Forums - General

style tag (5 replies)

atDev — Tue, 31 Aug 2010 05:58:26 -0700

When attempting to allow the "style" attribute we get an error.

Is there documentation on this or why it is not allowed? (not the tag, the attribute)

Allowed elements input format and style attribute (8 replies)

atDev — Fri, 03 Sep 2010 23:29:25 -0700

The configuration documentation says the AllowedElements should be set as an array.

However when we pass in:

Array
(
    [0] => p
    [1] => ul
    [2] => ol
    [3] => li
    [4] => strong
    [5] => em
    [6] => u
    [7] => span
    [8] => hr
    [9] => div
    [10] => br
    [11] => b
    [13] => i
)

We get errors like: Element '0' is not supported Element '1' is not supported etc.

What format should the input be?

$config->set('HTML', 'AllowedElements', (array) $tags['tags']);

$tags['tags'] is the above array.

Secondly how come we can't set 'style' as an attribute so styles can be added to elements?

Flash embeding problem (13 replies)

Claus — Wed, 08 Sep 2010 20:40:39 -0700

I'm using the latest 4.1.1 version of HTMLPurifier. I turned on "Output.FlashCompat" configuration option to true, but flash video not working properly in Google Chrome and not working at all in Mozilla Firefox. The problem is that HTMLPurifier strips attribute type="application/x-shockwave-flash" and puts embed into comments.

Another problem appears than I try to resave flash generated by HTMLPurifier. It adds another block. So than I save html second time I have 2 blocks, than 3 and so on.

Could anybody help me?

Quotes added to property background: url() (2 replies)

D4P — Thu, 05 Aug 2010 00:55:35 -0700

Hello Ambush,

I'm having a problem where style="background-image: url(http://www.blah.com/image.gif);" is begin converted to style="background-image: url("http://www.blah.com/image.gif");" which is creating the problem of double-quotes within double-quotes. Is this a problem with HTML Purifier or am I doing something wrong?

Best, D4P

Disallow all (2 replies)

arekanderu — Tue, 27 Jul 2010 11:26:08 -0700

Hello

Is there an easy way to disallow everything by default?

Allowing SCRIPT tag from whitelisted SRC? (5 replies)

jalefkowit — Mon, 19 Jul 2010 10:17:49 -0700

Hey all --

I have a question regarding HTMLPurifier that a thorough read of the (very good, btw) docs has not helped me find a solution to. So I figured I would turn to the experts :D

I have a client whose CMS is using HTMLPurifier to filter user-generated content. They are interested in allowing users to include widgets provided by a third party, who provides users with an "embed code" for the widgets that employs the SCRIPT tag, with the SRC attribute pointing to a JavaScript file hosted by the third party. (In some ways therefore this is similar to the problem of embedding videos from sites like YouTube.)

My thought was that it would be OK to allow this as long as SCRIPT is strictly set to only be included if the SRC is pointing to a valid, whitelisted domain that we know belongs to the third party. But the problem I've run into in implementing this is that I have not been able to find a way to get HTMLPurifier to allow SCRIPT tags _at all_ except by setting %HTML.Trusted to true. (I tried adding SCRIPT to the list of tags in %HTML.AllowedElements and adding the Scripting module via %HTML.AllowedModules, but neither allowed the tag through.)

Setting %HTML.Trusted to true appears to pass the tag through, but this approach makes me nervous because turning Trusted on seems to relax a bunch of other constraints as well, so using it to solve this problem feels a bit like swatting a fly with a shovel.

I can't do anything with whitelisting by SRC until I can get HTMLPurifier to allow SCRIPT tags through, though. So my question is: is there a way to solve this problem without resorting to %HTML.Trusted?

Thanks in advance for any help!

-- Jason Lefkowitz

Maintaining newlines in table HTML (2 replies)

Brett Gardner — Sun, 23 May 2010 23:19:06 -0700

The html

foo

gets converted to

foo

by the purifier. It seems to only maintain indentation on closing tags. Is there anyway to get it to maintain indents for the opening "table" and "tr" tags?

Core.CollectErrors: Status? (5 replies)

pinkgothic — Wed, 05 May 2010 05:15:22 -0700

Just a quick question about development tasks not outlined in your TODO:

I was wondering what the current status re: Core.CollectErrors is - is there a chance the feature might be completed in the near future, or is it low-priority? :)

(I'm already using it in its current form, but would need completion for my project. As an example, when...


  
    blah
  
  
    Something.

