ezyang / htmlpurifier

Standards compliant HTML filter written in PHP
http://htmlpurifier.org
GNU Lesser General Public License v2.1
3.02k stars 323 forks source link

`DirectLex` will cause PHP error #393

Open lenhatthanh20 opened 6 months ago

lenhatthanh20 commented 6 months ago

https://github.com/ezyang/htmlpurifier/blob/bbc513d79acf6691fa9cf10f192c90dd2957f18c/library/HTMLPurifier/Token/Tag.php#L47

Hello, When I use HTML Purifier with Core.LexerImpl = DirectLex, The PHP error will cause in above line when I purify the below data: <a href="https://example.com/" 10="hoge">Test</a> Because the key of attribute is non-string value. So the PHP error will be occured. Ref: https://www.php.net/manual/en/function.ctype-lower.php

Please help to fix it. I think we can fix it by using quick typecast in the Tag.php file: $key = (string)$key;

Or remove the attribute if the key is non-string value.

Thank you so much

bytestream commented 6 months ago

What is the value of $attr and $key if you dump the values? It's perhaps something to do with 10 not being a valid attribute name.

lenhatthanh20 commented 6 months ago

When I dump the value:

In my example, the attribute key is 10 and the value is hoge. I know the attribute key 10 is invalid because it is a non-string. But my expected is: