ezyang/htmlpurifier

`DirectLex` will cause PHP error

lenhatthanh20 opened this issue · 2 comments

if (!ctype_lower($key)) {

Hello,
When I use HTML Purifier with Core.LexerImpl = DirectLex, The PHP error will cause in above line when I purify the below data:
<a href="https://example.com/" 10="hoge">Test</a>
Because the key of attribute is non-string value. So the PHP error will be occured.
Ref: https://www.php.net/manual/en/function.ctype-lower.php

Please help to fix it.
I think we can fix it by using quick typecast in the Tag.php file:
$key = (string)$key;

Or remove the attribute if the key is non-string value.

Thank you so much

What is the value of $attr and $key if you dump the values? It's perhaps something to do with 10 not being a valid attribute name.

When I dump the value:

  • The $key is 10 (non-string)
  • The $value is hoge

In my example, the attribute key is 10 and the value is hoge. I know the attribute key 10 is invalid because it is a non-string.
But my expected is:

  • Output: <a href="https://example.com/">Test</a> (remove invalid attribute 10)
  • There is no PHP error or warning.