mewebstudio / Purifier

HTMLPurifier for Laravel 5/6/7/8/9/10/11
MIT License
1.88k stars 229 forks source link

Img not allowing Style #78

Open egknight opened 6 years ago

egknight commented 6 years ago

I am trying to clean but allow the style attribute..

Input

"<img class="img-fluid" src="/storage/uploads/abc.jpeg" alt="abc.jpeg" style="width: 25%;">\n"

Output

"""
<p><img class="img-fluid" src="/storage/uploads/abc.jpeg" alt="abc.jpeg">\n
</p>
"""

I've configured my settings as follows, including style within img[]

'HTML.Allowed'             => 'div,b,strong,i,em,u,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src|class|style]',

When I remove class from the img[] section it will strip class, but having style included still results in it being stripped.

I'm running PHP 7.1

Thanks

nitogel commented 6 years ago

Same trouble

alextouzel commented 6 years ago

I had the same problem until I realized it was removing the style attributes because all style properties inside my style attribute were not allowed according to the 'CSS.AllowedProperties' in the config just below 'HTML.Allowed'.

In your case, your style attribute only has the 'width' property, which is not included in 'CSS.AllowedProperties' by default. Try adding it.

qwebdev commented 6 years ago

Looks like by default sizes can only be fixed values. You can disable the pixels check with something like this:

[
            'HTML.Allowed'             => 'div,b,strong,i,em,u,a[href|title],ul,ol,li,p[style],br,span[style],img[alt|src|style],code,pre',
            'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align,width,max-width',
            // This config option allows for b64 & regular linked images
            'URI.AllowedSchemes' => ['data' => true,'src'=>true,'http' => true, 'https' => true,],
            // This config option disables the pixel checks
            'HTML.MaxImgLength'   => NULL,
            'CSS.MaxImgLength'   => NULL,
]