Contrib.social

Xss::filter() damages attribute names with unconventional chars

Open on Drupal.org →
Created on 5 July 2023, almost 2 years ago

Problem/Motivation

Xss::filter() damages attribute names with chars other than alphanumeric or dash.

E.g. <div data-x_y="hello"></div> becomes <div y="hello"></div>

I already reported this in a comment in #2544110-165: XSS attribute filtering is inconsistent and strips valid attributes → , but I think it is useful to have a dedicated issue for reference.
This is also a place to have a patch that people can use to fix this issue specifically, without a full buy-in to the work from 🐛 XSS attribute filtering is inconsistent and strips valid attributes Needs work .

In the end, fixes for both issues will likely conflict.

Steps to reproduce

Call Xss::filter('<div data-x_y="hello"></div>').

Expected: Either <div data-x_y="hello"></div> or just <div></div>, depending if we want to remove funny-looking attributes (I think we want to keep them).

Actual: <div y="hello"></div>

Proposed resolution

Always parse the complete attribute name. Then decide whether to keep the attribute or not.
(I think in general we just keep it)

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Active

Version

11.0 🔥

Component
Base  →

Last updated about 14 hours ago

Created by

🇩🇪Germany donquixote

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024