HTMLPurifier allow class attribute

Question

How can i allow "class" in HTMLPurifier? I am trying to purify this:

 <div class="txt_r" id="test">Blah</div>

And i get:

 <div id="test">Blah</div>

Why class is dissapeared? I am using next config:

 $config->set('Attr.EnableID', true);
 $config->set('CSS.Trusted', true);
 $config->set('HTML.AllowedAttributes', 'style, src, class');

Hooch

Why are you using CSS.Trusted? – Schapira

I am not sure, for enabling inline css? – Hooch

No, that's wrong. I really made a big mistake calling these configuration directives "Trusted", they should really be called "UnsafeAllowXSS". Turn it off if you don't know why you're using it. – Schapira

Well tnx for advice, but if i turn this off, i dont know how to allow CSS like: top, left, bottom, right and something more. – Hooch

Answer 1

Your problem is probably that HTML.AllowedAttributes doesn't actually work that way. :) From the docs:

The syntax is "tag.attr" or "*.attr" for the global attributes (style, id, class, dir, lang, xml:lang).

What you probably want is...

$config->set('HTML.AllowedAttributes', 'img.src,*.style,*.class');

You also shouldn't use HTML.AllowedAttributes by itself, but in tandem with HTML.AllowedElements:

$config->set('HTML.AllowedElements', 'img,div');

Alternatively, use neither HTML.AllowedAttributes nor HTML.AllowedElements and instead use HTML.Allowed. That would look something like this:

$config->set('HTML.Allowed', 'div, *[style|class], img[src]');

Arriaga

Hi, tnx for the answer, it will be useful for the future :) I found solution this morning: $config = HTMLPurifier_Config::createDefault(); $config->set('Attr.EnableID', true); $config->set('CSS.Trusted', true); I dont even know why i filtered attributes, when i need all of them. And i hope this still filters JS :S – Hooch

The default Whitelist of HTML Purifier's is robust, safe and rigorously tested. You'd have to go out of your way to teach it to accept <script> or other trickery. You should definitely be safe. :) (Though you really ought to re-evaluate if you need CSS.Trusted, as Edward already said.) – Arriaga

Well, i re-evaluated CSS.Trusted and removed it, but now top, left, botom and right properties in inline css is missing :( Now i feel like cat chasing own tail :) – Hooch

left, right, bottom, top all depend on position. The combination lets someone using your site cover up parts of the site embedding their content, thereby impeding its use, defacing the site, or otherwise screw with your layout maliciously (e.g. phishing). But take a look at htmlpurifier.org/live/configdoc/plain.html#CSS.AllowTricky - that should be what you want; continue to stay away from CSS.Trusted. – Arriaga

@Arriaga In laravel purifier config: 'HTML.Allowed' => 'div,b,strong,i,em,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]'. I updated p[style] to p[style|class]. Is there any way to specify class? So that I want to allow only a custom class like "my-class". – Leukoderma

@user2356198 That seems like a different question to me. You'll want to ask it as a question - then more people have a chance to help you. :) – Arriaga