FilterHtml accepts <*> but does not support it, resulting in inaccurate ::getHtmlRestrictions() return value

Created on 2 August 2021, over 3 years ago
Updated 26 February 2024, 10 months ago

Discovered while working on #3216015: Generate CKEditor 5 configuration based on pre-existing text format configuration β†’ for CKEditor 5.

Problem/Motivation

\Drupal\filter\Plugin\Filter\FilterHtml::getHTMLRestrictions

Parses a string of html tags into an array that defines what tags/attributes are allowed by the filter. UPDATE per #6: While \Drupal\filter\Plugin\Filter\FilterHtml::settingsForm() does not check for this (there is zero validation for the allowed_html input 😱), which is why one can be reasonably led to believe that <*> is allowed…

That finding makes all of this wrong/irrelevant:

However, the returned array does not properly represent the config for "star" tags.

Before any parsing of the "allowed html" string occurs all * instaces are replaced.

$star_protector = '__zqh6vxfbk3cg__';
    $html = str_replace('*', $star_protector, $html);

Later in the code, any attributes using * have the star returned

 foreach ($node->attributes as $name => $attribute) {
          // Put back any trailing * on wildcard attribute name.
          $name = str_replace($star_protector, '*', $name);

But stars representing a tag never get un-starred, and the returned array will include the "tag" for the $star_protector string. For example, when it parses a string with the "tag" <* data-donk>


There is configuration for a __zqh6vxfbk3cg__ tag alongside the config for the * tag returned by default

Steps to reproduce

See above.

Proposed resolution

  1. β€” done in https://git.drupalcode.org/project/drupal/-/merge_requests/998/diffs?com...
  2. β€” done in https://git.drupalcode.org/project/drupal/-/merge_requests/998/diffs?com...
  3. β€” done in https://git.drupalcode.org/project/drupal/-/merge_requests/998/diffs?com...

Remaining tasks

None.

User interface changes

API changes

None.

Data model changes

None.

Release notes snippet

None.

πŸ› Bug report
Status

Needs work

Version

11.0 πŸ”₯

Component
FilterΒ  β†’

Last updated 3 days ago

No maintainer
Created by

πŸ‡ΊπŸ‡ΈUnited States bnjmnm Ann Arbor, MI

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024