Reviewers: ihab.awad,

Description:
<div class="!...@#$%"></div> is valid html, and it was accepted by
an earlier version of caja, but now it isn't.

This change removes the constraint.

Please review this at http://codereview.appspot.com/89073

Affected files:
  M     src/com/google/caja/plugin/templates/TemplateCompiler.java
  M     tests/com/google/caja/plugin/templates/TemplateCompilerTest.java


Index: tests/com/google/caja/plugin/templates/TemplateCompilerTest.java
===================================================================
--- tests/com/google/caja/plugin/templates/TemplateCompilerTest.java (revision 3549) +++ tests/com/google/caja/plugin/templates/TemplateCompilerTest.java (working copy)
@@ -298,6 +298,14 @@
         );
   }

+  /** class= attributes are CDATA, non-alphanumerics should be allowed. */
+  public void test1057ClassNames() throws Exception {
+    assertSafeHtml(
+        htmlFragment(fromString("<div class='*...@$'></div>")),
+        htmlFragment(fromString("<div class='*...@$'></div>")),
+        new Block());
+  }
+
   private void assertSafeHtml(
       DocumentFragment input, DocumentFragment htmlGolden, Block jsGolden)
       throws ParseException {
Index: src/com/google/caja/plugin/templates/TemplateCompiler.java
===================================================================
--- src/com/google/caja/plugin/templates/TemplateCompiler.java (revision 3549) +++ src/com/google/caja/plugin/templates/TemplateCompiler.java (working copy)
@@ -274,7 +274,6 @@
     Expression dynamicValue;
     switch (info.getType()) {
       case CLASSES:
-        if (!checkRestrictedNames(value, pos)) { return; }
         dynamicValue = null;
         break;
       case FRAME_TARGET:


Reply via email to