TinyMCE not honoring HTML Filtering Settings

[hvelarde]

Brand new Plone 5.0.5 instance; go to Site Setup -> HTML Filtering Settings and remove script from the list of Nasty tags.

Go to a page and edit it adding some content with such tag:

<blockquote class="twitter-tweet" data-lang="pt"><p lang="en" dir="ltr">Michel Temer now being mocked globally not only for attacking democracy but also cowardice <a href="https://t.co/AheHiR1hYj">https://t.co/AheHiR1hYj</a> <a href="https://t.co/AIoePfg1NH">pic.twitter.com/AIoePfg1NH</a></p>&mdash; Glenn Greenwald (@ggreenwald) <a href="https://twitter.com/ggreenwald/status/763012536631431168">9 de agosto de 2016</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

Save it: the script tag is filtered anyway:

[hvelarde]

Using Disable html filtering works neither.

[sneridagh]

I can confirm that adding offending attributes does not work neither. It seems that the whole safe_html transform is not working at all for Plone 5.0.6.

[tisto]

When I moved the control panel to z3c.form I wrote acceptance tests for the filters:

https://github.com/plone/Products.CMFPlone/blob/master/Products/CMFPlone/tests/robot/test_controlpanel_filter.robot

FYI: The transforms were broken before my PLIP (I wrote the test before the implementation). So at least we have a pretty good idea of what is currently broken.

[sneridagh]

@plone/framework-team It seems to me that this issue should have the highest priority... not the current low.

[tisto]

Bottom line is that the implementation of safe_html is just broken by design. We are using regular expressions to parse HTML. We started to work on https://github.com/collective/experimental.safe_html_transform to solve the problem properly, but we never reached a stable point.

[tisto]

@hvelarde are you still interested in a solution for that? Unfortunately we do not have any budget in our current project to solve this issue properly. Though, I could to chip in some money/dev time if others are willing to do the same...

[hvelarde]

we can allocate human resources if someone can provide guidance to fix this.

CC @agnogueira

[abosio]

I just noticed it would work for me with new Custom Tags if I disabled filtering, saved, then reenabled and saved on Plone 5.0.7.