Problem/Motivation

Xss::filter removes valid HTML attributes that start with a word and colon. This pattern is common in image captions like <img src="http://drupal.org/logo.jpg" alt="Drupal: The best CMS ever.">. Xss::filter treats all html attributes the same, this applied to title, alt and custom data attributes.

Proposed resolution

Remaining tasks

User interface changes

API changes

CommentFileSizeAuthor
#1 filter-xss-2383205.patch1.62 KBwebflo

Comments

webflo’s picture

webflo commented
StatusFileSize
new filter-xss-2383205.patch1.62 KB
webflo’s picture

webflo commented
Status: Active » Needs review
wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Status: Needs review » Closed (duplicate)
Related issues: +#2105841: Xss filter() mangles image captions and title/alt/data attributes

This is a duplicate of #2105841: Xss filter() mangles image captions and title/alt/data attributes. But the tests in your patch would be a great addition to the patch that's got consensus there. Perhaps you can reroll the patch over there (because it's been silent for almost two months now, despite having an agreed upon solution).

Status: Closed (duplicate) » Needs work

The last submitted patch, 1: filter-xss-2383205.patch, failed testing.

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Status: Needs work » Closed (duplicate)

LOL @ d.o