diff --git a/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Internal.php b/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Internal.php index 2e469da..7fbdb22 100644 --- a/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Internal.php +++ b/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Internal.php @@ -496,6 +496,13 @@ protected function generateACFSettings(Editor $editor) { } // Tell CKEditor the tag is allowed, along with some tags. elseif (is_array($attributes)) { + // Set defaults (these will be overridden below if more specific + // values are present). + $allowed[$tag] = array( + 'attributes' => FALSE, + 'styles' => FALSE, + 'classes' => FALSE, + ); // Configure allowed attributes, allowed "style" attribute values and // allowed "class" attribute values. // CKEditor only allows specific values for the "class" and "style" @@ -560,6 +567,9 @@ protected function generateACFSettings(Editor $editor) { } } + ksort($allowed); + ksort($disallowed); + return array($allowed, $disallowed); } } diff --git a/core/modules/ckeditor/src/Tests/CKEditorTest.php b/core/modules/ckeditor/src/Tests/CKEditorTest.php index d2a59bc..6e65ce2 100644 --- a/core/modules/ckeditor/src/Tests/CKEditorTest.php +++ b/core/modules/ckeditor/src/Tests/CKEditorTest.php @@ -54,7 +54,7 @@ protected function setUp() { 'filter_html' => array( 'status' => 1, 'settings' => array( - 'allowed_html' => '


', + 'allowed_html' => '


', ) ), ), @@ -95,6 +95,7 @@ function testGetJSSettings() { ), ); ksort($expected_config); + ksort($expected_config['allowedContent']); $this->assertIdentical($expected_config, $this->ckeditor->getJSSettings($editor), 'Generated JS settings are correct for default configuration.'); // Customize the configuration: add button, have two contextually enabled @@ -121,12 +122,13 @@ function testGetJSSettings() { // Change the allowed HTML tags; the "allowedContent" and "format_tags" // settings for CKEditor should automatically be updated as well. $format = $editor->getFilterFormat(); - $format->filters('filter_html')->settings['allowed_html'] .= '

 
';
+    $format->filters('filter_html')->settings['allowed_html'] .= '
 
';
     $format->save();
 
-    $expected_config['allowedContent']['pre'] = array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE);
-    $expected_config['allowedContent']['h3'] = array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE);
-    $expected_config['format_tags'] = 'p;h2;h3;h4;h5;h6;pre';
+    $expected_config['allowedContent']['pre'] = array('attributes' => FALSE, 'styles' => FALSE, 'classes' => FALSE);
+    $expected_config['allowedContent']['h1'] = array('attributes' => FALSE, 'styles' => FALSE, 'classes' => FALSE);
+    $expected_config['format_tags'] = 'p;h1;h2;h3;h4;h5;h6;pre';
+    ksort($expected_config['allowedContent']);
     $this->assertIdentical($expected_config, $this->ckeditor->getJSSettings($editor), 'Generated JS settings are correct for customized configuration.');
 
     // Disable the filter_html filter: allow *all *tags.
@@ -178,14 +180,17 @@ function testGetJSSettings() {
       ),
       'a' => array(
         'attributes' => 'href,rel,class,target',
+        'styles' => FALSE,
         'classes' => 'external',
       ),
       'span' => array(
         'attributes' => 'class,property,rel,style',
         'styles' => 'font-size',
+        'classes' => FALSE,
       ),
       '*' => array(
         'attributes' => 'class,data-*',
+        'styles' => FALSE,
         'classes' => 'is-a-hipster-llama,and-more',
       ),
       'del' => array(
@@ -205,6 +210,8 @@ function testGetJSSettings() {
     );
     $expected_config['format_tags'] = 'p';
     ksort($expected_config);
+    ksort($expected_config['allowedContent']);
+    ksort($expected_config['disallowedContent']);
     $this->assertIdentical($expected_config, $this->ckeditor->getJSSettings($editor), 'Generated JS settings are correct for customized configuration.');
   }
 
