sanitizehtml: disallow tables

common/data/text/sanitizehtml/sanitize_test.go

 // Copyright 2017 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package sanitizehtml
 
 import (
         "bytes"
         "strings"
         "testing"
@@ skipping 62 matching lines @@
                 },
                 {
                         `<a href="https:///foo">link</a>`,
                         `<a rel="noopener" target="_blank" href="about:invalid#sanitized&amp;reason=relative-url">link</a>`,
                 },
                 {
                         `<<a href=abc>`,
                         `&lt;<a rel="noopener" target="_blank" href="about:invalid#sanitized&amp;reason=disallowed-scheme"></a>`,
                 },
 
-                // Tables
-                {
-                        `<table>
-                                <tr colspan="2">
-                                        <td rowspan=2>a</td>
-                                </tr>
-                                <tr style="">
-                                        <td>b</td>
-                                        <td>c</td>
-                                </tr>
-                        </table>`,
-                        `<table>
-                                <tr colspan="2">
-                                        <td rowspan="2">a</td>
-                                </tr>
-                                <tr>
-                                        <td>b</td>
-                                        <td>c</td>
-                                </tr>
-                        </table>`,
-                },
-
                 // Other
                 {
                         `<div><strong>hello</strong></div>`,
                         `<strong>hello</strong>`,
                 },
                 {
                         `&lt;`,
                         `&lt;`,
                 },
                 {
@@ skipping 17 matching lines @@
         for _, c := range cases {
                 c := c
                 Convey(c.in, t, func() {
                         buf := &bytes.Buffer{}
                         err := Sanitize(buf, strings.NewReader(c.in))
                         So(err, ShouldBeNil)
                         So(buf.String(), ShouldEqual, c.out)
                 })
         }
 }