Drupal valid_input_data() rejects the following:
This is a <a href="http://www.example.com/this/is/only/a/test">test</a>.
Apparently it is trying to detect "onblah=action" attributes, but it rejects anything containing a word that begins with "on", even though it appears in the middle of a URL value rather than as an attribute name.
Drupal's "diagnostic" message was not exactly helpful -- this was a real time-waster.
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | invalid_url.txt | 62 bytes | wulff |
| #3 | example_2.txt | 280 bytes | wulff |
| #1 | common.inc_13.patch | 874 bytes | wulff |
Comments
Comment #1
wulff commentedIssue still applies to HEAD.
Attached patch change the regexp based on the information at http://www.w3.org/TR/html401/index/attributes.html
Comment #2
chx commentedinstead, change the checker so that only attributes are checked. for example:
Comment #3
wulff commentedI'm not sure that is the correct solution. Most of the attributes, e.g. onclick, apply to all the HTML tags allowed by default by the 'Filtered HTML' input format.
See the attached file for examples of tags which IMHO should be marked as invalid by
valid_input_data().Comment #4
chx commentedI was not clear. My solution was about creating a new string which will be validated as it was before. By deleting the href your problem is solved.
Comment #5
wulff commentedOK, I misread your post.
Also, as far as I can tell on further inspection, the URL mentioned in the original post isn't marked invalid by Drupal, while something like the content of the attached file is.
I agree that simply removing the href attribute before checking the rest of the attribute seems like a good way of doing it. The question is whether we should just remove
href="<any chars>"or if we should check that the URL in the href is valid (this will result in a quite hairy RE as described on http://www.foad.org/~abigail/Perl/url2.html).Comment #6
Jaza commentedThe code in question doesn't seeem to exist in HEAD anymore. Closing issue.