[upstream] [GHS] CKEditor 5 does not retain custom HTML tags that are not defined by CKEditor 5 plugins whenever /.*/ is not allowed (e.g. when filter_html is enabled)

Created on 24 January 2023, almost 2 years ago
Updated 2 November 2023, about 1 year ago

Problem/Motivation

If a site has a custom, non-HTML5 tag (<foo>) which is listed in the "Source editing" plugin settings, and the site is also using the filter "Limit allowed HTML tags and correct faulty HTML", the custom tag should be allowed and not filtered out. Tags in "Source editing" and "Allowed HTML tags" should be exempt being filtered out, should override the filter for faulty HTML. Without this, the only way to allow such a custom tag is to disable the filter, which disables the security protections the filter was created for.

This issue is spun off as a child issue from this issue: "[upstream] Consider allowing styles for non-HTML5 tags (3280124)".
In the discussion of that parent issue two separate concerns were surfaced.
"Allowing styles for non-HTML5 tags"
and
"CKEditor5 retaining non-HTML5 tags that are entered in the Allowed Tags.
This child issue is to track this separate issue of CKEditor5 retaining non-HTML5 tags.

Steps to reproduce

1. Create a text format using CKEditor 5
2. Check the filter "Limit allowed HTML tags and correct faulty HTML"
3. In "Source editing" enter <foo>
4. Note that <foo> is in the "Allowed HTML tags" list, and save
6. Create/edit content using this text filter
7. Click "Source" and add <foo>Some text</foo>
8. Click "Source"
9. Click "Source" again and note that "<foo>" and "</foo>" are not there, have been filtered out
10. In the text format, uncheck "Limit allowed HTML tags and correct faulty HTML" and try again, the foo tags are not filtered out

alternatively, just import this config:

Note that in this text format's CKEditor 5 instance, you can create a <foo> tag. Now just enable filter_html on the text format and observe how suddenly you no longer can!

Proposed resolution

Wait for https://github.com/ckeditor/ckeditor5/issues/13343 to be fixed & shipped in a release.

Remaining tasks

Once this child issue is resolved, please consider allowing non-HTML5 Styles (in the Styles drop-down).

User interface changes

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Postponed

Version

11.0 🔥

Component
CKEditor 5 

Last updated 1 day ago

Created by

🇺🇸United States will_frank

Live updates comments and jobs are added and updated live.
  • Needs tests

    The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

  • Regression

    It restores functionality that was present in earlier versions.

  • JavaScript

    Affects the content, performance, or handling of Javascript.

Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024