...is turned into...

Something.

...because the ruleset does not allow for 'head' and 'body' and 'html' tags, then there's no notification.)

Custom HTML elements. (3 replies)

buggedcom — Mon, 03 May 2010 11:08:14 -0700

I've got a question about adding a custom html element. I have a php class that parses output looking for custom html elements. For example

I've tried adding `ctag:pagination` to HTML.Allowed and `ctag:pagination.*` to HTML.AllowedAttributes, however I get the error

Notice: Cannot allow attribute '*' if element 'ctag:pagination' is not allowed/supported (for information on implementing this, see the support forums) in /Users/ollie/Sites/SacrificeApp/Sacrifice/application/vendors/HTMLPurifier/HTMLPurifier/HTMLDefinition.php  on line 316

Am I doing something wrong. Can custom html elements not be added?

HTML5 Support? (7 replies)

Peter Nguyen — Tue, 22 Jun 2010 16:08:58 -0700

Hi,

when will HTML Purifier support HTML5? For example tags like , and end tags without slashes e.g. ?

HTML Trigger (3 replies)

Technocrat — Fri, 16 Apr 2010 09:53:43 -0700

I have been working on optimizing phpinputvalidator. One of the speed issues I have found is HTML Purifier. Obviously with the large over head it is no ideal to use it when it's not needed. You can configure it so it is only used when you tell to use it. But I would like to refine it even more.

Would it be good from a security and a purification standpoint to only trigger HTML purifier if say a < is found? The thought being that if there is not a < then the string shouldn't have any html thus shouldnt need to be run through purifier.

Flash without filtering attributes and etc (4 replies)

rocker — Mon, 05 Apr 2010 08:53:20 -0700

Hello. Could you advice me, how I could disable filtering flash video? Cuz it has many bugs in HTML Purifier. It filters other tags good, but flash is very bad, many players doesnt work. Even videos from youtube are incorrect after parsing: I cant use fullscreen and cant click on youtube logo. I have many other examples with different players from different sites. So, the question is next: how I could say parser, that flash video must be processed with only simple checks like cutting js in attribute onlick? I dont want that parser checks allowed attributes and many other checks. How I could perform it, Mr.Ambush Commander? :) Its very important for me and I really dont know how to solve this problem. Thx.

Preserve and export text but still protect - how? (7 replies)

scanreg — Mon, 29 Mar 2010 09:55:59 -0700

I need to allow users to enter text data into a form and then load that data into a mysql db and then extract that same data for various print jobs.

Thus, the characters that go in must be exactly the same as what is extracted for the print job.

However, of course I'd like to ensure that the data on the server (from upload through extraction) is filtered/cleaned

Is there a way to allow all kinds of characters, extract them exactly the same, but protect the system too?

I know you can filter going in, just not sure how I'd get it all out the same and still keep the system happy.

Thanks so much :-)

Using filters without cleaning (1 reply)

Joshua — Tue, 16 Mar 2010 13:29:22 -0700

After days of trying to configure purifier to clean our html we realized that it was not possible (stripping out forms and all other data we need - this is absurd btw. There are people out there who just want to clean their code as they go from one CMS to another for example). Unfortunately we already wrote complex filters for url and images. Is there a way to keep these without having any stripping/modifying going on? I figured we'll just have to write our own regex to do what we need as far as cleaning the html

Thanks

You tube filter + allowed tags trouble (1 reply)

Whisher — Mon, 08 Mar 2010 12:37:03 -0800

Hi, I'm new at HP so be patience :) I don't see why this snippet don't get rid of the last div :(

