Search code examples
htmlpurifier

with HTMLpurifier, how to add a couple attributes to the default whitelist, e.g. 'onclick'

Two questions:

I have been reading docs and SO posts.. and know how to do it the long way (defining each and every element and attribute myself), but all I want to do is add 2 or 3 attributes to the default whitelist.. so that I do not have to constantly find and add more elements/attributes to, e.g., HTML.AllowedElements and/or HTML.AllowedAttributes.

Specifically, now, (for internal trusted users) I need to allow javascript attributes (input from tinymce). Question #1.) Is there a way to just add an attribute (to what HTMLpurifier allows) without causing the whole default sets of allowed elements/attributes to be effectively wiped out (overwritten by ONLY what is explicitly written in HTML.AllowedElements or HTML.AllowedAttributes)?

For what I need right now (the javascript attributes), I got excited when I saw in this thread:

Whitelist Forms in HTML Purifier Configuration

...where Edward Z. Yang says, "... [$config->set('HTML.Trusted', true);] allows JavaScript."

...but even after setting this: $config->set('HTML.Trusted', true);, HTMLpurifier 4.4.0 is still stripping e.g. any input onclick="dostuff();" attribute. Why? Question #2.) Is there a quick way to add just the javascript attributes to the allowed list?

Solution

    1. You're losing onclick because HTML Purifier doesn't know about that attribute, and if HTML Purifier passed everything through when you turned on %HTML.Trusted you might as well just not use HTML Purifier at all.

    2. HTML Purifier has attribute collections for just this case; 'Common' is probably the right one to insert them into.

    But... why? The real name of %HTML.Trusted really should be %HTML.UnsafeMakeMyApplicationVulnerable