Изменения

attributes whitelist
Строка 172: Строка 172:  
-- Only these tags can be legitimately empty:
 
-- Only these tags can be legitimately empty:
 
local empty = to_set { 'p', 'th', 'td', 'br', 'hr', 'img' }
 
local empty = to_set { 'p', 'th', 'td', 'br', 'hr', 'img' }
 +
 +
-- Whitelist of allowed HTML attributes:
 +
local allowed_attributes = to_set {
 +
'style', 'align', 'href', 'src', 'alt', 'width', 'height', 'title',
 +
'rowspan', 'colspan'
 +
}
    
local grammar = P { Ct (V'fragment') * -1,
 
local grammar = P { Ct (V'fragment') * -1,
Строка 186: Строка 192:  
local tag = { __name = tbl.__name }
 
local tag = { __name = tbl.__name }
 
for _, attr in ipairs (tbl.__attrs) do
 
for _, attr in ipairs (tbl.__attrs) do
tag [attr.name] = attr.value
+
if allowed_attributes [attr.name] then
 +
tag [attr.name] = attr.value
 +
end
 
end
 
end
 
if tag.__name == 'table' then
 
if tag.__name == 'table' then