-
-
-
",
+ * "allowed_html" = {},
* "filter_html_help" = TRUE,
* "filter_html_nofollow" = FALSE
* },
@@ -45,6 +47,10 @@ public function settingsForm(array $form, FormStateInterface $form_state) {
'#title' => $this->t('Allowed HTML tags'),
'#default_value' => $this->settings['allowed_html'],
'#description' => $this->t('A list of HTML tags that can be used. By default only the lang and dir attributes are allowed for all HTML tags. Each HTML tag may have attributes which are treated as allowed attribute names for that HTML tag. Each attribute may allow all values, or only allow specific values. Attribute names or values may be written as a prefix and wildcard like jump-*. JavaScript event attributes, JavaScript URLs, and CSS are always stripped.'),
+ '#value_callback' => [$this, 'allowedHtmlValueCallback'],
+ '#pre_render' => [
+ [$this, 'preRenderAllowedHtml'],
+ ],
'#attached' => [
'library' => [
'filter/drupal.filter.filter_html.admin',
@@ -65,15 +71,90 @@ public function settingsForm(array $form, FormStateInterface $form_state) {
}
/**
+ * Value callback for the allowed_html field.
+ */
+ public function allowedHtmlValueCallback($element, $input, FormStateInterface $form_state) {
+ return $input === FALSE ? $element['#default_value'] : $this->generateAllowedHtmlSettings($input);
+ }
+
+ /**
+ * Pre render callback for the allowed_html element.
+ */
+ public function preRenderAllowedHtml($element) {
+ $element['#value'] = $this->generateAllowedHtmlString($element['#value']);
+ return $element;
+ }
+
+ /**
+ * Generate an array to represent the allowed HTML settings.
+ *
+ * @param string $allowed_html_string
+ * A string to parse into an allowed HTML settings array.
+ *
+ * @return array
+ * An array representing the allowed HTML settings.
+ */
+ protected function generateAllowedHtmlSettings($allowed_html_string) {
+ $allowed_html_settings = [];
+
+ // Make all the tags self-closing, so they will be parsed into direct
+ // children of the body tag in the DomDocument.
+ $html = str_replace('>', ' />', $allowed_html_string);
+ // Protect any trailing * characters in attribute names, since DomDocument
+ // strips them as invalid.
+ $star_protector = '__zqh6vxfbk3cg__';
+ $html = str_replace('*', $star_protector, $html);
+ $body_child_nodes = Html::load($html)
+ ->getElementsByTagName('body')
+ ->item(0)->childNodes;
+
+ foreach ($body_child_nodes as $node) {
+ if ($node->nodeType !== XML_ELEMENT_NODE) {
+ // Skip the empty text nodes inside tags.
+ continue;
+ }
+ $tag = $node->tagName;
+ $allowed_html_settings[$tag] = [];
+ if ($node->hasAttributes()) {
+ // Iterate over any attributes, and mark them as allowed.
+ foreach ($node->attributes as $name => $attribute) {
+ // Put back any trailing * on wildcard attribute name.
+ $name = str_replace($star_protector, '*', $name);
+ $value = str_replace($star_protector, '*', $attribute->value);
+ if (empty($value)) {
+ $value = '*';
+ }
+ $allowed_html_settings[$tag][$name] = $value;
+ }
+ }
+ }
+
+ return $allowed_html_settings;
+ }
+
+ /**
+ * Generate a string to represent the allowed HTML.
+ *
+ * @param array $allowed_html_settings
+ * The allowed HTML
+ * @return string
+ */
+ protected function generateAllowedHtmlString($allowed_html_settings) {
+ $allowed_html_tags = [];
+ foreach ($allowed_html_settings as $tag => $attributes) {
+ $attribute_strings = [];
+ foreach ($attributes as $attribute => $value) {
+ $attribute_strings[] = $value === '*' ? $attribute : sprintf('%s="%s"', $attribute, $value);
+ }
+ $allowed_html_tags[] = sprintf('<%s%s%s>', $tag, count($attribute_strings) > 0 ? ' ' : '', implode(' ', $attribute_strings));
+ }
+ return implode(' ', $allowed_html_tags);
+ }
+
+ /**
* {@inheritdoc}
*/
public function setConfiguration(array $configuration) {
- if (isset($configuration['settings']['allowed_html'])) {
- // The javascript in core/modules/filter/filter.filter_html.admin.js
- // removes new lines and double spaces so, for consistency when javascript
- // is disabled, remove them.
