OWASP / java-html-sanitizer / 205

94%

push

travis-ci

Properly parse srcset attributes

Fixes issue #112

Previously, extra URL handling for `src`, `href` and related attributes
was naively applied to `srcset`.

This failed safe but mangled content.

I consolidated (in a previous commit) the code that ensures that URL and `style`
attributes have extra checks done: the global URL and style policies
respectively.

This commit adds special handling for srcset which uses the global URL policy
to vet each URL policy and leaves the metadata portion alone.

Commas in the middle of URLs in a `srcset` value will be escaped to `%2c`.

89 of 89 new or added lines in 3 files covered. (100.0%)

4078 of 4415 relevant lines covered (92.37%)

3.69 hits per line