diff --git a/elasticsearch/x-pack/src/main/java/org/elasticsearch/xpack/notification/email/HtmlSanitizer.java b/elasticsearch/x-pack/src/main/java/org/elasticsearch/xpack/notification/email/HtmlSanitizer.java index 100b2c92301..7cc8f514ebc 100644 --- a/elasticsearch/x-pack/src/main/java/org/elasticsearch/xpack/notification/email/HtmlSanitizer.java +++ b/elasticsearch/x-pack/src/main/java/org/elasticsearch/xpack/notification/email/HtmlSanitizer.java @@ -86,6 +86,8 @@ public class HtmlSanitizer { case "_tables": policyBuilder.allowElements(TABLE_TAGS); policyBuilder.allowAttributes("span").onElements("col"); + policyBuilder.allowAttributes("border", "cellpadding").onElements("table"); + policyBuilder.allowAttributes("colspan", "rowspan").onElements("th", "td"); break; case "_links": policyBuilder.allowElements("a") diff --git a/elasticsearch/x-pack/src/test/java/org/elasticsearch/xpack/notification/email/HtmlSanitizerTests.java b/elasticsearch/x-pack/src/test/java/org/elasticsearch/xpack/notification/email/HtmlSanitizerTests.java index ac5d1c561c3..e17825a85a1 100644 --- a/elasticsearch/x-pack/src/test/java/org/elasticsearch/xpack/notification/email/HtmlSanitizerTests.java +++ b/elasticsearch/x-pack/src/test/java/org/elasticsearch/xpack/notification/email/HtmlSanitizerTests.java @@ -75,7 +75,7 @@ public class HtmlSanitizerTests extends ESTestCase { } public void testDefaultTablesAllowed() { - String html = "" + + String html = "
" + "" + "" + "" + @@ -83,7 +83,7 @@ public class HtmlSanitizerTests extends ESTestCase { "" + "" + "" + - "" + + "" + "" + "" + "" + @@ -105,6 +105,14 @@ public class HtmlSanitizerTests extends ESTestCase { assertThat(sanitizedHtml, equalTo(html)); } + public void testAllowStyles() { + String html = "
caption
header1header1header2
"; + Settings settings = Settings.builder().putArray("xpack.notification.email.html.sanitization.allow", "_tables", "_styles").build(); + HtmlSanitizer sanitizer = new HtmlSanitizer(settings); + String sanitizedHtml = sanitizer.sanitize(html); + assertThat(sanitizedHtml, equalTo(html)); + } + public void testDefaultFormattingAllowed() { String html = "" + "

";