@@ -420,17 +427,18 @@ protected function getDefaultInternalConfig() {
   }
 
   protected function getDefaultAllowedContentConfig() {
-    return array(
-      'h2' => array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE),
-      'h3' => array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE),
-      'h4' => array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE),
-      'h5' => array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE),
-      'h6' => array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE),
-      'p' => array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE),
-      'br' => array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE),
-      'strong' => array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE),
-      'a' => array('attributes' => TRUE, 'styles' => FALSE, 'classes' => TRUE),
-    );
+    return [
+      'h2' => ['attributes' => FALSE, 'styles' => FALSE, 'classes' => FALSE],
+      'h3' => ['attributes' => FALSE, 'styles' => FALSE, 'classes' => FALSE],
+      'h4' => ['attributes' => FALSE, 'styles' => FALSE, 'classes' => FALSE],
+      'h5' => ['attributes' => FALSE, 'styles' => FALSE, 'classes' => FALSE],
+      'h6' => ['attributes' => FALSE, 'styles' => FALSE, 'classes' => FALSE],
+      'p' => ['attributes' => FALSE, 'styles' => FALSE, 'classes' => FALSE],
+      'br' => ['attributes' => FALSE, 'styles' => FALSE, 'classes' => FALSE],
+      'strong' => ['attributes' => FALSE, 'styles' => FALSE, 'classes' => FALSE],
+      'a' => ['attributes' => 'href,hreflang', 'styles' => FALSE, 'classes' => FALSE],
+      '*' => ['attributes' => 'id,lang,dir', 'styles' => FALSE, 'classes' => FALSE],
+    ];
   }
 
   protected function getDefaultDisallowedContentConfig() {
diff --git a/core/modules/filter/filter.filter_html.admin.js b/core/modules/filter/filter.filter_html.admin.js
index 75a9824..8f94d44 100644
--- a/core/modules/filter/filter.filter_html.admin.js
+++ b/core/modules/filter/filter.filter_html.admin.js
@@ -23,23 +23,15 @@
        */
       getRules: function () {
         var currentValue = $('#edit-filters-filter-html-settings-allowed-html').val();
-        var rules = [];
-        var rule;
+        var rules = Drupal.behaviors.filterFilterHtmlUpdating._parseSetting(currentValue);
 
         // Build a FilterHTMLRule that reflects the hard-coded behavior that
         // strips all "style" attribute and all "on*" attributes.
-        rule = new Drupal.FilterHTMLRule();
+        var rule = new Drupal.FilterHTMLRule();
         rule.restrictedTags.tags = ['*'];
         rule.restrictedTags.forbidden.attributes = ['style', 'on*'];
         rules.push(rule);
 
-        // Build a FilterHTMLRule that reflects the current settings.
-        rule = new Drupal.FilterHTMLRule();
-        var behavior = Drupal.behaviors.filterFilterHtmlUpdating;
-        rule.allow = true;
-        rule.tags = behavior._parseSetting(currentValue);
-        rules.push(rule);
-
         return rules;
       }
     };
@@ -63,8 +55,12 @@
     // The description for the "Allowed HTML tags" field.
     $allowedHTMLDescription: null,
 
-    // The user-entered tag list of $allowedHTMLFormItem.
-    userTags: null,
+    /**
+     * The parsed, user-entered tag list of $allowedHTMLFormItem
+     *
+     * @var {Object.}
+     */
+    userTags: {},
 
     // The auto-created tag list thus far added.
     autoTags: null,
@@ -116,9 +112,10 @@
       this.$allowedHTMLDescription.find('.editor-update-message').remove();
 
