Skip to content

Conversation

dmsnell
Copy link
Owner

@dmsnell dmsnell commented Sep 11, 2024

Based on WordPress#7331

Add constraints when serializing/normalizing HTML to remove unwanted tags or attributes.

// Apply value constraints.
$html = WP_HTML_Processor::normalize(
	'<p id=3 data-id=thrive class=another-tag>Just <em class=fixme><script>gotcha</script>another</em> snippet.</p>',
	array(
		'em' => array( 'class' => true ),
		'p'  => array(
			'class'   => true,
			'id'      => array( 'minval' => 1 ),
			'data-id' => array( 'minlen' => '3' )
		)
	)
);

$html === <<<HTML
<p class="another-tag" id="3" data-id="thrive">Just <em class="fixme">another</em> snippet.</p>
HTML;

// Require attributes to add a tag.
$html = WP_HTML_Processor::normalize(
	'<li><p id=3 data-id=thrive class=another-tag>Just <em class=fixme><script>gotcha</script>another</em> snippet.</p>',
	array(
		'li' => true,
		'em' => array( 'class' => true ),
		'p'  => array( 'data-important' => array( 'required' => true ) )
	)
);

$html === <<<HTML
<li>Just <em class="fixme">another</em> snippet.</li>
HTML;

@todo Still needs to constrain $allowed_protocols.

Copy link

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props dmsnell.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant