Merge pull request #50 from benubois/strip_script_contents

Strip contents of <script> tags.
gjtorikian · Apr 10, 2013 · d4ef9db · d4ef9db
2 parents 0cd6136 + c912d6d
commit d4ef9db
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/lib/html/pipeline/sanitization_filter.rb b/lib/html/pipeline/sanitization_filter.rb
@@ -35,6 +35,7 @@ class SanitizationFilter < Filter
           div ins del sup sub p ol ul table blockquote dl dt dd
           kbd q samp var hr ruby rt rp li tr td th
         ),
+        :remove_contents => ['script'],
         :attributes => {
           'a' => ['href'],
           'img' => ['src'],

diff --git a/test/html/pipeline/sanitization_filter_test.rb b/test/html/pipeline/sanitization_filter_test.rb
@@ -44,4 +44,9 @@ def test_github_specific_protocols_are_not_removed
     stuff = '<a href="github-windows://spillthelog">Spill this yo</a> and so on'
     assert_equal stuff, SanitizationFilter.call(stuff).to_s
   end
+
+  def test_script_contents_are_removed
+    orig = '<script>JavaScript!</script>'
+    assert_equal "", SanitizationFilter.call(orig).to_s
+  end
 end