"Limit allowed HTML tags and correct faulty HTML" filter strips inline css.
I know actually that this is works as designed:

A list of HTML tags that can be used. By default only the lang and dir attributes are allowed for all HTML tags. Each HTML tag may have attributes which are treated as allowed attribute names for that HTML tag. Each attribute may allow all values, or only allow specific values. Attribute names or values may be written as a prefix and wildcard like jump-*. JavaScript event attributes, JavaScript URLs, and CSS are always stripped.

I think in several use cases it would be helpful if this filtering could be turned off for some html tags.
The method could be similar as any other parameter: specify style tag to a desired html element in the field Enabled filters

So e.g. this way could be enable inline css to table element:

<table style>

Comments

kepesv created an issue. See original summary.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

emil stoianov’s picture

emil stoianov commented

I agree, the style attribute is a door for potential unsafe things and a beginning of things looking wired but this is a responsibility of the editor of the site and duty of the developer to rise awareness about it. No instrument is protected from miss use. There are a lot of things one can hit with a hammer besides nails
Having that in mind there is an approved list of the safe ones: https://validator.w3.org/feed/docs/warning/DangerousStyleAttr.html
The list:
azimuth, background, background-color, border, border-bottom, border-bottom-color, border-bottom-style, border-bottom-width, border-collapse, border-color, border-left, border-left-color, border-left-style, border-left-width, border-right, border-right-color, border-right-style, border-right-width, border-spacing, border-style, border-top, border-top-color, border-top-style, border-top-width, border-width, clear, color, cursor, direction, display, elevation, float, font, font-family, font-size, font-style, font-variant, font-weight, height, letter-spacing, line-height, margin, margin-bottom, margin-left, margin-right, margin-top, overflow, padding, padding-bottom, padding-left, padding-right, padding-top, pause, pause-after, pause-before, pitch, pitch-range, richness, speak, speak-header, speak-numeral, speak-punctuation, speech-rate, stress, text-align, text-decoration, text-indent, unicode-bidi, vertical-align, voice-family, volume, white-space, and width
The generated styles by several CKEditor5 plugins are more or less fitting in the "safe"list.

Is it possible to make the above list be part of exceptions?

emil stoianov’s picture

emil stoianov commented

Make it available for D^9.5.x

emil stoianov’s picture

emil stoianov commented
Version: 10.1.x-dev » 9.5.x-dev
Priority: Normal » Major
emil stoianov’s picture

emil stoianov commented
Category: Feature request » Bug report

Changing this to but report category as this is limiting CKEditor5 capabilities.

emil stoianov’s picture

emil stoianov commented
Issue tags: +ckeditor5
Related issues: +#3324225: Support CKEditor 5's table properties and cell properties plugins in Full HTML
wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Issue tags: +Security
davedg629’s picture

davedg629 commented

I'd also like to see the exceptions listed in #4 added.

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented

FYI: if you really really want inline styles:

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Version: 9.5.x-dev » 11.x-dev
davedg629’s picture

davedg629 commented

Interesting, thanks for the recommendation.

bramdriesen’s picture

bramdriesen
he/him
Primary language Dutch
Location Belgium 🇧🇪🇪🇺
commented
Category: Bug report » Feature request

Setting to FR as this is currently clearly working as designed.

bramdriesen’s picture

bramdriesen
he/him
Primary language Dutch
Location Belgium 🇧🇪🇪🇺
commented
Issue summary: View changes

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.