- $configuration['settings']['allowed_html'] = preg_replace('/\s+/', ' ', $configuration['settings']['allowed_html']);
- }
parent::setConfiguration($configuration);
// Force restrictions to be calculated again.
$this->restrictions = NULL;
@@ -251,33 +332,16 @@ public function getHTMLRestrictions() {
// specific.
$restrictions = ['allowed' => []];
- // Make all the tags self-closing, so they will be parsed into direct
- // children of the body tag in the DomDocument.
- $html = str_replace('>', ' />', $this->settings['allowed_html']);
- // Protect any trailing * characters in attribute names, since DomDocument
- // strips them as invalid.
- $star_protector = '__zqh6vxfbk3cg__';
- $html = str_replace('*', $star_protector, $html);
- $body_child_nodes = Html::load($html)->getElementsByTagName('body')->item(0)->childNodes;
-
- foreach ($body_child_nodes as $node) {
- if ($node->nodeType !== XML_ELEMENT_NODE) {
- // Skip the empty text nodes inside tags.
- continue;
+ foreach ($this->settings['allowed_html'] as $element_name => $element_attributes) {
+ // If no attributes are specified, the element is allowed, but with
+ // no attributes.
+ if (empty($element_attributes)) {
+ $restrictions['allowed'][$element_name] = FALSE;
}
- $tag = $node->tagName;
- if ($node->hasAttributes()) {
- // Mark the tag as allowed, assigning TRUE for each attribute name if
- // all values are allowed, or an array of specific allowed values.
- $restrictions['allowed'][$tag] = [];
- // Iterate over any attributes, and mark them as allowed.
- foreach ($node->attributes as $name => $attribute) {
- // Put back any trailing * on wildcard attribute name.
- $name = str_replace($star_protector, '*', $name);
-
- // Put back any trailing * on wildcard attribute value and parse out
- // the allowed attribute values.
- $allowed_attribute_values = preg_split('/\s+/', str_replace($star_protector, '*', $attribute->value), -1, PREG_SPLIT_NO_EMPTY);
+ else {
+ foreach ($element_attributes as $attribute_name => $attribute_value) {
+ // Parse the allowed attribute values.
+ $allowed_attribute_values = preg_split('/\s+/', $attribute_value, -1, PREG_SPLIT_NO_EMPTY);
// Sanitize the attribute value: it lists the allowed attribute values
// but one allowed attribute value that some may be tempted to use
@@ -285,25 +349,21 @@ public function getHTMLRestrictions() {
// allowed attribute values with a wildcard. A wildcard by itself
// would mean whitelisting all possible attribute values. But in that
// case, one would not specify an attribute value at all.
- $allowed_attribute_values = array_filter($allowed_attribute_values, function ($value) use ($star_protector) { return $value !== '*'; });
+ $allowed_attribute_values = array_filter($allowed_attribute_values, function ($value) { return $value !== '*'; });
if (empty($allowed_attribute_values)) {
// If the value is the empty string all values are allowed.
- $restrictions['allowed'][$tag][$name] = TRUE;
+ $restrictions['allowed'][$element_name][$attribute_name] = TRUE;
}
else {
// A non-empty attribute value is assigned, mark each of the
// specified attribute values as allowed.
- foreach ($allowed_attribute_values as $value) {
- $restrictions['allowed'][$tag][$name][$value] = TRUE;
+ foreach ($allowed_attribute_values as $allowed_attribute_value) {
+ $restrictions['allowed'][$element_name][$attribute_name][$allowed_attribute_value] = TRUE;
}
}
}
}
- else {
- // Mark the tag as allowed, but with no attributes allowed.
