ 'col',
'nav',
'main',
'footer',
diff --git a/core/test/utils/standardize_html_sanitizing_transformers_test.dart b/core/test/utils/standardize_html_sanitizing_transformers_test.dart
index 8d6dc2471..d597b26e4 100644
--- a/core/test/utils/standardize_html_sanitizing_transformers_test.dart
+++ b/core/test/utils/standardize_html_sanitizing_transformers_test.dart
@@ -6,67 +6,80 @@ void main() {
group('StandardizeHtmlSanitizingTransformers::test', () {
const transformer = StandardizeHtmlSanitizingTransformers();
const htmlEscape = HtmlEscape();
+ const listHTMLTags = [
+ 'div',
+ 'span',
+ 'p',
+ 'a',
+ 'i',
+ 'table',
+ 'font',
+ 'u',
+ 'center',
+ 'style',
+ 'section',
+ 'google-sheets-html-origin',
+ ];
+ const listOnEventAttributes = [
+ 'mousedown',
+ 'mouseenter',
+ 'mouseleave',
+ 'mousemove',
+ 'mouseover',
+ 'mouseout',
+ 'mouseup',
+ 'load',
+ 'unload',
+ 'loadstart',
+ 'loadeddata',
+ 'loadedmetadata',
+ 'playing',
+ 'show',
+ 'error',
+ 'message',
+ 'focus',
+ 'focusin',
+ 'focusout',
+ 'keydown',
+ 'keypress',
+ 'keyup',
+ 'input',
+ 'ended',
+ 'drag',
+ 'drop',
+ 'dragstart',
+ 'dragover',
+ 'dragleave',
+ 'dragend',
+ 'dragenter',
+ 'beforeunload',
+ 'beforeprint',
+ 'afterprint',
+ 'blur',
+ 'click',
+ 'change',
+ 'contextmenu',
+ 'cut',
+ 'copy',
+ 'dblclick',
+ 'abort',
+ 'durationchange',
+ 'progress',
+ 'resize',
+ 'reset',
+ 'scroll',
+ 'seeked',
+ 'select',
+ 'submit',
+ 'toggle',
+ 'volumechange',
+ 'touchstart',
+ 'touchmove',
+ 'touchend',
+ 'touchcancel',
+ ];
test('SHOULD remove all `on*` attributes tag', () {
- const listOnEventAttributes = [
- 'mousedown',
- 'mouseenter',
- 'mouseleave',
- 'mousemove',
- 'mouseover',
- 'mouseout',
- 'mouseup',
- 'load',
- 'unload',
- 'loadstart',
- 'loadeddata',
- 'loadedmetadata',
- 'playing',
- 'show',
- 'error',
- 'message',
- 'focus',
- 'focusin',
- 'focusout',
- 'keydown',
- 'keydpress',
- 'keydup',
- 'input',
- 'ended',
- 'drag',
- 'drop',
- 'dragstart',
- 'dragover',
- 'dragleave',
- 'dragend',
- 'dragenter',
- 'beforeunload',
- 'beforeprint',
- 'afterprint',
- 'blur',
- 'click',
- 'change',
- 'contextmenu',
- 'cut',
- 'copy',
- 'dblclick',
- 'abort',
- 'durationchange',
- 'progress',
- 'resize',
- 'reset',
- 'scroll',
- 'seeked',
- 'select',
- 'submit',
- 'toggle',
- 'volumechange',
- 'touchstart',
- 'touchmove',
- 'touchend',
- 'touchcancel'
- ];
-
for (var i = 0; i < listOnEventAttributes.length; i++) {
final inputHtml = '';
final result = transformer.process(inputHtml, htmlEscape);
@@ -76,22 +89,6 @@ void main() {
});
test('SHOULD remove all `on*` attributes for any tags', () {
- const listOnEventAttributes = [
- 'mousedown', 'mouseenter', 'mouseleave', 'mousemove', 'mouseover',
- 'mouseout', 'mouseup', 'load', 'unload', 'loadstart', 'loadeddata',
- 'loadedmetadata', 'playing', 'show', 'error', 'message', 'focus',
- 'focusin', 'focusout', 'keydown', 'keypress', 'keyup', 'input', 'ended',
- 'drag', 'drop', 'dragstart', 'dragover', 'dragleave', 'dragend', 'dragenter',
- 'beforeunload', 'beforeprint', 'afterprint', 'blur', 'click', 'change',
- 'contextmenu', 'cut', 'copy', 'dblclick', 'abort', 'durationchange',
- 'progress', 'resize', 'reset', 'scroll', 'seeked', 'select', 'submit',
- 'toggle', 'volumechange', 'touchstart', 'touchmove', 'touchend', 'touchcancel'
- ];
-
- const listHTMLTags = [
- 'div', 'span', 'p', 'a', 'u', 'i', 'table', 'section'
- ];
-
for (var tag in listHTMLTags) {
for (var event in listOnEventAttributes) {
final inputHtml = '<$tag on$event="javascript:alert(1)">$tag>';
@@ -102,6 +99,24 @@ void main() {
}
});
+ test('SHOULD remove all `on*` attributes for `colgroup` tag', () {
+ for (var event in listOnEventAttributes) {
+ final inputHtml = '