tgalopin / html-sanitizer

Sanitize untrustworthy HTML user input
MIT License
390 stars 41 forks source link

Images src attribute removed #30

Closed alartigue closed 5 years ago

alartigue commented 5 years ago

Hi, I'm trying to use html-sanitizer to allow users to create articles in a Blog style application I'm building. I can't figure out why sanitizer is removing src attribute from images tags.

The config I'm using is this one $this->sanitizerConfig = [ 'extensions' => ['basic', 'code', 'image', 'list', 'table'], 'tags' => [ 'a' => [ 'allowed_hosts' => null, 'allow_mailto' => true, ], 'img' => [ 'allowed_attributes' => ['src', 'alt', 'title', 'width', 'height'], 'allowed_hosts' => null, 'allow_data_uri' => true, 'force_https' => false, ], 'div' => [ 'allowed_attributes' => ['class'], ], 'span' => [ 'allowed_attributes' => ['class'], ], 'table' => [ 'allowed_attributes' => ['class'], ], 'p' => [ 'allowed_attributes' => ['class'], ], 'h1' => [ 'allowed_attributes' => ['class'], ], 'h2' => [ 'allowed_attributes' => ['class'], ], 'h3' => [ 'allowed_attributes' => ['class'], ], 'h4' => [ 'allowed_attributes' => ['class'], ], ], ]; this is the html before sanitizing "<p><img src="/images/uploaded/articles/1b75dd06bf92c5e04e1491af441491fe9a7d7bab.png" alt="Test image" width="960" height="638" /></p>" and this is what I get from sanitize method.

"<p><img alt="Test image" width="960" height="638" /></p>"

Thanks for your help.

olegatro commented 5 years ago

see #28

alartigue commented 5 years ago

You're right. I didn't see that comment. I'm closing this issue. Thanks