Строка 172: |
Строка 172: |
| -- Only these tags can be legitimately empty: | | -- Only these tags can be legitimately empty: |
| local empty = to_set { 'p', 'th', 'td', 'br', 'hr', 'img' } | | local empty = to_set { 'p', 'th', 'td', 'br', 'hr', 'img' } |
| + | |
| + | -- Whitelist of allowed HTML attributes: |
| + | local allowed_attributes = to_set { |
| + | 'style', 'align', 'href', 'src', 'alt', 'width', 'height', 'title', |
| + | 'rowspan', 'colspan' |
| + | } |
| | | |
| local grammar = P { Ct (V'fragment') * -1, | | local grammar = P { Ct (V'fragment') * -1, |
Строка 186: |
Строка 192: |
| local tag = { __name = tbl.__name } | | local tag = { __name = tbl.__name } |
| for _, attr in ipairs (tbl.__attrs) do | | for _, attr in ipairs (tbl.__attrs) do |
− | tag [attr.name] = attr.value | + | if allowed_attributes [attr.name] then |
| + | tag [attr.name] = attr.value |
| + | end |
| end | | end |
| if tag.__name == 'table' then | | if tag.__name == 'table' then |