Excluded elements from <pre> tag
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.4k
- Forks
- 361
- Avg merge
- 3d 41m
- Merged PRs (30d)
- 2
Description
Hello, I came up with an interesting "bug" that the purifier deletes the contents of nested elements inside the 'pre' tag. I found this in file /library/HTMLPurifier/HTMLModule/Text.php between lines 60-69, $pre->excludes.. Does anyone know why? I'm mainly interested in the tags 'big', 'small' and 'font'. HTML specification does not prohibit using of these tags inside 'pre', or does it? The mentioned tags in 'pre' generally works in actual browsers and there is no reason nor for security to remove them with their content, which is probably the biggest problem.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in library/HTMLPurifier/HTMLModule/Text.php around lines 60-69 and inspect how $pre->excludes handles nested elements. Compare the behavior for big, small, and font with the HTML specification and browser behavior. Done means determining the intended handling and validating the resulting purifier behavior with appropriate coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100