Search code examples
databaseyii2htmlpurifier

Problem with output from the database yii2

I have in the database the path to the files that i want to get outputed. like: 

<audio src="/yii2-biblioteca/frontend/web/uploads/audio/lya1.mp3" controls type="audio/mpeg">

and i am using: 

<?=HtmlPurifier::process($model->audio)?>

for the output.

I used the same thing for images and it's ok, it works, but for the audio and for the pdf embed not so much. At the beginning the pdf worked, i changed some things with a js funtion, it was not suppos to have a negative impact. I reversed all back to when it was good, but it's not working now.

the pdf exemple: <embed src="/yii2-biblioteca/frontend/web/uploads/pdf/dying.pdf" type="application/pdf" width="100%" height="100%" />

Solution

  • Yii2's HTMLPurifier wrapper takes a second argument:

    echo HtmlPurifier::process($html, [
    // options go here
]);

    For <embed>, you should be able to use the HTML.SafeEmbed setting:

    echo HtmlPurifier::process($html, [
    'HTML.SafeEmbed' => true,
]);

    Unfortunately, for <audio>, the underlying problem here is that HTML Purifier isn't HTML5-aware, which is going to make adding that a lot more complicated.

    There are user-supplied patches to allow HTML Purifier to understand HTML5, but as far as I know, none has been audited and so it's hard to say what this will do to the security of your site. (Arguably, HTML Purifier with userland supplied HTML5 definitions is still better than no HTML Purifier at all, though.)

    I've given some rough instructions about how to make HTML Purifier (the library itself, not its Yii2 wrapper) aware of only the <audio> tag over on another question. Quoting the relevant pieces:

    You'll have to look at the "Customize!" end-user documentation, where it will tell you how to add tags and attributes that HTML Purifier is not aware of.

    To quote the most vivid code example from the linked documentation (this code teaches HTML Purifier about the <form> tag):

    Time for some code:

    $config = HTMLPurifier_Config::createDefault();
$config->set('HTML.DefinitionID', 'enduser-customize.html tutorial');
$config->set('HTML.DefinitionRev', 1);
$config->set('Cache.DefinitionImpl', null); // remove this later!
$def = $config->getHTMLDefinition(true);
[...]
$form = $def->addElement(
    'form',   // name
    'Block',  // content set
    'Flow', // allowed children
    'Common', // attribute collection
    array( // attributes
        'action*' => 'URI',
        'method' => 'Enum#get|post',
        'name' => 'ID'
    )
);
$form->excludes = array('form' => true);

    Each of the parameters corresponds to one of the questions we asked. Notice that we added an asterisk to the end of the action attribute to indicate that it is required. If someone specifies a form without that attribute, the tag will be axed. Also, the extra line at the end is a special extra declaration that prevents forms from being nested within each other.

    Once you've followed those instructions to make your purifying routine aware of <audio>, adding the tag <audio> to your configuration whitelist will work.

    So, in brief, if you want to be able to purify just <audio> tags without losing them altogether, you're going to have to do some research on the tags' capability and add the information to HTML Purifier.

    You could base your code on what you can find in xemlock/htmlpurifier-html5's HTML5Definition.php file if you don't want to work on it from scratch.