- $restrictions['allowed'][$tag] = FALSE;
- }
}
// The 'style' and 'on*' ('onClick' etc.) attributes are always forbidden,
@@ -339,7 +399,7 @@ public function tips($long = FALSE) {
if (!($allowed_html = $this->settings['allowed_html'])) {
return;
}
- $output = $this->t('Allowed HTML tags: @tags', ['@tags' => $allowed_html]);
+ $output = $this->t('Allowed HTML tags: @tags', ['@tags' => $this->generateAllowedHtmlString($allowed_html)]);
if (!$long) {
return $output;
}
diff --git a/core/modules/filter/src/Tests/FilterAdminTest.php b/core/modules/filter/src/Tests/FilterAdminTest.php
index aceeff5..37654ea 100644
--- a/core/modules/filter/src/Tests/FilterAdminTest.php
+++ b/core/modules/filter/src/Tests/FilterAdminTest.php
@@ -52,7 +52,13 @@ protected function setUp() {
'filter_html' => [
'status' => 1,
'settings' => [
- 'allowed_html' => '
',
+ 'allowed_html' => [
+ 'p' => [],
+ 'br' => [],
+ 'strong' => [],
+ 'a' => [],
+ 'em' => [],
+ ],
],
],
],
@@ -66,7 +72,12 @@ protected function setUp() {
'status' => TRUE,
'weight' => -10,
'settings' => [
- 'allowed_html' => '
',
+ 'p' => [],
+ 'br' => [],
+ 'strong' => [],
+ 'a' => [],
+ 'em' => [],
+ 'h4' => [],
],
],
'filter_autop' => [
diff --git a/core/modules/filter/src/Tests/FilterHtmlImageSecureTest.php b/core/modules/filter/src/Tests/FilterHtmlImageSecureTest.php
index 249021a..9ec60ba 100644
--- a/core/modules/filter/src/Tests/FilterHtmlImageSecureTest.php
+++ b/core/modules/filter/src/Tests/FilterHtmlImageSecureTest.php
@@ -41,7 +41,13 @@ protected function setUp() {
'filter_html' => [
'status' => 1,
'settings' => [
- 'allowed_html' => '![]()
',
+ 'allowed_html' => [
+ 'img' => [
+ 'src' => '*',
+ 'testattribute' => '*',
+ ],
+ 'a' => [],
+ ],
],
],
'filter_autop' => [
diff --git a/core/modules/filter/src/Tests/Update/FilterHtmlSchemaUpdateTest.php b/core/modules/filter/src/Tests/Update/FilterHtmlSchemaUpdateTest.php
new file mode 100644
index 0000000..863555b
--- /dev/null
+++ b/core/modules/filter/src/Tests/Update/FilterHtmlSchemaUpdateTest.php
@@ -0,0 +1,61 @@
+databaseDumpFiles = [
+ __DIR__ . '/../../../../system/tests/fixtures/update/drupal-8.bare.standard.php.gz',
+ __DIR__ . '/../../../tests/fixtures/update/drupal-8.filter-html-updated-schema-2871354.php',
+ ];
+ }
+
+ /**
+ * Test the schema update.
