TinyMCE stripping anchor tags within or around DIVs

ctgraham · May 6, 2022, 1:18pm

I’m not aware of a way to configure this without a code change.

The code which is enforcing HTML4 rules appears to be here:

pkp/pkp-lib/blob/5df21eaf4f975f927ac40fc261c0f2c7ee649130/classes/core/PKPString.inc.php#L394-L414

      
        
            /**
             * Strip unsafe HTML from the input text. Covers XSS attacks like scripts,
             * onclick(...) attributes, javascript: urls, and special characters.
             *
             * @param string $input input string
             *
             * @return string
             */
            public static function stripUnsafeHtml($input)
            {
                static $purifier;
                if (!isset($purifier)) {
                    $config = \HTMLPurifier_Config::createDefault();
                    $config->set('Core.Encoding', 'utf-8');
                    $config->set('HTML.Doctype', 'HTML 4.01 Transitional');
                    $config->set('HTML.Allowed', Config::getVar('security', 'allowed_html'));
                    $config->set('Cache.SerializerPath', 'cache');
                    $purifier = new \HTMLPurifier($config);
                }
                return $purifier->purify($input);
            }

HTMLPurifier does not appear to support HTML5 as a DOCTYPE:
http://htmlpurifier.org/live/configdoc/plain.html#HTML.Doctype
and it doesn’t appear that the project intends to support HTML5:

github.com/ezyang/htmlpurifier

HTML5 support

opened 03:15PM - 24 Jan 18 UTC

mattez

Is it planed to support HTML5? Is really needed to use these in 2018: ### de…tails / summary ```html <details> Defines additional details that the user can view or hide <summary> Defines a visible heading for a <details> element ``` see: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/details ### figure ```html <figcaption> Defines a caption for a <figure> element <figure> Defines self-contained content ``` see: http://html5doctor.com/the-figure-figcaption-elements/ ### structure ```html <article> Defines an article in a document <section> Defines a section in a document <header> Defines a header for a document or section <footer> Defines a footer for a document or sectio ``` and others... see: [New HTML5 Elements (w3.org)](https://www.w3.org/wiki/HTML/New_HTML5_Elements)

Another add-in library might provide a solution:

All of the potential solutions and workarounds will require development time, however, either by the PKP team or by a community contributor.