HTML Comment <!-- <style> --> produces empty result
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.4k
- Forks
- 361
- Avg merge
- 3d 41m
- Merged PRs (30d)
- 2
Description
I have the following simplified PHP code, the HTML is coming from an untrusted source, and needs to be purified. This is a minimal example which reproduces the problem, my real HTMLPurifier config is a lot more complex.
$config = HTMLPurifier_Config::createDefault();
$config->set('Core.Encoding', 'UTF-8');
$config->set('HTML.Doctype', 'HTML 4.01 Transitional');
$config->set('Filter.ExtractStyleBlocks', true);
$purifier = new HTMLPurifier($config);
$dirtyHtml = <<<EOF
<!-- <style> -->
<style>
div {font-size: 12px;}
</style>
<div>
some text
</div>
EOF;
var_dump($purifier->purify($dirtyHtml));
The output is an empty string.
If I remove the "Filter.ExtractStyleBlocks" line, I get the correct output:
<div>
some text
</div>
If I remove the HTML Comment from the $dirtyHtml, it also works fine. The problem seems to be this HTML comment in combination with the Filter.ExtractStyleBlocks.
As a quick workaround I remove all occurrences of <!-- <style> --> from the $dirtyHtml before purifying it, but it's just a workaround for now, until HTMLPurifier is fixed.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running the minimal PHP reproduction using HTMLPurifier_Config, Filter.ExtractStyleBlocks, and HTMLPurifier::purify() to confirm the empty result. Trace the interaction between the HTML comment and style-block extraction, then verify that the sanitized output retains the div text and handles the comment without the workaround.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100