remove contents of script and style elements

Avoids rendering HTML-ized CSS and/or Javascript by removing the
contents of script and style elements as well as the elements
themselves.

/cc @technoweenie

Pull Request: master

lib/gollum/sanitization.rb

@@ -55,6 +55,13 @@ module Gollum
       end
     end
 
+    # Default elements whose contents will be removed in addition
+    # to the elements themselve
+    REMOVE_CONTENTS = [
+      'script',
+      'style'
+      ].freeze
+
     # Default transformers to force @id attributes with 'wiki-' prefix
     TRANSFORMERS = [
       lambda do |env|
@@ -104,18 +111,23 @@ module Gollum
     # Default: {}
     attr_reader :add_attributes
 
+    # Gets an Array of element names whose contents will be removed in addition
+    # to the elements themselves. Default: REMOVE_CONTENTS
+    attr_reader :remove_contents
+
     # Sets a boolean determining whether Sanitize allows HTML comments in the
     # output.  Default: false.
     attr_writer :allow_comments
 
     def initialize
-      @elements       = ELEMENTS
+      @elements         = ELEMENTS
-      @attributes     = ATTRIBUTES
+      @attributes       = ATTRIBUTES
-      @protocols      = PROTOCOLS
+      @protocols        = PROTOCOLS
-      @transformers   = TRANSFORMERS
+      @transformers     = TRANSFORMERS
-      @add_attributes = {}
+      @add_attributes   = {}
-      @allow_comments = false
+      @remove_contents  = REMOVE_CONTENTS
-      @id_prefix      = 'wiki-'
+      @allow_comments   = false
+      @id_prefix        = 'wiki-'
       yield self if block_given?
     end
 
@@ -140,13 +152,14 @@ module Gollum
     #
     # Returns a Hash.
     def to_hash
-      { :elements       => elements,
+      { :elements         => elements,
-        :attributes     => attributes,
+        :attributes       => attributes,
-        :protocols      => protocols,
+        :protocols        => protocols,
-        :add_attributes => add_attributes,
+        :add_attributes   => add_attributes,
-        :allow_comments => allow_comments?,
+        :remove_contents  => remove_contents,
-        :transformers   => transformers,
+        :allow_comments   => allow_comments?,
-        :id_prefix      => id_prefix
+        :transformers     => transformers,
+        :id_prefix        => id_prefix
       }
     end
 

test/test_markup.rb

@@ -459,6 +459,18 @@ np.array([[2,2],[1,3]],np.float)
     compare(content, output)
   end
 
+  test "removes style blocks completely" do
+    content = "<style>body { color: red }</style>foobar"
+    output = "<p>foobar</p>"
+    compare(content, output)
+  end
+
+  test "removes script blocks completely" do
+    content = "<script>alert('hax');</script>foobar"
+    output = "<p>foobar</p>"
+    compare(content, output)
+  end
+
   test "escaped wiki link" do
     content = "a '[[Foo]], b"
     output = "<p>a [[Foo]], b</p>"