Would it be possible and safe to whitelist some CSS functions?

[NikoRoberts]

At the moment scrub_css will drop an entire inline style attribute if a CSS function is used.

For example:

# ruby 2.3.3
# loofah 2.0.3
2.3.3 :001 > Loofah.fragment("<div style='background-color: red;'></div>").scrub!(:strip).to_html
 => "<div style=\"background-color: red;\"></div>" 
2.3.3 :002 > Loofah.fragment("<div style='background-color: red; margin-left: calc(100% - 4em)'></div>").scrub!(:strip).to_html
 => "<div></div>" 

Is there a situation where whitelisting calc would be a bad idea?

[oluwayetty]

My team is also currently stuck on a whitelisting issue for the attribute list-style-type.
And apparently from this link, it's also not included and I'm wondering if one PR can be raised to include these attributes that are needed for other projects but not included.

[flavorjones]

Generally speaking, I think the right thing to do is to make it easier/possible to extend what's whitelisted by Loofah. Many people have asked for tags, attributes or functions to be whitelisted, and honestly I'd rather the core library be as conservative as possible and force users to opt into additional non-obvious tags/attributes/functions.

[flavorjones]

Merged pull request, this will be in the next release, planned to be 2.2.0 this weekend.