From fcd4f7f6c94ac2a017e3e7fcec66af2d474f649b Mon Sep 17 00:00:00 2001
From: Go MAEDA <maeda@farend.jp>
Date: Wed, 11 Jan 2023 13:11:04 +0000
Subject: [PATCH] CommonMark Markdown formatter does not support min-width,
 max-width, min-height, and max-height CSS properties (#38073).

Patch by Go MAEDA.


git-svn-id: https://svn.redmine.org/redmine/trunk@22025 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 .../wiki_formatting/common_mark/sanitization_filter.rb        | 4 ++--
 .../wiki_formatting/common_mark/sanitization_filter_test.rb   | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb b/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb
index adb301290..54e0db4cb 100644
--- a/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb
+++ b/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb
@@ -29,8 +29,8 @@ module Redmine
 
         ALLOWED_CSS_PROPERTIES = %w[
           color background-color
-          width
-          height
+          width min-width max-width
+          height min-height max-height
           padding padding-left padding-right padding-top padding-bottom
           margin margin-left margin-right margin-top margin-bottom
           border border-left border-right border-top border-bottom border-radius border-style border-collapse border-spacing
diff --git a/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb b/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb
index 6741c7174..ca2e141f1 100644
--- a/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb
+++ b/test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb
@@ -97,6 +97,10 @@ if Object.const_defined?(:CommonMarker)
         '<span style="color: #333; background: url(\'https://example.com/evil.svg\')">hello</span>"',
         '<span style="color: #333; ">hello</span>"'
       ],
+      [
+        '<img src="photo.jpg" style="min-width: 100px; max-width: 200px; min-height: 100px; max-height: 200px;">',
+        '<img src="photo.jpg" style="min-width: 100px; max-width: 200px; min-height: 100px; max-height: 200px;">'
+      ],
       [
         '<b>Lo<!-- comment -->rem</b> <a href="pants" title="foo" style="text-decoration: underline;">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br/>amet <style>.foo { color: #fff; }</style> <script>alert("hello world");</script>',
         '<b>Lorem</b> <a href="pants" title="foo">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br>amet .foo { color: #fff; } '