Repository: flavorjones/loofah (Ruby)

Issue:
border-collapse other than "collapse" is stripped, even when safelisted
Any valid properties for `border-collapse` except `collapse` is being stripped out; `initial`, `unset`, `inherit`, etc. This makes it impossible to do `border-radius` on tables that have a stylesheet default of `collapse`.

This happens with all of the scrubbers (that I know of) that would affect this: `prune`, `strip`, `whitewash`.

Example:

```ruby
>> Loofah.fragment(%Q(<table style="border-collapse: separate;"><tr><td></td></tr></table)).scrub!(:prune).to_s
=> "<table><tr><td></td></tr></table>"
```

But:

```ruby
>> Loofah::HTML5::SafeList::ALLOWED_CSS_PROPERTIES.include?('border-collapse')
=> true
```


Discussion:
@bbugh Thanks for opening this issue, and sorry for my slow reply. I've reproduced this and it's because `collapse` is a member of `Loofah::HTML5::SafeList::ACCEPTABLE_CSS_KEYWORDS`.

See #214 for the fix.
Thank you! No problem, you're a champion for all the work you do to keep this running. 
Fixed in v2.11.0



Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c78bee0..2d044a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Features
 
 * Allow HTML5 element `wbr`.
+* Allow all CSS property values for `border-collapse`. [[#201](https://github.com/flavorjones/loofah/issues/201)]
 
 
 ### Changes
diff --git a/lib/loofah/html5/safelist.rb b/lib/loofah/html5/safelist.rb
index 583ea8c..1bde02c 100644
--- a/lib/loofah/html5/safelist.rb
+++ b/lib/loofah/html5/safelist.rb
@@ -638,6 +638,8 @@ module SafeList
                                           "green",
                                           "groove",
                                           "hidden",
+                                          "inherit",
+                                          "initial",
                                           "inset",
                                           "italic",
                                           "left",
@@ -653,16 +655,19 @@ module SafeList
                                           "pointer",
                                           "purple",
                                           "red",
+                                          "revert",
                                           "ridge",
                                           "right",
+                                          "separate",
                                           "silver",
                                           "solid",
                                           "teal",
-                                          "thin",
                                           "thick",
+                                          "thin",
                                           "top",
                                           "transparent",
                                           "underline",
+                                          "unset",
                                           "white",
                                           "yellow",
                                         ])


Test patch:
diff --git a/test/integration/test_ad_hoc.rb b/test/integration/test_ad_hoc.rb
index 5308ecd..356e8d1 100644
--- a/test/integration/test_ad_hoc.rb
+++ b/test/integration/test_ad_hoc.rb
@@ -287,5 +287,33 @@ def test_dont_remove_whitespace_between_tags
 
       assert_equal(expected, actual.to_html)
     end
+
+    it "allows border-collapse property values" do
+      # https://github.com/flavorjones/loofah/issues/201
+      # https://developer.mozilla.org/en-US/docs/Web/CSS/border-collapse
+      input = <<~EOF
+        <table style='border-collapse: collapse;'></table>
+        <table style='border-collapse: separate;'></table>
+        <table style='border-collapse: not-allowed;'></table>
+        <table style='border-collapse: inherit;'></table>
+        <table style='border-collapse: initial;'></table>
+        <table style='border-collapse: revert;'></table>
+        <table style='border-collapse: unset;'></table>
+      EOF
+
+      expected = <<~EOF
+        <table style=\"border-collapse:collapse;\"></table>
+        <table style=\"border-collapse:separate;\"></table>
+        <table></table>
+        <table style=\"border-collapse:inherit;\"></table>
+        <table style=\"border-collapse:initial;\"></table>
+        <table style=\"border-collapse:revert;\"></table>
+        <table style=\"border-collapse:unset;\"></table>
+      EOF
+
+      actual = Loofah.scrub_fragment(input, :escape)
+
+      assert_equal(expected, actual.to_html)
+    end
   end
 end