From ff44a27ef69ab7cf3cb942073a9249c754e50728 Mon Sep 17 00:00:00 2001
From: Tayyyyyyy <Tayyyyyyy@users.noreply.github.com>
Date: Wed, 14 Aug 2019 18:25:21 -0700
Subject: [PATCH] Secure style attribute from XSS

---
 code/__HELPERS/text.dm | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/code/__HELPERS/text.dm b/code/__HELPERS/text.dm
index 07f65b412ea..08af11a128c 100644
--- a/code/__HELPERS/text.dm
+++ b/code/__HELPERS/text.dm
@@ -547,6 +547,13 @@ proc/checkhtml(var/t)
 
 /proc/convert_pencode_arg(text, tag, arg)
 	arg = sanitize_simple(html_encode(arg), list("''"="","\""="", "?"=""))
+	// https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#rule-4---css-escape-and-strictly-validate-before-inserting-untrusted-data-into-html-style-property-values
+	var/list/style_attacks = list("javascript:", "expression", "byond:", "file:")
+
+	for(var/style_attack in style_attacks)
+		if(findtext(arg, style_attack))
+			// Do not attempt to render dangerous things
+			return text
 
 	if(tag == "class")
 		return "<span class='[arg]'>"
@@ -555,8 +562,6 @@ proc/checkhtml(var/t)
 		return "<span style='[arg]'>"
 
 	if(tag == "img")
-		if(dd_hasprefix(arg, "byond:") || dd_hasprefix(arg, "file:"))
-			return text
 		var/list/img_props = splittext(arg, ";")
 		if(img_props.len == 3)
 			return "<img src='[img_props[1]]' width='[img_props[2]]' height='[img_props[3]]'>"