feat: Allow phone links in HTML sanitizer - EXO-73882 - Meeds-io/MIPs…

…#129 (#656) Allow phone links in HTML sanitizer
Meeds-io · Oct 8, 2024 · f6e2434 · f6e2434
1 parent 35c0e29
commit f6e2434
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/commons-component-common/src/main/java/org/exoplatform/commons/utils/HTMLSanitizer.java b/commons-component-common/src/main/java/org/exoplatform/commons/utils/HTMLSanitizer.java
@@ -157,6 +157,8 @@ abstract public class HTMLSanitizer {
                                                                                                                                         "onmouseup")
                                                                                                                                 .matching(HISTORY_BACK)
                                                                                                                                 .onElements("a")
+                                                                                                                                .allowStandardUrlProtocols()
+                                                                                                                                .allowUrlProtocols("tel","ftp")
                                                                                                                                 .requireRelNofollowOnLinks()
                                                                                                                                 .allowAttributes("src")
                                                                                                                                 .matching(ONSITE_OR_OFFSITE_URL)

diff --git a/commons-component-common/src/test/java/org/exoplatform/commons/utils/HTMLSanitizerTest.java b/commons-component-common/src/test/java/org/exoplatform/commons/utils/HTMLSanitizerTest.java
@@ -117,4 +117,11 @@ public void testAllowedSpecialCharactersLinks(){
     }
     assertEquals("https://www.economie.gouv.fr/entreprises/changement-janvier-2022?xtor&#61;ES-29-[BIE_292_20220106]-20220106-[https://www.economie.gouv.fr/entreprises/changement-janvier-2022]", sanitized);
   }
+
+  @Test
+  public void testAllowPhoneLinks() throws Exception {
+    String input = "<a class=\"class\" href=\"tel:+21612345678\" target=\"_self\">link</a>";
+    String sanitized = HTMLSanitizer.sanitize(input);
+    assertEquals("<a class=\"class\" href=\"tel:&#43;21612345678\" rel=\"nofollow\">link</a>", sanitized);
+  }
 }