diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java index f5b176df..31988114 100644 --- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java +++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java @@ -109,7 +109,7 @@ public HtmlElementTables( LI_TAG = indexForName("li"); SELECT_TAG = indexForName("select"); OPTION_TAG = indexForName("option"); - OPTGROUP_TAG = indexForName("opgroup"); + OPTGROUP_TAG = indexForName("optgroup"); SCRIPT_TAG = indexForName("script"); STYLE_TAG = indexForName("style"); TABLE_TAG = indexForName("table"); diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/OptgroupBugTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/OptgroupBugTest.java new file mode 100644 index 00000000..5e99c0ec --- /dev/null +++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/OptgroupBugTest.java @@ -0,0 +1,27 @@ +package org.owasp.html; + +import org.junit.Test; +import static org.junit.Assert.assertEquals; + +public class OptgroupBugTest { + + /** + * Test that optgroup elements inside select are not corrupted with extra select tags. + * + * Before fix: + * After fix: + */ + @Test + public void testOptgroupInsideSelectDoesNotAddExtraSelectTags() { + PolicyFactory factory = new HtmlPolicyBuilder() + .allowElements("select", "optgroup", "option") + .allowAttributes("label").globally() + .toFactory(); + + String input = ""; + String result = factory.sanitize(input); + + // The key assertion: no extra select tags should be inserted + assertEquals(input, result); + } +} \ No newline at end of file