Skip to content

Preserve text gates in renamed literal-content elements - #489

Merged
jmanico merged 1 commit into
OWASP:mainfrom
goutamadwant:fix/renamed-literal-text-gate
Sep 13, 2026
Merged

Preserve text gates in renamed literal-content elements#489
jmanico merged 1 commit into
OWASP:mainfrom
goutamadwant:fix/renamed-literal-text-gate

Conversation

@goutamadwant

Copy link
Copy Markdown
Contributor

Summary

Fixes #482.

When an ElementPolicy renamed a container to an element such as style, a
nested allowed element could become the policy's active text container even
though the renderer could not emit its tag inside literal content. That let the
nested text bypass the outer element's text gate.

This change tracks whether a kept literal-content element is open separately
from whether its text is allowed. Nested start tags are treated as dropped
before they can establish another text gate, so their text remains governed by
the outer element. The state is restored when that element closes.

Tests

  • Added negative coverage showing nested text is removed when the renamed
    literal-content element does not allow text.
  • Added positive coverage showing explicitly allowed text still survives while
    the nested tag is removed.
  • Verified a following sibling is unaffected after the literal-content element
    closes.
  • Verified change reporting treats the nested tag as discarded without
    separately reporting its attributes.
  • ./mvnw -ntp -B clean verify passes on JDK 25: 604 library tests and 7 example
    tests.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Text inside an element nested in a rename into a literal-content element bypasses the target's text gate

2 participants