lib/loofah/html5/scrub.rb in loofah-2.1.1 vs lib/loofah/html5/scrub.rb in loofah-2.2.0

@@ -77,10 +77,10 @@
           sanitized_tree = []
 
           style_tree.each do |node|
             next unless node[:node] == :property
             next if node[:children].any? do |child|
-              [:url, :bad_url, :function].include? child[:node]
+              [:url, :bad_url].include?(child[:node]) || (child[:node] == :function && !WhiteList::ALLOWED_CSS_FUNCTIONS.include?(child[:name].downcase))
             end
             name = node[:name].downcase
             if WhiteList::ALLOWED_CSS_PROPERTIES.include?(name) || WhiteList::ALLOWED_SVG_PROPERTIES.include?(name)
               sanitized_tree << node << CRASS_SEMICOLON
             elsif WhiteList::SHORTHAND_CSS_PROPERTIES.include?(name.split('-').first)