EditorHtmlSanitizer
in package
Server-side sanitization of HTML from the parameter editor (ParameterForm with `useEditor`).
Replaces the earlier strip_tags(), which removes only forbidden tags but keeps arbitrary
attributes (onclick, style, href="javascript:"), giving stored XSS when rendered through
|noescape. HTMLPurifier whitelists tags, attributes and allowed CSS properties and repairs
invalid structure.
The whitelist is deliberately tight and matches what the front-end toolbar (rich-editor.js)
can do: bold/italic/underline, alignment, text and background color, lists and tables. No
links, images or block format choice.
Table of Contents
Constants
- ALLOWED_CSS : mixed = 'text-align,color,background-color,' . 'border,...
- Allowed CSS properties inside `style` (HTMLPurifier validates the values).
- ALLOWED_HTML : mixed = 'p[style],br,strong,b,em,i,u,' . 'span[style],u...
- Allowed tags and attributes (HTMLPurifier `HTML.Allowed` syntax).
Properties
- $fullPurifier : HTMLPurifier|null
- $purifier : HTMLPurifier|null
Methods
- purify() : string
- purifyFull() : string
- Sanitization for the content of the full editor ({@see \App\Core\Forms\Form::addEditor()}) that arrives from somewhere other than an admin form, currently HTML descriptions from product import.
- cacheDir() : string|null
- fullInstance() : HTMLPurifier
- instance() : HTMLPurifier
Constants
ALLOWED_CSS
Allowed CSS properties inside `style` (HTMLPurifier validates the values).
private
mixed
ALLOWED_CSS
= 'text-align,color,background-color,' . 'border,border-color,border-width,border-style,' . 'width,height,vertical-align,padding'
ALLOWED_HTML
Allowed tags and attributes (HTMLPurifier `HTML.Allowed` syntax).
private
mixed
ALLOWED_HTML
= 'p[style],br,strong,b,em,i,u,' . 'span[style],ul,ol,li[style],' . 'table[style|border],thead,tbody,tfoot,' . 'tr,td[colspan|rowspan|style],th[colspan|rowspan|style|scope]'
Properties
$fullPurifier
private
static HTMLPurifier|null
$fullPurifier
= null
$purifier
private
static HTMLPurifier|null
$purifier
= null
Methods
purify()
public
static purify(string $html) : string
Parameters
- $html : string
Return values
stringpurifyFull()
Sanitization for the content of the full editor ({@see \App\Core\Forms\Form::addEditor()}) that arrives from somewhere other than an admin form, currently HTML descriptions from product import.
public
static purifyFull(string $html) : string
Unlike purify() it does not restrict structure (headings, links, images, tables and
embedded videos stay: it is content an admin could write in the editor), it only removes what
has no place in stored HTML: scripts, event attributes, javascript: URLs, foreign iframes.
The base is the default safe HTMLPurifier whitelist plus SafeIframe for YouTube/Vimeo.
Parameters
- $html : string
Return values
stringcacheDir()
private
static cacheDir() : string|null
Return values
string|nullfullInstance()
private
static fullInstance() : HTMLPurifier
Return values
HTMLPurifierinstance()
private
static instance() : HTMLPurifier