joomla / joomla-cms

Home of the Joomla! Content Management System
https://www.joomla.org
GNU General Public License v2.0
4.79k stars 3.65k forks source link

Text Filter removes boolean attributes if they are not last in the attributes order #43644

Open ryandemmer opened 5 months ago

ryandemmer commented 5 months ago

Steps to reproduce the issue

Assuming you are logged in as a Super User:

  1. In the Global Configuration, set the Default Editor to "Editor - None"
  2. In the Global Configuration, click on the Text Filter tab and set the Filter Type for the Super User group to Default Forbidden List.
  3. Create a new Article with any Title eg: Video test.
  4. Paste the following code into the textarea. The src value is irrelevant:
    <video src="images/big_buck_bunny_trailer_480p.mp4" autoplay controls width="854" height="315"></video>
  5. Click Save.

Expected result

Boolean attributes autoplay and controls are retained.

Actual result

Boolean attributes autoplay and controls are removed.

System information (as much as possible)

Joomla 4.4.x amd Joomla 5.x PHP 8.x

Additional comments

If the boolean attributes are set as the last attributes, then they are retained, eg:

<video src="images/big_buck_bunny_trailer_480p.mp4" width="854" height="315" autoplay controls></video>

The boolean attributes are still removed if they have empty values, eg: controls="" The boolean attributes are not removed if they have non-empty values, eg: controls="controls"

ryandemmer commented 5 months ago

Is there any paraticular reason why we might not use DOMDocument to extract and process tags and attributes? Performance?

Hackwar commented 3 months ago

The filtering is done by the framework filter package. The problem most likely is in InputFilter::remove(). At least for now, it would have to be fixed there. @ryandemmer would you be willing to work on this and create a PR against the 2.x-dev branch? https://github.com/joomla-framework/filter Please also extend the tests to check for this situation, so that we are sure this is covered.

ryandemmer commented 3 months ago

@ryandemmer would you be willing to work on this and create a PR against the 2.x-dev branch? https://github.com/joomla-framework/filter

I'll certainly give it my best shot :)