Allow `data-*` attributes
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.4k
- Forks
- 361
- Avg merge
- 3d 41m
- Merged PRs (30d)
- 2
Description
I tried the following code with HTMLPurifier 4.13.0 to allow generic data-* attributes:
<?php
require_once('vendor/autoload.php');
$config = HTMLPurifier_Config::createDefault();
$config->set('HTML.Allowed', 'p, *[style|class|data-*], img[src]');
$def = $config->getHTMLDefinition(true);
$purifier = new HTMLPurifier($config);
print $purifier->purify('<p data-test="foo" data-test2="bar" data-test3="baz">test</p>');
This prints a warning:
PHP Warning: Global attribute '*' is not supported in any elements (for information on implementing this, see the support forums) in /var/www/htmlpurifier/vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLDefinition.php on line 390
Since http://htmlpurifier.org/phorum/ is no longer working, and I did not find anything similar in the GitHub issues list, could anyone point me to some information what would be needed to make this work (or just tell me my configuration was wrong and it actually should work?).
Thanks!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the configuration in the issue and inspect library/HTMLPurifier/HTMLDefinition.php around line 390, where the warning is emitted. Trace how HTML.Allowed parses global attributes, then verify that the example preserves data-test, data-test2, and data-test3 without the warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100