Problem/Motivation

According to the HTML specification, any character is allowed in attribute values*
So, something like <a href="https://drupal.org" title="Go to > Drupal !">Click me</a> should be legitimate.
Currently, the Xss filtering fails to handle this and strips a significant part of the string which can alter the rendering or even change its behavior if Javascript is involved.

* except for the quotes used to delimit the attribute value or some special chars if the attribute value is not delimited by any quotes

I believe this has no direct impact on Drupal Core but this can affect contrib or custom modules or even external projects using our Utilities.

Proposed resolution

Change how \Drupal\Component\Utility\Xss::filter() extract the tags to allow having angled brackets in quoted attributes.

Issue fork drupal-3561452

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

duaelfr created an issue. See original summary.

duaelfr opened merge request !14035

duaelfr’s picture

duaelfr
he/him
Primary language French
Location Montpellier, France
commented
Status: Active » Needs work

I opened a MR with a test coverage for this issue.
I am not good enough at Regex to fix it, though.

cilefen’s picture

cilefen commented

Please link to the HTML specification for attributes in the issue summary.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

duaelfr’s picture

duaelfr
he/him
Primary language French
Location Montpellier, France
commented
Issue summary: View changes

Link added