+ */
+ public function testSchemaUpdate() {
+ $this->runUpdates();
+
+ $filter = FilterFormat::load('test_format');
+ $filter_html_configuration = $filter->filters('filter_html')->getConfiguration();
+
+ $this->assertEqual([
+ 'no-attributes' => [],
+ 'single-attribute' => [
+ 'foo' => '*',
+ ],
+ 'attribute-with-value' => [
+ 'foo' => 'bar',
+ ],
+ 'multiple-attributes' => [
+ 'foo' => 'value',
+ 'bar' => 'value',
+ ],
+ 'wildcard-attributes' => [
+ '*' => '*',
+ ],
+ 'wildcard-attribute-name' => [
+ 'data-*' => '*',
+ ],
+ 'wildcard-attribute-name-with-value' => [
+ 'data-*' => 'foo',
+ ],
+ 'wildcard-attribute-value' => [
+ 'foo' => '*',
+ ],
+ ], $filter_html_configuration['settings']['allowed_html']);
+ }
+
+}
diff --git a/core/modules/filter/tests/filter_test/config/install/filter.format.filtered_html.yml b/core/modules/filter/tests/filter_test/config/install/filter.format.filtered_html.yml
index ba403db..a35c48e 100644
--- a/core/modules/filter/tests/filter_test/config/install/filter.format.filtered_html.yml
+++ b/core/modules/filter/tests/filter_test/config/install/filter.format.filtered_html.yml
@@ -12,4 +12,10 @@ filters:
provider: filter
status: true
settings:
- allowed_html: '
'
+ allowed_html:
+ p: { }
+ br: { }
+ strong: { }
+ a:
+ href: '*'
+ hreflang: '*'
diff --git a/core/modules/filter/tests/fixtures/update/drupal-8.filter-html-updated-schema-2871354.php b/core/modules/filter/tests/fixtures/update/drupal-8.filter-html-updated-schema-2871354.php
new file mode 100644
index 0000000..3a0467a
--- /dev/null
+++ b/core/modules/filter/tests/fixtures/update/drupal-8.filter-html-updated-schema-2871354.php
@@ -0,0 +1,49 @@
+ [
+ 'langcode' => 'en',
+ 'status' => TRUE,
+ 'dependencies' => [],
+ 'name' => 'Test Filter',
+ 'format' => 'test_format',
+ 'weight' => 0,
+ 'filters' => [
+ 'filter_html' => [
+ 'id' => 'filter_html',
+ 'provider' => 'filter',
+ 'status' => TRUE,
+ 'weight' => -10,
+ 'settings' => [
+ 'allowed_html' => ' ',
+ 'filter_html_help' => FALSE,
+ 'filter_html_nofollow' => FALSE,
+ ],
+ ],
+ ],
+ ],
+];
+
+foreach ($formats as $id => $format) {
+ $connection->insert('config')
+ ->fields([
+ 'collection',
+ 'name',
+ 'data',
+ ])
+ ->values([
+ 'collection' => '',
+ 'name' => 'filter.format.' . $id,
+ 'data' => serialize($format),
+ ])
+ ->execute();
+}
diff --git a/core/modules/filter/tests/src/Kernel/FilterAPITest.php b/core/modules/filter/tests/src/Kernel/FilterAPITest.php
index 2203bbe..3f2c710 100644
--- a/core/modules/filter/tests/src/Kernel/FilterAPITest.php
+++ b/core/modules/filter/tests/src/Kernel/FilterAPITest.php
@@ -45,7 +45,9 @@ public function testCheckMarkupFilterOrder() {
'weight' => -10,
'status' => 1,
'settings' => [
- 'allowed_html' => '',
+ 'allowed_html' => [
+ 'p' => [],
+ ],
],
],
]
@@ -141,7 +143,7 @@ public function testFilterFormatAPI() {
'filter_html' => [
'status' => 1,
'settings' => [
- 'allowed_html' => '', // Nothing is allowed.
+ 'allowed_html' => [], // Nothing is allowed.
],
],
],
@@ -167,7 +169,14 @@ public function testFilterFormatAPI() {
'filter_html' => [
'status' => 1,
'settings' => [
- 'allowed_html' => '
',
+ 'allowed_html' => [
+ 'p' => [],
+ 'br' => [],
+ 'a' => [
+ 'href' => '*',
+ ],
+ 'strong' => [],
+ ],
],
],
'filter_test_restrict_tags_and_attributes' => [
@@ -214,7 +223,18 @@ public function testFilterFormatAPI() {
'filter_html' => [
'status' => 1,
'settings' => [
- 'allowed_html' => ' ',
+ 'allowed_html' => [
+ 'a' => [],
+ 'b' => [
+ 'class' => '*',
+ ],
+ 'c' => [
+ 'class' => '*',
+ ],
+ 'd' => [
+ 'class' => 'foo bar-* *',
+ ],
+ ],
],
],
]
@@ -410,7 +430,9 @@ public function testFilterFormatPreSave() {
'weight' => -10,
'status' => 1,
'settings' => [
- 'allowed_html' => '',
+ 'allowed_html' => [
+ 'p' => [],
+ ],
],
],
]
diff --git a/core/modules/filter/tests/src/Kernel/FilterKernelTest.php b/core/modules/filter/tests/src/Kernel/FilterKernelTest.php
index cf72bbe..451a54b 100644
--- a/core/modules/filter/tests/src/Kernel/FilterKernelTest.php
+++ b/core/modules/filter/tests/src/Kernel/FilterKernelTest.php
@@ -192,7 +192,13 @@ public function testCaptionFilter() {
$html_filter = $this->filters['filter_html'];
$html_filter->setConfiguration([
'settings' => [
- 'allowed_html' => '![]()
',
+ 'allowed_html' => [
+ 'img' => [
+ 'src' => '*',
+ 'data-align' => '*',
+ 'data-caption' => '*',
+ ],
+ ],
'filter_html_help' => 1,
'filter_html_nofollow' => 0,
]
@@ -408,7 +414,22 @@ public function testHtmlFilter() {
$filter = $this->filters['filter_html'];
$filter->setConfiguration([
'settings' => [
- 'allowed_html' => ' -
-
-
',
+ 'allowed_html' => [
+ 'a' => [],
+ 'p' => [],
+ 'em' => [],
+ 'strong' => [],
+ 'cite' => [],
+ 'blockquote' => [],
+ 'code' => [],
+ 'ul' => [],
+ 'ol' => [],
+ 'li' => [],
+ 'dl' => [],
+ 'dt' => [],
+ 'dd' => [],
+ 'br' => [],
+ ],
'filter_html_help' => 1,
'filter_html_nofollow' => 0,
]
@@ -463,10 +484,27 @@ public function testHtmlFilter() {
// Now whitelist the "llama" attribute on .
$filter->setConfiguration([
'settings' => [
- 'allowed_html' => ' -
-
-
',
+ 'allowed_html' => [
+ 'a' => [
+ 'href' => '*',
+ 'llama' => '*',
+ ],
+ 'em' => [],
+ 'strong' => [],
+ 'cite' => [],
+ 'blockquote' => [],
+ 'code' => [],
+ 'ul' => [],
+ 'ol' => [],
+ 'li' => [],
+ 'dl' => [],
+ 'dt' => [],
+ 'dd' => [],
+ 'br' => [],
+ ],
'filter_html_help' => 1,
'filter_html_nofollow' => 0,
- ]
+ ],
]);
$f = (string) $filter->process('link', Language::LANGCODE_NOT_SPECIFIED);
$this->assertNormalized($f, 'link', 'HTML filter keeps explicitly allowed attributes, and removes attributes that are not explicitly allowed.');
@@ -475,7 +513,24 @@ public function testHtmlFilter() {
// "majestical", or "epic".
$filter->setConfiguration([
'settings' => [
- 'allowed_html' => ' -
-
-
',
+ 'allowed_html' => [
+ 'a' => [
+ 'href' => '*',
+ 'llama' => 'majestical epic',
+ ],
+ 'em' => [],
+ 'strong' => [],
+ 'cite' => [],
+ 'blockquote' => [],
+ 'code' => [],
+ 'ul' => [],
+ 'ol' => [],
+ 'li' => [],
+ 'dl' => [],
+ 'dt' => [],
+ 'dd' => [],
+ 'br' => [],
+ ],
'filter_html_help' => 1,
'filter_html_nofollow' => 0,
]
@@ -498,7 +553,11 @@ public function testNoFollowFilter() {
$filter = $this->filters['filter_html'];
$filter->setConfiguration([
'settings' => [
- 'allowed_html' => '',
