Purifier duplicates anchor tags - trix-editor generated html
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.4k
- Forks
- 361
- Avg merge
- 3d 41m
- Merged PRs (30d)
- 2
Description
Hello,
I am just implementing htmlpurifier to sanitize the html generated by the basecamp:trix-editor.
After purifying, it duplicates the anchor tag in 5 various places (apparently inside every other element).
Here is the code I used:
https://gist.github.com/AntonioPrimera/ab8646567bac2b81c09298a83bc50532
Here is the original html:
https://gist.github.com/AntonioPrimera/4e6c421aecc94589474d6b2602282505
And here is the purified html:
https://gist.github.com/AntonioPrimera/ca5f6c6e1c93231a78f588fb82f4c57d
This seems like a bug, rather than a wrong configuration - I think no configuration should allow tags to be duplicated.
Any help / hint is highly appreciated.
PS: I have also tried disabling Tidy, via $config->set('HTML.TidyLevel', 'none'), but the results are the same (with or without the Tidy functionality).
PS2: When I remove the figure and the figcaption elements from the config, the anchor tag is not multiplied. Is it maybe because of the way the anchor tag is defined: strict - accepting just text / img tags inside?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the purification shown in the linked code gist, comparing the original and purified HTML. Focus on the interaction between anchor elements and the configured figure and figcaption elements, and verify that removing those elements prevents duplication; done means the purifier no longer duplicates anchors while preserving the intended sanitization behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100