htmlLawed class whitelisting

50sQuiff

I've searched around for this and I can't find any examples. Does anyone know how you create a whitelist of class names (and deny the rest) in htmlLawed?

x00

you need to pass a function to $Config['hook_tag'] if you are not using safe styles there Already is such a function, which is a good example.

there are two parameter of the function the element and the attributes array. You can detect class then check the values against a lookup.

I also recommend applying name spacing/unique names, this stops people exploiters using common class names, that may vary in context.

50sQuiff

Thanks for the pointer @x00. Here's my code:

First, make sure you have this line uncommented in class.htmlawed.plugin.php:

$Config['hook_tag'] = 'HTMLawedHookTag';

Then the Hook Tag function:

function HTMLawedHookTag($Element, $Attributes) {
   $Attribs = '';
   $PermClasses = array('YOURCLASS', 'ANOTHERCLASS');
   foreach ($Attributes as $Key => $Value) {   
       if (strcasecmp($Key, 'class') == 0) {       
           if (!in_array($Value, $PermClasses))
              continue;
       }
      $Attribs .= " {$Key}=\"{$Value}\"";
   }
   return "<{$Element}{$Attribs}>";
}

x00

As you can have multiple classes per element you could split the value on white space, then if there is more than one class per element it with be matched. You would need an inner loop, then you would join them back together.

50sQuiff

Not an issue for me, where I only have to add a few class combinations to the whitelist, but I think that's good advice.