bleach stripping style that should be allowed

Viewed 304

I have the following string:

html = '<div id="cover" style="display: block; height: 682px"><div class="cover-desktop hidden-xs" style="background-image: linear-gradient(rgba(0, 0, 0, 0.45), rgba(0, 0, 0, 0.45)), url(\'/site_media/covers/cover.jpg\')"></div></div>'

And these are my options:

ALLOWED_TAGS = bleach.sanitizer.ALLOWED_TAGS + [
    'p',
    'div',
    'table',
    'br',
    'style'
]
ALLOWED_STYLES = ['display', 'height', 'background-image']
ALLOWED_ATTRIBUTES = {
    '*': ['id', 'class', 'style']
}

However when running bleach.clean, the background-image style is getting stripped:

cleaned_html = bleach.clean(html, tags=ALLOWED_TAGS, styles=ALLOWED_STYLES, attributes=ALLOWED_ATTRIBUTES)

Output:

u'<div id="cover" style="display: block; height: 682px;"><div class="cover-desktop hidden-xs" style=""></div></div>'

Why? And how can I fix that?

In fact, how can I allow any style? '*' doesn't do the trick.

edit: it turns out it's because of the background image url(). If a rule containts url it just gets stripped. Here's their code in BleachSanitizerFilter.sanitize_css:

# Drop any url values before we do anything else
style = re.compile(r"url\s*\(\s*[^\s)]+?\s*\)\s*").sub(" ", style)

So how am I supposed to allow background-image property then?

0 Answers
Related