Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

allowing data-* attributes with HTMLPurifier

Currently I am using this code with HTMLPurifier to allow data-* HTML tag attributes:

    $def = $config->getHTMLDefinition(true);
    $def->addAttribute('div', 'data-aaa', 'Text');
    $def->addAttribute('div', 'data-bbb', 'Text');
    // ...

Is there a way I can allow all data-* attributes at once, preferable on all the HTML tags? (they are not a security problem in my case - to the best of my knowledge of course)

like image 581
johndodo Avatar asked Jun 13 '13 09:06

johndodo


2 Answers

It's not a full solution, but I was able to globally white-list individual data- attributes with the follow code, allowing them to be placed on any element without having to itemize each element type for each attribute.

$def = $config->getHTMLDefinition(true);
$def->info_global_attr['data-aaa-xxx'] = new HTMLPurifier_AttrDef_Text;
$def->info_global_attr['data-bbb-yyy'] = new HTMLPurifier_AttrDef_Text;
$def->info_global_attr['data-ccc-zzz'] = new HTMLPurifier_AttrDef_Text;
like image 70
Adam Franco Avatar answered Sep 18 '22 09:09

Adam Franco


Nope, it's not possible without modifying the validate attributes strategy.

like image 27
Edward Z. Yang Avatar answered Sep 21 '22 09:09

Edward Z. Yang