ezyang / ezyang/htmlpurifier

Support for conditional HTML commenting e.g. `<!--[if mso]>`

Open
#379 6 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
3.4k
Forks
361
Avg merge
3d 41m
Merged PRs (30d)
2

Description

The syntax specified here for conditional Outlook CSS does not seem to be compatible with HTMLPurifier, everything inside the conditional comment will be removed.

The simplified version of the syntax I'm trying to use is:

<!--[if mso]>
   <a href="https://swifthalf.com/" target="_blank">
      conditional link
   </a>
<![endif]-->
<!--[if !mso]>
  <!-- -->
    <a href="https://swifthalf.com"  target="_blank">
        default link
    </a>
  <!--
<![endif]-->

As these are HTML comments, I initially thought I might be able to use the HTML.AllowedComments config option, however it does not have an option to allow ALL comments. The exact comment body has to be specified, which will not work for this use case as the content is not always known.

I next tried HTML.AllowedCommentsRegexp with a regexp that should allow everything:

$config->set('HTML.AllowedCommentsRegexp', '/^.*?$/');

However this also does not work. It seems that in the <!--[if mso]> comment marker, the non-standard [if mso] seems to cause the comment to be removed regardless.

Is there a way to support this syntax currently or is it not possible?

Thank you for any help!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by examining the HTML.AllowedComments and HTML.AllowedCommentsRegexp behavior against the conditional-comment example in the issue. Determine whether the conditional Outlook markers can be preserved while retaining sanitization, and verify that the supplied markup survives filtering as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.