From 338262b4b54dfe5b7f7110641853dfc55ef26f26 Mon Sep 17 00:00:00 2001
From: dab246 <tdvu@linagora.com>
Date: Tue, 3 Dec 2024 11:55:11 +0700
Subject: [PATCH] TF-3315 Fix TMail web could not display embedded table
 correctly

---
 ...ndardize_html_sanitizing_transformers.dart |   3 +
 ...ize_html_sanitizing_transformers_test.dart | 165 ++++++++++--------
 2 files changed, 93 insertions(+), 75 deletions(-)

diff --git a/core/lib/presentation/utils/html_transformer/text/standardize_html_sanitizing_transformers.dart b/core/lib/presentation/utils/html_transformer/text/standardize_html_sanitizing_transformers.dart
index 0f6ebe092..9ff53ac2a 100644
--- a/core/lib/presentation/utils/html_transformer/text/standardize_html_sanitizing_transformers.dart
+++ b/core/lib/presentation/utils/html_transformer/text/standardize_html_sanitizing_transformers.dart
@@ -20,6 +20,9 @@ class StandardizeHtmlSanitizingTransformers extends TextTransformer {
     'style',
     'body',
     'section',
+    'google-sheets-html-origin',
+    'colgroup',
+    'col',
     'nav',
     'main',
     'footer',
diff --git a/core/test/utils/standardize_html_sanitizing_transformers_test.dart b/core/test/utils/standardize_html_sanitizing_transformers_test.dart
index 8d6dc2471..d597b26e4 100644
--- a/core/test/utils/standardize_html_sanitizing_transformers_test.dart
+++ b/core/test/utils/standardize_html_sanitizing_transformers_test.dart
@@ -6,67 +6,80 @@ void main() {
   group('StandardizeHtmlSanitizingTransformers::test', () {
     const transformer = StandardizeHtmlSanitizingTransformers();
     const htmlEscape = HtmlEscape();
+    const listHTMLTags = [
+      'div',
+      'span',
+      'p',
+      'a',
+      'i',
+      'table',
+      'font',
+      'u',
+      'center',
+      'style',
+      'section',
+      'google-sheets-html-origin',
+    ];
+    const listOnEventAttributes = [
+      'mousedown',
+      'mouseenter',
+      'mouseleave',
+      'mousemove',
+      'mouseover',
+      'mouseout',
+      'mouseup',
+      'load',
+      'unload',
+      'loadstart',
+      'loadeddata',
+      'loadedmetadata',
+      'playing',
+      'show',
+      'error',
+      'message',
+      'focus',
+      'focusin',
+      'focusout',
+      'keydown',
+      'keypress',
+      'keyup',
+      'input',
+      'ended',
+      'drag',
+      'drop',
+      'dragstart',
+      'dragover',
+      'dragleave',
+      'dragend',
+      'dragenter',
+      'beforeunload',
+      'beforeprint',
+      'afterprint',
+      'blur',
+      'click',
+      'change',
+      'contextmenu',
+      'cut',
+      'copy',
+      'dblclick',
+      'abort',
+      'durationchange',
+      'progress',
+      'resize',
+      'reset',
+      'scroll',
+      'seeked',
+      'select',
+      'submit',
+      'toggle',
+      'volumechange',
+      'touchstart',
+      'touchmove',
+      'touchend',
+      'touchcancel',
+    ];
 
     test('SHOULD remove all `on*` attributes tag', () {
-      const listOnEventAttributes = [
-        'mousedown',
-        'mouseenter',
-        'mouseleave',
-        'mousemove',
-        'mouseover',
-        'mouseout',
-        'mouseup',
-        'load',
-        'unload',
-        'loadstart',
-        'loadeddata',
-        'loadedmetadata',
-        'playing',
-        'show',
-        'error',
-        'message',
-        'focus',
-        'focusin',
-        'focusout',
-        'keydown',
-        'keydpress',
-        'keydup',
-        'input',
-        'ended',
-        'drag',
-        'drop',
-        'dragstart',
-        'dragover',
-        'dragleave',
-        'dragend',
-        'dragenter',
-        'beforeunload',
-        'beforeprint',
-        'afterprint',
-        'blur',
-        'click',
-        'change',
-        'contextmenu',
-        'cut',
-        'copy',
-        'dblclick',
-        'abort',
-        'durationchange',
-        'progress',
-        'resize',
-        'reset',
-        'scroll',
-        'seeked',
-        'select',
-        'submit',
-        'toggle',
-        'volumechange',
-        'touchstart',
-        'touchmove',
-        'touchend',
-        'touchcancel'
-      ];
-
       for (var i = 0; i < listOnEventAttributes.length; i++) {
         final inputHtml = '<img src="1" href="1" on${listOnEventAttributes[i]}="javascript:alert(1)">';
         final result = transformer.process(inputHtml, htmlEscape);
@@ -76,22 +89,6 @@ void main() {
     });
 
     test('SHOULD remove all `on*` attributes for any tags', () {
-      const listOnEventAttributes = [
-        'mousedown', 'mouseenter', 'mouseleave', 'mousemove', 'mouseover',
-        'mouseout', 'mouseup', 'load', 'unload', 'loadstart', 'loadeddata',
-        'loadedmetadata', 'playing', 'show', 'error', 'message', 'focus',
-        'focusin', 'focusout', 'keydown', 'keypress', 'keyup', 'input', 'ended',
-        'drag', 'drop', 'dragstart', 'dragover', 'dragleave', 'dragend', 'dragenter',
-        'beforeunload', 'beforeprint', 'afterprint', 'blur', 'click', 'change',
-        'contextmenu', 'cut', 'copy', 'dblclick', 'abort', 'durationchange',
-        'progress', 'resize', 'reset', 'scroll', 'seeked', 'select', 'submit',
-        'toggle', 'volumechange', 'touchstart', 'touchmove', 'touchend', 'touchcancel'
-      ];
-
-      const listHTMLTags = [
-        'div', 'span', 'p', 'a', 'u', 'i', 'table', 'section'
-      ];
-
       for (var tag in listHTMLTags) {
         for (var event in listOnEventAttributes) {
           final inputHtml = '<$tag on$event="javascript:alert(1)"></$tag>';
@@ -102,6 +99,24 @@ void main() {
       }
     });
 
+    test('SHOULD remove all `on*` attributes for `colgroup` tag', () {
+      for (var event in listOnEventAttributes) {
+        final inputHtml = '<table><colgroup on$event="javascript:alert(1)"></colgroup></table>';
+        final result = transformer.process(inputHtml, htmlEscape);
+
+        expect(result, equals('<table><colgroup></colgroup></table>'));
+      }
+    });
+
+    test('SHOULD remove all `on*` attributes for `col` tag', () {
+      for (var event in listOnEventAttributes) {
+        final inputHtml = '<table><colgroup><col on$event="javascript:alert(1)"></colgroup></table>';
+        final result = transformer.process(inputHtml, htmlEscape);
+
+        expect(result, equals('<table><colgroup><col></colgroup></table>'));
+      }
+    });
+
     test('SHOULD remove attributes of IMG tag WHEN they are invalid', () {
       const inputHtml = '<img src="1" href="1" onerror="javascript:alert(1)">';
       final result = transformer.process(inputHtml, htmlEscape);