From e4be0eb7e849ea9d132a2bcf1a4ee5087db8bf75 Mon Sep 17 00:00:00 2001
From: Dries Buytaert <dries@buytaert.net>
Date: Thu, 1 Jul 2010 19:41:18 +0000
Subject: - Patch #327331 by mr.baileys, wrwrwr: fix filter_xss() to not allow
 empty style/on* attributes at end of opening tag.

---
 modules/filter/filter.test | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'modules')

diff --git a/modules/filter/filter.test b/modules/filter/filter.test
index 954c7eaa8..973a0b779 100644
--- a/modules/filter/filter.test
+++ b/modules/filter/filter.test
@@ -912,6 +912,9 @@ class FilterUnitTestCase extends DrupalUnitTestCase {
 
     $f = _filter_html('<p onerror="alert(0);" />', $filter);
     $this->assertNoNormalized($f, 'onerror', t('HTML filter should remove on* attributes on default.'));
+
+    $f = _filter_html('<code onerror>&nbsp;</code>', $filter);    
+    $this->assertNoNormalized($f, 'onerror', t('HTML filter should remove empty on* attributes on default.'));
   }
 
   /**
-- 
cgit v1.2.3