htmlLawed class whitelisting

Comments

• Options

  x00 MVP

  October 2013

  you need to pass a function to $Config['hook_tag'] if you are not using safe styles there Already is such a function, which is a good example.

  there are two parameter of the function the element and the attributes array. You can detect class then check the values against a lookup.

  I also recommend applying name spacing/unique names, this stops people exploiters using common class names, that may vary in context.

  grep is your friend.

  2
• Options

  50sQuiff ✭✭

  October 2013

  Thanks for the pointer @x00. Here's my code:

  First, make sure you have this line uncommented in class.htmlawed.plugin.php:

  $Config['hook_tag'] = 'HTMLawedHookTag';

  Then the Hook Tag function:

  function HTMLawedHookTag($Element, $Attributes) {
     $Attribs = '';
     $PermClasses = array('YOURCLASS', 'ANOTHERCLASS');
     foreach ($Attributes as $Key => $Value) {   
         if (strcasecmp($Key, 'class') == 0) {       
             if (!in_array($Value, $PermClasses))
                continue;
         }
        $Attribs .= " {$Key}=\"{$Value}\"";
     }
     return "<{$Element}{$Attribs}>";
  }
  

  2
• Options

  x00 MVP

  October 2013 edited October 2013

  As you can have multiple classes per element you could split the value on white space, then if there is more than one class per element it with be matched. You would need an inner loop, then you would join them back together.

  grep is your friend.

  1
• Options

  50sQuiff ✭✭

  October 2013 edited October 2013

  Not an issue for me, where I only have to add a few class combinations to the whitelist, but I think that's good advice.

  0