function cleanComments($user_input_data)
{
  $purifier = new HTMLPurifier();
$purfier_config = HTMLPurifier_Config::createDefault();
$purfier_config->set('HTML.DefinitionID', 'User Content Filter');
$purfier_config->set('HTML.DefinitionRev', 1);
// these are allowed html tags, means white list
$purfier_config->set('HTML.Allowed', 'a,strong,em,p,span,img,li,ul,ol,sup,sub,small,big,code,blockquote,h1,h2,h3,h4,h5');
// these are allowed html attributes, coool!
$purfier_config->set('HTML.AllowedAttributes', 'a.href,a.title,span.style,span.class,span.id,p.style,img.src,img.style,img.alt,img.title,img.width,img.height');
// auto link given url string
$purfier_config->set('AutoFormat.Linkify', true);
// auto format \r\n lines
//$purfier_config->set('AutoFormat.AutoParagraph', true);
// clean empty tags
$purfier_config->set('AutoFormat.RemoveEmpty', true);
// cache dir, just for symfony of course, you can change to another path
//$purfier_config->set('Cache.SerializerPath', sfConfig::get('sf_cache_dir'));
// translation type, 
$purfier_config->set('HTML.Doctype', 'XHTML 1.0 Transitional');
// allow youtube videos
$purfier_config->set('Filter.YouTube', true);
$purfier_config->set('HTML.TidyLevel', 'heavy');
// now clean your data
$cleanHtml = $purifier->purify($user_input_data, $purfier_config);
  return $cleanHtml;
}
$html = 'http://www.youtube.com/v/BdU--T8rLns">http://www.youtube.com/v/BdU--T8rLns" type="application/x-shockwave-flash" wmode="transparent" width="425" height="350">';
$html .= ' kkkk http://www.google.it/">pippopippo
dddpippo'; 
echo(cleanComments($html));

Bye

Default Configuration (1 reply)

dynamic — Tue, 16 Feb 2010 08:12:39 -0800

Hello All,

What is the the default configuration for HTMLpurifier? ie: what tags are stripped ...etc

can u list the default configuration please :)!

Thanks, Kayed Qunibi

HTMLPurifier + Markdown -> A lot of empty p tags (2 replies)

AzizLight — Sun, 17 Jan 2010 10:06:04 -0800

Hello everybody, I am creating my own minimalist blog engine using codeigniter. I added HTMLPurifier and if works fine. I also use Markdown. I will post here the plugin I use and some code to illustrate my problem:

The plugin: htmlpurifier_pi.php:

function purify($html)
{
	if (empty($html) || trim((string)$html) === '')
	{
		log_message('error','htmlpurifier_pi::purify : The html you sent to the HTML Purifier is empty...I wonder how is that possible...');
		return FALSE;
	}
	
	if (is_array($html))
	{
		foreach ($html as $key => $value)
		{
			$html[$key] = purify($value);
		}
		
		return $html;
	}
	else
	{
		require_once(APPPATH . 'plugins/htmlpurifier/HTMLPurifier.standalone.php'); 
		
		$allowed_tags = 'p,em,i,strong,b,a[href],ul,ol,li,code,pre,blockquote';
		
		$config = HTMLPurifier_Config::createDefault();
		$config->set('HTML.Doctype', 'XHTML 1.0 Strict');
		$config->set('HTML.Allowed', $allowed_tags);
		$config->set('HTML.TidyLevel', 'heavy');
		$config->set('AutoFormat.Linkify', 'true');
		$config->set('AutoFormat.AutoParagraph', 'true');
		$htmlpurifier = new HTMLPurifier($config);
		
		log_message('debug','HTML Purified!');
		return $htmlpurifier->purify($html);
	}
} // End of purify

The example:

$this->load->plugin('htmlpurifier_pi.php');
$body = purify(markdown($this->input->post('body')));

Now if I post the following comment:

This is a list:

* This is a list item
* This is another list item

1. This is the first item of an ordered list
2. This is the second item of an ordered list

Quote:

> Only idiots
> never change their minds

Here is the code that I get:

This is a list:

This is a list item
This is another list item

This is the first item of an ordered list
This is the second item of an ordered list

Quote:

Only idiots never change their minds

See? I get a bunch of empty p tags. How could I get rid of those p tags please?

WYSIWYG or Rich Editor Demo Available? (1 reply)

Shotster — Sun, 17 Jan 2010 01:17:42 -0800

Greetings,

I hope this is the right forum to ask this question, so here goes...

I'm considering using the Phorum software along with HTML Purifier primarily so I can integrate a WYSIWYG editor like CKEditor or YUI. Is there a demo site utilizing such a configuration that anyone can direct me to? I don't want to force my users to know and type arcane mark-up. If anyone can point me in the direction of a demo site, I'd greatly appreciate it.

Thanks,

-Steve

Would this be suited for... (3 replies)

Justin — Thu, 31 Dec 2009 13:54:29 -0800

Hello,

I have been looking into ways to overcome a problem I have with my website and wondered if I could ask you for some more details.