       // If any auto-created tags: insert message and update form item.
-      if (this.autoTags.length > 0) {
+      if (!_.isEmpty(this.autoTags)) {
         this.$allowedHTMLDescription.append(Drupal.theme('filterFilterHTMLUpdateMessage', this.autoTags));
-        this.$allowedHTMLFormItem.val(this._generateSetting(this.userTags) + ' ' + this._generateSetting(this.autoTags));
+        var userTagsWithoutOverrides = _.omit(this.userTags, _.keys(this.autoTags));
+        this.$allowedHTMLFormItem.val(this._generateSetting(userTagsWithoutOverrides) + ' ' + this._generateSetting(this.autoTags));
       }
       // Restore to original state.
       else {
@@ -142,45 +139,136 @@
      *   A list of new allowed tags.
      */
     _calculateAutoAllowedTags: function (userAllowedTags, newFeatures) {
-      return _
-        .chain(newFeatures)
-        // Reduce multiple features' rules.
-        .reduce(function (memo, featureRules) {
-          // Reduce a single features' rules' required tags.
-          return _.union(memo, _.reduce(featureRules, function (memo, featureRule) {
-            return _.union(memo, featureRule.required.tags);
-          }, []));
-        }, [])
-        // All new features' required tags are "new allowed tags", except
-        // for those that are already allowed in the original allowed tags.
-        .difference(userAllowedTags)
-        .value();
+      var editorRequiredTags = {};
+      // Map the newly added Text Editor features to Drupal.FilterHtmlRule
+      // objects.
+      // (to allow comparing userTags with autoTags.)
+      var featureName, feature, featureRule, filterRule, tag;
+      for (featureName in newFeatures) {
+        feature = newFeatures[featureName];
+        for (var f = 0; f < feature.length; f++) {
+          featureRule = feature[f];
+          for (var t = 0; t < featureRule.required.tags.length; t++) {
+            tag = featureRule.required.tags[t];
+            if (!_.has(editorRequiredTags, tag)) {
+              filterRule = new Drupal.FilterHTMLRule();
+              filterRule.restrictedTags.tags = [tag];
+              // @todo Neither Drupal.FilterHtmlRule nor
+              //   Drupal.EditorFeatureHTMLRule allow for generic attribute
+              //   value restrictions, only for the "class" and "style"
+              //   attribute's values to be restricted.
+              filterRule.restrictedTags.allowed.attributes = featureRule.required.attributes;
+              editorRequiredTags[tag] = filterRule;
+            }
+            // The tag is already allowed, add any additionally allowed
+            // attributes.
+            else {
+              filterRule = editorRequiredTags[tag];
+              filterRule.restrictedTags.allowed.attributes = _.union(filterRule.restrictedTags.allowed.attributes, featureRule.required.attributes);
+            }
+          }
+        }
+      }
+
+      // Now compare userAllowedTags with editorRequiredTags, and build
+      // autoAllowedTags, which contains:
+      // - any tags in editorRequiredTags but not in userAllowedTags (i.e. tags
+      //   that are additionally going to be allowed)
+      // - any tags in editorRequiredTags that already exists in userAllowedTags
+      //   but does not allow all attributes or attribute values
+      var autoAllowedTags = {};
+      for (tag in editorRequiredTags) {
+        // If userAllowedTags does not contain a rule for this editor-required
+        // tag, then add it to the list of automatically allowed tags.
+        if (!_.has(userAllowedTags, tag)) {
+          autoAllowedTags[tag] = editorRequiredTags[tag];
+        }
+        // Otherwise, if userAllowedTags already allows this tag, then check if
+        // additional attributes on this tag are required by the editor.
+        else {
+          var requiredAttributes = editorRequiredTags[tag].restrictedTags.allowed.attributes;
+          var allowedAttributes = userAllowedTags[tag].restrictedTags.allowed.attributes;
+          if (requiredAttributes.length &&_.difference(requiredAttributes, allowedAttributes).length) {
+            autoAllowedTags[tag] = userAllowedTags[tag];
+            autoAllowedTags[tag].restrictedTags.allowed.attributes = _.union(allowedAttributes, requiredAttributes);
+          }
+          // @todo attribute values.
+        }
+      }
+
+      return autoAllowedTags;
     },
 
     /**
      * Parses the value of this.$allowedHTMLFormItem.
      *
      * @param {string} setting
-     *   The string representation of the setting. e.g. "
 
