Repository: mozilla/bleach

Issue:
Style filter does not work correctly when supplied non-ASCII style attribute
# Environment

Windows 10 Pro
Python 3.7.1
bleach         3.0.2

I've setup so that `color` style will survive after clean() method like below:
```
>>> bleach.clean('<span style="font-family:consolas;color:red">text</span>', tags = ['span'], attributes = {'span': ['style']}, styles = ['color'])
'<span style="color: red;">text</span>'
```

# Problem

When it contains non-ASCII style description such as Japanese font names, the `color` style is omitted.
```
>>> bleach.clean('<span style="font-family:メイリオ;color:red">text</span>', tags = ['span'], attributes = {'span': ['style']}, styles = ['color'])
'<span style="">text</span>'
```
It should retain the `color` style like below:
```
'<span style="color: red;">text</span>'
```

Discussion:
sekineh: Hmm, I can't write utf-8 literal in test py files.
sekineh: In python2, `\w` seems to have different meaning than python3.
It seems regex is not a reliable method for sanitizing something.
sekineh: @willkg I think it's done.
Could you please review this?
sekineh: @willkg I added a commit to satisfy your request!

Patch:
diff --git a/bleach/sanitizer.py b/bleach/sanitizer.py
index 79b80f5..6ccd78c 100644
--- a/bleach/sanitizer.py
+++ b/bleach/sanitizer.py
@@ -593,7 +593,8 @@ class BleachSanitizerFilter(html5lib_shim.SanitizerFilter):
         # the whole thing.
         parts = style.split(';')
         gauntlet = re.compile(
-            r"""^([-/:,#%.'"\sa-zA-Z0-9!]|\w-\w|'[\s\w]+'\s*|"[\s\w]+"|\([\d,%\.\s]+\))*$"""
+            r"""^([-/:,#%.'"\s!\w]|\w-\w|'[\s\w]+'\s*|"[\s\w]+"|\([\d,%\.\s]+\))*$""",
+            flags=re.U
         )
 
         for part in parts:


Test patch:
diff --git a/tests/test_css.py b/tests/test_css.py
index 12f27f3..7e34027 100644
--- a/tests/test_css.py
+++ b/tests/test_css.py
@@ -1,6 +1,8 @@
+# -*- coding: utf-8 -*-
 from functools import partial
 
 import pytest
+import six
 
 from bleach import clean
 
@@ -14,6 +16,11 @@ clean = partial(clean, tags=['p'], attributes=['style'])
         ['color'],
         'color: red;'
     ),
+    (
+        u'font-family: メイリオ; color: red; float: left; background-color: red;',
+        [u'color'],
+        u'color: red;'
+    ),
     (
         'border: 1px solid blue; color: red; float: left;',
         ['color'],
@@ -70,11 +77,19 @@ def test_allowed_css(data, styles, expected):
     p_double = "<p style='{0!s}'>bar</p>"
 
     if '"' in data:
+        if is_python2_unicode(data):
+            p_double = unicode(p_double)
         assert clean(p_double.format(data), styles=styles) == p_double.format(expected)
     else:
+        if is_python2_unicode(data):
+            p_single = unicode(p_single)
         assert clean(p_single.format(data), styles=styles) == p_single.format(expected)
 
 
+def is_python2_unicode(data):
+    return six.PY2 and isinstance(data, unicode)
+
+
 def test_valid_css():
     """The sanitizer should fix missing CSS values."""
     styles = ['color', 'float']