stevebauman/purify

Allow style element

Closed this issue · 1 comments

kikz4life commented

Hi,

first of all thank you very much for this.

My question is how to accept <style></style>. I tried adding it in the config/purify but to no avail.
'HTML.Allowed' => 'style,div,b,strong,i,em,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]',

stevebauman commented

Hi @kikz4life, this is entirely an HTMLPurifier question since all my package is, is a wrapper allowing easy access and configuration.

This will be tricky, since it's actually invalid HTML for style tags to be inside of a web pages <body> and not in the <head>, so HTMLPurifier doesn't even allow for these to be inserted, since it could be exploited in various ways that it cannot protect against (disclaimer).

You'll actually need to extract any styles and insert them back into the content that the user has submitted. Here's the walk-through example from their documentation:

http://htmlpurifier.org/live/configdoc/plain.html#Filter.ExtractStyleBlocks