 "
+     *   The string representation of the setting. For example:
+     *     
 
 
      *
-     * @return {Array}
-     *   The array representation of the setting. e.g. ['p', 'br', 'a']
+     * @return {Object.}
+     *   The corresponding text filter HTML rule objects, one per tag, keyed by
+     *   tag name.
      */
     _parseSetting: function (setting) {
-      return setting.length ? setting.substring(1, setting.length - 1).split('> <') : [];
+      var allowedTags = setting.match(/(<[^>]+>)/g);
+      var sandbox = document.createElement('div');
+      var node, tag, rule, attributes, attribute;
+      var rules = {};
+      for (var t = 0; t < allowedTags.length; t++) {
+        // Let the browser do the parsing work for us.
+        sandbox.innerHTML = allowedTags[t];
+        node = sandbox.firstChild;
+        tag = node.tagName.toLowerCase();
+
+        // Build the Drupal.FilterHtmlRule object.
+        rule = new Drupal.FilterHTMLRule();
+        // We create one rule per allowed tag, so always one tag.
+        rule.restrictedTags.tags = [tag];
+        // Add the attribute restrictions.
+        attributes = node.attributes;
+        for (var i = 0; i < attributes.length; i++) {
+          attribute = attributes.item(i);
+          var attributeName = attribute.nodeName;
+          // @todo Drupal.FilterHtmlRule does not allow for generic attribute
+          //   value restrictions, only for the "class" and "style" attribute's
+          //   values.
+          var attributeValue = attribute.textContent;
+          rule.restrictedTags.allowed.attributes.push(attributeName);
+        }
+
+        rules[tag] = rule;
+      }
+      return rules;
     },
 
     /**
      * Generates the value of this.$allowedHTMLFormItem.
      *
-     * @param {Array} tags
-     *   The array representation of the setting. e.g. ['p', 'br', 'a']
+     * @param {Object.} tags
+     *   The parsed representation of the setting.
      *
      * @return {Array}
      *   The string representation of the setting. e.g. "
 
 "
      */
     _generateSetting: function (tags) {
-      return tags.length ? '<' + tags.join('> <') + '>' : '';
+      return _.reduce(tags, function (setting, rule, tag) {
+        if (setting.length) {
+          setting += ' ';
+        }
+
+        setting += '<' + tag;
+        if (rule.restrictedTags.allowed.attributes.length) {
+          setting += ' ' + rule.restrictedTags.allowed.attributes.join(' ');
+        }
+        // @todo Drupal.FilterHtmlRule does not allow for generic attribute
+        //   value restrictions, only for the "class" and "style" attribute's
+        //   values. Until generic support is here, we don't bother generating
+        //   attribute value whitelists at all, and we pretend every value is
+        //   allowed for any given attribute.
+        setting += '>';
+        return setting;
+      }, '');
     }
 
   };
@@ -196,7 +284,7 @@
    */
   Drupal.theme.filterFilterHTMLUpdateMessage = function (tags) {
     var html = '';
-    var tagList = '<' + tags.join('> <') + '>';
+    var tagList = Drupal.behaviors.filterFilterHtmlUpdating._generateSetting(tags);
     html += '
';
     html += Drupal.t('Based on the text editor configuration, these tags have automatically been added: @tag-list.', {'@tag-list': tagList});
     html += '
';
diff --git a/core/modules/filter/filter.module b/core/modules/filter/filter.module
index 6188006..7202b28 100644
--- a/core/modules/filter/filter.module
+++ b/core/modules/filter/filter.module
@@ -13,7 +13,7 @@
 use Drupal\Core\Routing\RouteMatchInterface;
 use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\Template\Attribute;
-use Drupal\filter\Entity\FilterFormat;
+use Drupal\filter\Plugin\FilterBase;
 use Drupal\filter\FilterFormatInterface;
 
 /**
@@ -453,18 +453,74 @@ function template_preprocess_filter_tips(&$variables) {
 /**
  * Provides filtering of input into accepted HTML.
  */
-function _filter_html($text, $filter) {
-  $allowed_tags = preg_split('/\s+|<|>/', $filter->settings['allowed_html'], -1, PREG_SPLIT_NO_EMPTY);
+function _filter_html($text, FilterBase $filter) {
+  $restrictions = $filter->getHtmlRestrictions();
+  $global_allowed_attrs = array_filter($restrictions['allowed']['*']);
+  unset($restrictions['allowed']['*']);
+  $allowed_tags = array_keys($restrictions['allowed']);
   $text = Xss::filter($text, $allowed_tags);
 
