From 6c2d6dbc0eb20a95e1fe907f953bf4e627856525 Mon Sep 17 00:00:00 2001
From: mark_story <mark@mark-story.com>
Date: Sun, 16 Nov 2008 05:00:41 +0000
Subject: [PATCH] Fixing greedy Sanitize::stripTags().  Fixes #5758.

git-svn-id: https://svn.cakephp.org/repo/branches/1.2.x.x@7876 3807eeeb-6ff5-0310-8944-8be069107fe0
---
 cake/libs/sanitize.php                  |  2 +-
 cake/tests/cases/libs/sanitize.test.php | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/cake/libs/sanitize.php b/cake/libs/sanitize.php
index 707586e23..30d424faf 100644
--- a/cake/libs/sanitize.php
+++ b/cake/libs/sanitize.php
@@ -162,7 +162,7 @@ class Sanitize {
 		$str = $params[0];
 
 		for ($i = 1; $i < count($params); $i++) {
-			$str = preg_replace('/<' . $params[$i] . '[^>]*>/i', '', $str);
+			$str = preg_replace('/<' . $params[$i] . '\b[^>]*>/i', '', $str);
 			$str = preg_replace('/<\/' . $params[$i] . '[^>]*>/i', '', $str);
 		}
 		return $str;
diff --git a/cake/tests/cases/libs/sanitize.test.php b/cake/tests/cases/libs/sanitize.test.php
index c62e9c965..31101445e 100644
--- a/cake/tests/cases/libs/sanitize.test.php
+++ b/cake/tests/cases/libs/sanitize.test.php
@@ -375,6 +375,26 @@ class SanitizeTest extends CakeTestCase {
 		$expected = 'Important<p>Additional information here <img src="/img/test.png" />. Read even more here</p>';
 		$result = Sanitize::stripTags($string, 'h2', 'a');
 		$this->assertEqual($result, $expected);
+
+		$string = '<h2>Important</h2><p>Additional information here <a href="/about"><img src="/img/test.png" /></a>. Read even more here</p>';
+		$expected = 'Important<p>Additional information here . Read even more here</p>';
+		$result = Sanitize::stripTags($string, 'h2', 'a', 'img');
+		$this->assertEqual($result, $expected);
+
+		$string = '<b>Important message!</b><br>This message will self destruct!';
+		$expected = 'Important message!<br>This message will self destruct!';
+		$result = Sanitize::stripTags($string, 'b');
+		$this->assertEqual($result, $expected);
+
+		$string = '<b>Important message!</b><br />This message will self destruct!';
+		$expected = 'Important message!<br />This message will self destruct!';
+		$result = Sanitize::stripTags($string, 'b');
+		$this->assertEqual($result, $expected);
+
+		$string = '<h2 onclick="alert(\'evil\'); onmouseover="badness()">Important</h2><p>Additional information here <a href="/about"><img src="/img/test.png" /></a>. Read even more here</p>';
+		$expected = 'Important<p>Additional information here . Read even more here</p>';
+		$result = Sanitize::stripTags($string, 'h2', 'a', 'img');
+		$this->assertEqual($result, $expected);
 	}
 	/**
  * testFormatColumns method