diff --git a/src/main/java/org/owasp/html/HtmlStreamRenderer.java b/src/main/java/org/owasp/html/HtmlStreamRenderer.java index 9c079d1c..c0fb9dd5 100644 --- a/src/main/java/org/owasp/html/HtmlStreamRenderer.java +++ b/src/main/java/org/owasp/html/HtmlStreamRenderer.java @@ -341,7 +341,7 @@ private static int checkHtmlCdataCloseable( } break; case '>': - if (i >= 2 && sb.charAt(i - 2) == '-' && sb.charAt(i - 2) == '-') { + if (i >= 2 && sb.charAt(i - 2) == '-' && sb.charAt(i - 1) == '-') { if (innerStart < 0) { return i - 2; } // Merged start and end like if (innerStart + 6 > i) { return innerStart; } diff --git a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java index b399e80d..aae1e0cd 100644 --- a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java +++ b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java @@ -994,7 +994,7 @@ public static final void testTextareaIsNotTextArea() { assertEquals("x", textAreaPolicy.sanitize(input)); } - @Test + @Test public static final void testCSSFontSize() { HtmlPolicyBuilder builder = new HtmlPolicyBuilder(); PolicyFactory factory = builder.allowElements("span") @@ -1007,6 +1007,41 @@ public static final void testCSSFontSize() { assertEquals(toSanitizeMedium, factory.sanitize(toSanitizeMedium)); } + @Test + public static final void testCSSChildCombinator() { + HtmlPolicyBuilder builder = new HtmlPolicyBuilder(); + + PolicyFactory factory = builder.allowElements("span","style","h1").allowTextIn("style","h1") + .allowAttributes("type").onElements("style").allowStyling() + .toFactory(); + + + String toSanitize = "\n" + + "

Test

\n" + + "\n" + + ""; + assertEquals(toSanitize, factory.sanitize(toSanitize)); + } private static String apply(HtmlPolicyBuilder b) { return apply(b, EXAMPLE);