+  // Apply attribute restrictions to tags.
+  $html_dom = Html::load($text);
+  $xpath = new \DOMXPath($html_dom);
+  foreach ($allowed_tags as $allowed_tag) {
+    // By default, no attributes are allowed for a tag, but due to the globally
+    // whitelisted attributes, it is impossible for a tag to actually completely
+    // disallow attributes.
+    if ($restrictions['allowed'][$allowed_tag] === FALSE) {
+      $restrictions['allowed'][$allowed_tag] = $global_allowed_attrs;
+    }
+    // If specific attributes are whitelisted, then ensure our global whitelist
+    // is also applied.
+    elseif (is_array($restrictions['allowed'][$allowed_tag])) {
+      // More specific restrictions on the 'id', 'lang' or 'dir' attributes are
+      // not allowed.
+      $restrictions['allowed'][$allowed_tag] = $global_allowed_attrs + $restrictions['allowed'][$allowed_tag];
+    }
+
+    // First, remove all attributes except the whitelisted ones.
+    $attribute_whitelist = array_keys(array_merge($global_allowed_attrs, $restrictions['allowed'][$allowed_tag]));
+    foreach ($xpath->query('//' . $allowed_tag) as $node) {
+      if ($node->hasAttributes()) {
+        $attribute_list = array_keys(iterator_to_array($node->attributes));
+        $attributes_to_remove = array_diff($attribute_list, $attribute_whitelist);
+        foreach ($attributes_to_remove as $attribute) {
+          $node->removeAttribute($attribute);
+        }
+      }
+    }
+    // Second, remove all attributes whose values do not meet the attribute
+    // values whitelist.
+    foreach ($restrictions['allowed'][$allowed_tag] as $attribute => $allowed_attribute_values) {
+      // All attribute values are allowed, we have no work to do.
+      if ($allowed_attribute_values === TRUE) {
+        continue;
+      }
+      foreach ($xpath->query('//' . $allowed_tag . '[@' . $attribute . ']') as $node) {
+        $attribute_values = preg_split('/\s+/', $node->getAttribute($attribute), -1, PREG_SPLIT_NO_EMPTY);
+        $final_values = [];
+        foreach ($attribute_values as $idx => $value) {
+          if (in_array($value, $allowed_attribute_values)) {
+            $final_values[] = $value;
+          }
+        }
+        if ($final_values) {
+          $node->setAttribute($attribute, implode(' ', $final_values));
+        }
+        else {
+          $node->removeAttribute($attribute);
+        }
+      }
+    }
+  }
+
   if ($filter->settings['filter_html_nofollow']) {
-    $html_dom = Html::load($text);
     $links = $html_dom->getElementsByTagName('a');
     foreach ($links as $link) {
       $link->setAttribute('rel', 'nofollow');
     }
-    $text = Html::serialize($html_dom);
   }
+  $text = Html::serialize($html_dom);
 
   return trim($text);
 }
diff --git a/core/modules/filter/migration_templates/d6_filter_format.yml b/core/modules/filter/migration_templates/d6_filter_format.yml
index 16982d3..c3f896f 100644
--- a/core/modules/filter/migration_templates/d6_filter_format.yml
+++ b/core/modules/filter/migration_templates/d6_filter_format.yml
@@ -36,7 +36,9 @@ process:
             - filter_html_escape
           php:
             - php_code
-      settings: settings
+      settings:
+        plugin: filter_settings
+        source: settings
       status:
         plugin: default_value
         default_value: true
diff --git a/core/modules/filter/src/Plugin/Filter/FilterHtml.php b/core/modules/filter/src/Plugin/Filter/FilterHtml.php
index 4708cc6..f5791b5 100644
--- a/core/modules/filter/src/Plugin/Filter/FilterHtml.php
+++ b/core/modules/filter/src/Plugin/Filter/FilterHtml.php
@@ -20,7 +20,7 @@
  *   title = @Translation("Limit allowed HTML tags"),
  *   type = Drupal\filter\Plugin\FilterInterface::TYPE_HTML_RESTRICTOR,
  *   settings = {
- *     "allowed_html" = "