diff --git a/lib/rails/html/scrubbers.rb b/lib/rails/html/scrubbers.rb index 6182abb..da15af9 100644 --- a/lib/rails/html/scrubbers.rb +++ b/lib/rails/html/scrubbers.rb @@ -150,7 +150,7 @@ def scrub_attribute(node, attr_node) Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node) end - if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == "xlink:href" && attr_node.value =~ /^\s*[^#\s].*/m + if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == "xlink:href" && attr_node.value =~ /^\s*[^#].*/m attr_node.remove end diff --git a/test/scrubbers_test.rb b/test/scrubbers_test.rb index b0529ea..ed086b2 100644 --- a/test/scrubbers_test.rb +++ b/test/scrubbers_test.rb @@ -1,5 +1,6 @@ # frozen_string_literal: true +require "benchmark" require "minitest/autorun" require "rails-html-sanitizer"