Basically I am coding a website in which I want to allow members of my site to post html/css so they can decorate their profile backgrounds, pages etc!

However I am aware that you can sanitise user input but am confused as to the allowing html, etc!

So by using this script would this ensure that the user input is made safe?

I would want to allow users to use things like etc but not necessarily tables and stuff. Thanks

Question to html purifier experts (5 replies)

Dmitri — Wed, 23 Dec 2009 10:55:33 -0800

Hi!

I am thinking of this idea to write something like html purifier, basically I want to know your opinion of what's wrong with doing it this way: 3 basic steps

1) Convert charset encoding to utf8, like this: if charset is already reported as utf-8 or ascii, then validate that it does not contain illegal chars and strip low bytecode chars (except tab, newline and space) If utf8 does not pass the test for well-formdness, then recode it using iconv UTF-8 to UTF-8 with //IGNORE flag or similarly can use mb_convert_encoding using the "none" as default character If charset is anything other than utf8 then convert it to utf8 using either utf8_encode or iconv or mb_convert_encoding, depending on what extension is available and of cause utf8_encode only works on latin1

2) Fix the html string by running it through Tidy. This will take care of closing unclosed tags, can also remove garbage from MS-Word created HTML. It will also add necessary to the html fragment.

3) The actual stripping off the dangerous tags: do with with DOMDocument/DOMElement classes of php. Since by now we have valid UTF-8 string and fixed HTML, we should be able to load the document into DOMDocument without problems.

Now we can use DOM interface or even Xpath to find all tags that are not on our whitelist (or on our blacklist), and can also find all tags that have dangerous attributes and remove all of them.

The DOMElement removes all decendents, so nesting is solved right there.

Now we have the clean DOMDocument and can dump it back as a string, there are also some tricks to only dump the contents of what's inside the tag, so the actual will not be included in the result if we don't want that.

This looks easy and uses only the extensions that are already in php - mbstring or iconv, tidy and DOM

What's your take on this approach?

About utf8 charset validation (1 reply)

Dmitri — Tue, 22 Dec 2009 18:53:18 -0800

Question about utf8 Does the purifier validate that string contains only the valid utf-8 chars? I know that this type of validation may be time consuming.

I already have written my own utf-8 sanitizor class that validates and recodes the utf-8 string if necessary, so I am 100% confident that my string is 100% utf-8

Is there a way for me to tell the purifier to skip its' charset validation and only do the html tags related work?

So basically I have already done the charset validation/sanitization, and I only need to remove dangerous html tags and maybe fix the bad html.

Could I use HTML Purifier on my website? (2 replies)

codesupplier.com — Sat, 31 Oct 2009 12:08:17 -0700

Hi,

Could I use this great programme on my website and forums at http://www.codesupplier.com/ and http://www.codesupplier.com/apps/forums/ or not? Please tell me... Thanks.

Cheers!

Has HTML purifier it's own editor??? (2 replies)

titia — Thu, 15 Oct 2009 15:04:20 -0700

Hi, i've read that HTMLpurifier had also it's own editor WYSIWYG of a very good quality. But i don't seem able to find it. So, i wonder if what i've read is true and if yes, where can i find it? Thanks, laetitia.

Remove ascii character 160 from HTML (1 reply)

csplrj — Sun, 30 Aug 2009 11:01:26 -0700

How to remove ascii character 160 which shows up as a space on the Firefox 3.0 from HTML?

Thanks in advance

CSJakharia

What is the way to remove all whitespace and from the HTML (1 reply)

csplrj — Sun, 30 Aug 2009 10:59:57 -0700

What is the way to remove all whitespace and from the HTML?

I tried this but then also values in the attribute does not remove spaces $config = HTMLPurifier_Config::createDefault(); $config->set('HTML.Doctype', 'XHTML 1.0 Transitional'); $config->set('HTML.TidyLevel', 'heavy'); $config->set('Attr.EnableID', true); $config->set('AutoFormat.RemoveEmpty.RemoveNbsp', true); $config->set('AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions',array());

$obj = new HTMLPurifier($config);

But this does not converts

  Type

Type

It does not removes extra trailing spaces

Thanks in advance

CSJakharia

custom whitelist? (2 replies)

es555 — Thu, 20 Aug 2009 07:45:14 -0700

I want to use htmlpurifier in such a way that only a strict subset of tags and attributes are allowed. Where and how can I specify the list of html tags and attributes that I want to allow (so that ALL other tags and attributes get immediately filtered out). Thanks.

