Inconsistent behavior of SafeObject injector and SafeParam attributes transform
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.4k
- Forks
- 361
- Avg merge
- 3d 41m
- Merged PRs (30d)
- 2
Description
The purifier is incorrectly handling the <param name="allowfullscreen" value="false" /> by changing it to <param name="" value="" /> with a warning Passing null to parameter #xxx (xxx) of type string is deprecated in PHP >= 8.1. There is a problem with the inconsistency in HTMLPurifier/Injector/SafeObject and HTMLPurifier/AttrTransform/SafeParam: the injector accepts parameter names in a case-insensitive manner, while the attributes transformer treats them in a case-sensitive way. However, it's too late to filter such tags.
I've created a PR that includes a test case and proposed fixes (also fixed a bug, I think), along with my comments. I have opted for normalizing the parameter names as a solution, but I am open to alternative suggestions.
- HTMLPurifier version: 4.18.0
- PHP version: 8.1.17
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with HTMLPurifier/Injector/SafeObject and HTMLPurifier/AttrTransform/SafeParam, then review pull request #458 and its test case. Reproduce the allowfullscreen parameter example on PHP 8.1 or later, compare the injector and attribute-transformer behavior, and verify that the proposed fix prevents empty attributes and the deprecation warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100