+ 'allowed_html' => [
+ 'a' => [
+ 'href' => '*',
+ ],
+ ],
'filter_html_help' => 1,
'filter_html_nofollow' => 1,
]
diff --git a/core/modules/filter/tests/src/Unit/FilterHtmlTest.php b/core/modules/filter/tests/src/Unit/FilterHtmlTest.php
index 664c2a3..3ddde35 100644
--- a/core/modules/filter/tests/src/Unit/FilterHtmlTest.php
+++ b/core/modules/filter/tests/src/Unit/FilterHtmlTest.php
@@ -22,7 +22,33 @@ class FilterHtmlTest extends UnitTestCase {
protected function setUp() {
parent::setUp();
$configuration['settings'] = [
- 'allowed_html' => ' -
-
-
',
+ 'allowed_html' => [
+ 'a' => [
+ 'href' => '*',
+ ],
+ 'p' => [],
+ 'em' => [],
+ 'strong' => [],
+ 'cite' => [],
+ 'blockquote' => [],
+ 'code' => [
+ 'class' => "pretty boring align-*",
+ ],
+ 'ul' => [
+ 'alpaca-*' => "wooly-* strong",
+ ],
+ 'ol' => [
+ 'llama-*' => '*',
+ ],
+ 'li' => [],
+ 'dl' => [],
+ 'dt' => [],
+ 'dd' => [],
+ 'br' => [],
+ 'h3' => [
+ 'id' => '*',
+ ],
+ ],
'filter_html_help' => 1,
'filter_html_nofollow' => 0,
];
@@ -79,18 +105,4 @@ public function providerFilterAttributes() {
];
}
- /**
- * @covers ::setConfiguration
- */
- public function testSetConfiguration() {
- $configuration['settings'] = [
- // New lines and spaces are replaced with a single space.
- 'allowed_html' => "
\r\n ",
- 'filter_html_help' => 1,
- 'filter_html_nofollow' => 0,
- ];
- $filter = new FilterHtml($configuration, 'filter_html', ['provider' => 'test']);
- $this->assertSame('
', $filter->getConfiguration()['settings']['allowed_html']);
- }
-
}
diff --git a/core/profiles/standard/config/install/filter.format.basic_html.yml b/core/profiles/standard/config/install/filter.format.basic_html.yml
index 92224c2..566c2b1 100644
--- a/core/profiles/standard/config/install/filter.format.basic_html.yml
+++ b/core/profiles/standard/config/install/filter.format.basic_html.yml
@@ -15,7 +15,47 @@ filters:
status: true
weight: -10
settings:
- allowed_html: ' -
-
-
![]()
'
+ allowed_html:
+ a:
+ href: '*'
+ hreflang: '*'
+ em: { }
+ strong: { }
+ cite: { }
+ blockquote:
+ cite: '*'
+ code: { }
+ ul:
+ type: '*'
+ ol:
+ start: '*'
+ type: '*'
+ li: { }
+ dl: { }
+ dt: { }
+ dd: { }
+ h2:
+ id: '*'
+ h3:
+ id: '*'
+ h4:
+ id: '*'
+ h5:
+ id: '*'
+ h6:
+ id: '*'
+ p: { }
+ br: { }
+ span: { }
+ img:
+ src: '*'
+ alt: '*'
+ height: '*'
+ width: '*'
+ data-entity-type: '*'
+ data-entity-uuid: '*'
+ data-align: '*'
+ data-caption: '*'
filter_html_help: false
filter_html_nofollow: false
filter_align:
diff --git a/core/profiles/standard/config/install/filter.format.restricted_html.yml b/core/profiles/standard/config/install/filter.format.restricted_html.yml
index 323d077..b7d4ded 100644
--- a/core/profiles/standard/config/install/filter.format.restricted_html.yml
+++ b/core/profiles/standard/config/install/filter.format.restricted_html.yml
@@ -13,7 +13,35 @@ filters:
status: true
weight: -10
settings:
- allowed_html: ' -
-
-
'
+ allowed_html:
+ a:
+ href: '*'
+ hreflang: '*'
+ em: { }
+ strong: { }
+ cite: { }
+ blockquote:
+ cite: '*'
+ code: { }
+ ul:
+ type: '*'
+ ol:
+ start: '*'
+ type: '*'
+ li: { }
+ dl: { }
+ dt: { }
+ dd: { }
+ h2:
+ id: '*'
+ h3:
+ id: '*'
+ h4:
+ id: '*'
+ h5:
+ id: '*'
+ h6:
+ id: '*'
filter_html_help: true
filter_html_nofollow: false
filter_autop: