diff --git a/inline_test.go b/inline_test.go index 48bf5f6..59afedb 100644 --- a/inline_test.go +++ b/inline_test.go @@ -204,16 +204,13 @@ func TestRawHtmlTag(t *testing.T) { // Additonal token types: SelfClosing, Comment, DocType. "
", - "


\n", + "


\n", "", "\n", "", "

<!DOCTYPE test>

\n", - - "
", - "
\n", } doTestsInlineParam(t, tests, 0, HTML_SKIP_STYLE|HTML_SANITIZE_OUTPUT) } @@ -229,6 +226,21 @@ func TestQuoteEscaping(t *testing.T) { doTestsInlineParam(t, tests, 0, HTML_SKIP_STYLE|HTML_SANITIZE_OUTPUT) } +func TestSanitizeSelfClosingTag(t *testing.T) { + tests := []string{ + "
\n", + "
\n", + + "
\n", + "
\n", + + // Make sure that evil attributes are stripped for self closing tags. + "
\n", + "
\n", + } + doTestsInlineParam(t, tests, 0, HTML_SKIP_STYLE|HTML_SANITIZE_OUTPUT) +} + func TestEmphasis(t *testing.T) { var tests = []string{ "nothing inline\n", diff --git a/sanitize.go b/sanitize.go index 92a0cc3..68e9e03 100644 --- a/sanitize.go +++ b/sanitize.go @@ -103,7 +103,11 @@ func sanitizeHtmlSafe(input []byte) []byte { wr.WriteByte('"') } } - wr.WriteString(">") + if t == html.SelfClosingTagToken { + wr.WriteString("/>") + } else { + wr.WriteString(">") + } } else { wr.WriteString(html.EscapeString(string(tokenizer.Raw()))) }