From d482fc50fb59e561b93a0e336680938ffac7fd22 Mon Sep 17 00:00:00 2001
From: Jesse Glick <jglick@cloudbees.com>
Date: Wed, 24 Apr 2013 16:33:29 -0400
Subject: [PATCH] [FIXED SECURITY-67] Forbid CSS links in markup to be on the
 safe side.(cherry picked from commit
 1e19eb3ecece1931b5363a797fd2b30f8edc6180)

---
 core/src/main/java/hudson/markup/MyspacePolicy.java     | 1 -
 core/src/test/java/hudson/markup/MyspacePolicyTest.java | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/core/src/main/java/hudson/markup/MyspacePolicy.java b/core/src/main/java/hudson/markup/MyspacePolicy.java
index f0543f9538..46d0c31e22 100644
--- a/core/src/main/java/hudson/markup/MyspacePolicy.java
+++ b/core/src/main/java/hudson/markup/MyspacePolicy.java
@@ -67,7 +67,6 @@ public class MyspacePolicy {
             tag("img",      "src",ONSITE_OR_OFFSITE_URL,
                             "hspace","vspace");
             tag("iframe",   "src");
-            tag("link",     "type","rel");
             tag("ul,ol,li,dd,dl,dt,thead,tbody,tfoot");
             tag("table",    "noresize");
             tag("td,th,tr");
diff --git a/core/src/test/java/hudson/markup/MyspacePolicyTest.java b/core/src/test/java/hudson/markup/MyspacePolicyTest.java
index cb1a63e2bb..75ac37b28c 100644
--- a/core/src/test/java/hudson/markup/MyspacePolicyTest.java
+++ b/core/src/test/java/hudson/markup/MyspacePolicyTest.java
@@ -43,7 +43,7 @@ public class MyspacePolicyTest extends Assert {
         assertReject("script","<script src='relative.js'></script>");
 
         assertIntact("<style>H1 { display:none; }</style>");
-        assertIntact("<link rel='stylesheet' type='text/css' href='http://www.microsoft.com/'>");
+        assertReject("link", "<link rel='stylesheet' type='text/css' href='http://www.microsoft.com/'>");
         assertIntact("<div style='background-color:white'>inline CSS</div>");
         assertIntact("<br><hr>");