From b0a622196a793a36bdf77f79185acea85ba39730 Mon Sep 17 00:00:00 2001
From: David Flatz
Date: Mon, 29 Apr 2024 08:38:04 +0200
Subject: Handle whitespace between attribute name and value also for img tags

---
 it_html.class  |  2 +-
 test/it_html.t | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/it_html.class b/it_html.class
index 44a2137..af2ef8c 100644
--- a/it_html.class
+++ b/it_html.class
@@ -421,7 +421,7 @@ static function sanitize($html)
 		list($head, $href, $content, $tail) = $tag;
 		$result .= it_html::sanitize($head) . '<a href="' . it_html::Q(it_html::U(html_entity_decode($href, ENT_COMPAT, $charset))) . '">' . it_html::sanitize($content) . "</a>" . it_html::sanitize($tail);
 	}
-	else if ($tag = it::match('(.*)<img\b[^>]+?src="(' . $urlpattern . ')"[^>]*?>(.*)', $html))
+	else if ($tag = it::match('(.*)<img\b[^>]+?\bsrc\s*=\s*"(' . $urlpattern . ')"[^>]*?>(.*)', $html))
 	{
 		# Image tags, keeps only src attribute
 		list($head, $src, $tail) = $tag;
diff --git a/test/it_html.t b/test/it_html.t
index 4fef25d..11e05dd 100755
--- a/test/it_html.t
+++ b/test/it_html.t
@@ -271,6 +271,24 @@ is(
 	'TODO it_html::sanitize handle anchors with unquoted attribute value'
 );
 
+is(
+	it_html::sanitize('<img src = "http://search.ch/logo.jpg">'),
+	'<img src="http://search.ch/logo.jpg" alt="" />',
+	'it_html::sanitize handle anchors with spaces between attribute name and value in img'
+);
+
+is(
+	it_html::sanitize("<img src='http://search.ch/logo.jpg'/>"),
+	'<img src="http://search.ch/logo.jpg" alt="" />',
+	'TODO it_html::sanitize handle anchors with single quotes at attribute value in img'
+);
+
+is(
+	it_html::sanitize("<img src=http://search.ch/logo.jpg>"),
+	'<img src="http://search.ch/logo.jpg" alt="" />',
+	'TODO it_html::sanitize handle anchors with unquoted attribute value in img'
+);
+
 foreach (json_decode(it::file_get_contents(dirname($argv[0]) . '/U_tests.json'), true) as $test)
 	is(U(...$test['args']), $test['exp'], $test['name']);
 
-- 
cgit v1.2.3