Generic video/embed filter? (62 replies)

zmonteca — Sun, 20 Jun 2010 18:17:28 -0700

I have read over oodles of posts here and have been unable to find exactly what i'm looking for. I'm looking for something more generic than the YouTube filter in the core of HTMLPurify. The reason for this is I need to support numerous videos, most of the sites would be unknown. Additionally, supporting the flashvars tag is imperative.

Can anyone provide any insight on this?

As it stands now, I have this config and flashvars is filtered out:

require_once 'HTMLPurifier.auto.php';
$config = HTMLPurifier_Config::createDefault();
$config->set('Core.Encoding', 'UTF-8');
$config->set('HTML.Doctype', 'XHTML 1.0 Transitional');
// $config->set('Output.TidyFormat', true);
$config->set('AutoFormat.AutoParagraph', true);
$config->set('AutoFormat.DisplayLinkURI', true);
$config->set('AutoFormat.Linkify', true);
$config->set('AutoFormat.RemoveEmpty', true);
$config->set('AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions', array('td', 'th'));
$config->set('AutoFormat.RemoveEmpty.RemoveNbsp', true);
$config->set('HTML.SafeObject', true);
$config->set('HTML.SafeEmbed', true);
$config->set('HTML.Trusted', true);
$config->set('HTML.TidyLevel', 'light');
$config->set('HTML.EnableAttrID', true);
// $config->set('HTML.Allowed', 'flashvars', 'object', 'embed', 'param');
$config->set('HTML.Allowed', array('param', 'object', 'embed', 'flashvars'));
$config->set('Cache.SerializerPath', Base::clientPath().Cache::DIRECTORY);
$config->set('Filter.YouTube', true);
// $config->set('Filter.Embed', true);
// $config->set('Filter.Playlist', true);

$purifier = new HTMLPurifier($config);
$this->post_data[$var_name] = $purifier->purify($post_value);

On a side note, I was _trying_ to write my own filter, but could never get it to run. Is there something I need to do to activate the plugin?

phpInputValidator (5 replies)

Technocrat — Thu, 13 Aug 2009 12:17:59 -0700

Hey,

I was wonder if you had time if you could take a look at a project I have been working on to validate php input and give me any feed back. It can work in conjunction with HTMLPurifier.

https://www.assembla.com/wiki/show/phpInputValidator/

Thanks

height attribute on removed (8 replies)

DP — Wed, 22 Jul 2009 12:23:11 -0700

Hello,

I'm trying to allow the "height" attribute on the table element, and I can't seem to get it to work properly.

My config is this:


		$config->set('Core', 'Encoding', 'ISO-8859-1');
		$config->set('Core', 'CollectErrors', true);
		$config->set('HTML', 'Doctype', 'XHTML 1.0 Transitional');
		$config->set('Core', 'EscapeNonASCIICharacters', true);
		$config->set('Core', 'EscapeInvalidTags', true);
		$config->set('HTML', 'Trusted', true);
		$config->set('HTML', 'SafeObject', true);
		$config->set('HTML', 'SafeEmbed', true);
		$config->set('HTML', 'EnableAttrID', true);
		$config->set('HTML', 'TidyLevel', 'medium');
		$config->set('Filter', 'YouTube', true);
		$config->set('Cache', 'DefinitionImpl', null); // remove this later!
				
		$config->set('HTML', 'DefinitionID', '1');
		$config->set('HTML', 'DefinitionRev', 2);

$def =& $config->getHTMLDefinition(true);
$def->addAttribute('table', 'height', new HTMLPurifier_AttrDef_Enum(array(0 => '*')));

I have tried to define the value array in multiple ways, but nothing seems to work. If anybody sees what I'm doing wrong, I'd appreciate the input.

RSS (4 replies)

Technocrat — Thu, 16 Jul 2009 09:13:07 -0700

First nice work on v4. I like the improvements.

Would it be possible to create an RSS feed for your news or releases? I would like to keep up to date on your releases since I am using it on 3 projects. I hate blindly coming to the site wondering if there is a new release or not.

Thanks!