-
Notifications
You must be signed in to change notification settings - Fork 231
Open
Description
I'm experiencing an issue where the HTML Purifier is removing <style> tags even when explicitly allowed in the configuration.
Configuration
'editor_html' => [
'HTML.Doctype' => 'HTML 4.01 Transitional',
'HTML.AllowedElements' => 'abbr,b,blockquote,br,code,div,em,h1,h2,h3,h4,h5,h6,hr,i,li,mark,ol,p,pre,s,small,span,strong,sub,sup,table,tbody,td,tfoot,th,thead,tr,u,ul,style',
'HTML.AllowedAttributes' => 'title,width,height,colspan,rowspan,class,id,style',
'HTML.ForbiddenAttributes' => 'on*,style=expression',
'HTML.Trusted' => true,
'Attr.AllowedFrameTargets' => ['_blank'],
'AutoFormat.AutoParagraph' => false,
'AutoFormat.RemoveEmpty' => true,
'URI.SafeIframeRegexp' => null,
'CSS.AllowedProperties' => '*',
'CSS.AllowTricky' => true,
'CSS.Proprietary' => true,
],Steps to Reproduce
Clean content containing style tags:
$clean = Purifier::clean('<style>p {color: red;}</style><p>Test</p>');Output shows style tag is removed:
<p>Test</p>Expected Behavior
<style>p {color: red;}</style><p>Test</p>Troubleshooting Attempted
- Added style to HTML.AllowedElements
- Enabled HTML.Trusted
- Set CSS.AllowedProperties to *
- Cleared config cache (php artisan config:clear)
- Tried custom element definition
Additional Information:
- PHP Version: 8.2
- Server Environment: Homestead/Laravel Sail
Relevant Packages:
- laravel/framework v11.0
- mews/purifier v3.4.2
Request
Please help identify:
- If this is a bug or configuration error
- Safe alternatives to allow style tags
- Any known workarounds
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels