Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added: Sanitize::rename_attributes() #717

Merged
merged 5 commits into from
Feb 5, 2022

Conversation

math-GH
Copy link
Contributor

@math-GH math-GH commented Jan 27, 2022

I want to bring a new method that we implemented into Simplepie of FreshRSS: FreshRSS/FreshRSS#4175

The use case:
Simplepie can clean the HTML with strip_attributes(), but in some cases it would be very useful to keep the information of some attributes under another attribute name, f.e. id and class
The new rename_attributes() methods enables it. The id and class attributes could be renamed to data-sanitized-id / data-sanitized-class.

The benefit: when HTML/XML/RSS is included into an existing HTML DOM the imported HTML/XML/RSS could have id/class attributes that are already defined in the DOM, but with another meaning. Rename this attributes brings id/class out of standard CSS behavior but keeps the information. It is still possible to style it with div[data-sanitized-class*="CLASSNAME"]

It would be a pleasure to extend Simplepie with this little improvement.

library/SimplePie.php Outdated Show resolved Hide resolved
@@ -650,6 +650,13 @@ class SimplePie
*/
public $strip_htmltags = array('base', 'blink', 'body', 'doctype', 'embed', 'font', 'form', 'frame', 'frameset', 'html', 'iframe', 'input', 'marquee', 'meta', 'noscript', 'object', 'param', 'script', 'style');

/**
* @var array Stores the default tags to be stripped by rename_attributes().
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe use string[] as a more detailed type annotation.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I want to keep it similar to:

public $strip_attributes = array('bgsound', 'class', 'expr', 'id', 'style', 'onclick', 'onerror', 'onfinish', 'onmouseover', 'onmouseout', 'onfocus', 'onblur', 'lowsrc', 'dynsrc');
/**
* @var array Stores the default attributes to add to different tags by add_attributes().
* @see SimplePie::add_attributes()
* @access private
*/
public $add_attributes = array('audio' => array('preload' => 'none'), 'iframe' => array('sandbox' => 'allow-scripts allow-same-origin'), 'video' => array('preload' => 'none'));

@@ -1218,6 +1225,15 @@ public function strip_htmltags($tags = '', $encode = null)
}
}

public function rename_attributes($tags = '', $encode = null)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be nice to have a doc comment.

library/SimplePie.php Outdated Show resolved Hide resolved
@@ -145,6 +146,25 @@ public function pass_file_data($file_class = 'SimplePie_File', $timeout = 10, $u
}
}

public function rename_attributes($tags = array())
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we could prefix the method name with set to make it clear it is just a setter. I know the old setters do not follow this convention but we could start switching to more modern names (and deprecate the old ones after #711).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, it would be better. Let's do it in another PR. I want to focus here on the rename method

}
else
{
$this->rename_attributes = explode(',', $tags);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any need to support comma separated strings, rather than just arrays of strings? Apps can always do the explosion themselves.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is the same as:

public function strip_htmltags($tags = array('base', 'blink', 'body', 'doctype', 'embed', 'font', 'form', 'frame', 'frameset', 'html', 'iframe', 'input', 'marquee', 'meta', 'noscript', 'object', 'param', 'script', 'style'))
{
if ($tags)
{
if (is_array($tags))
{
$this->strip_htmltags = $tags;
}
else
{
$this->strip_htmltags = explode(',', $tags);
}
}
else
{
$this->strip_htmltags = false;
}
}

}
else
{
$this->rename_attributes = false;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not just use array() and have the foreach be a no-op?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is the same as:

public function strip_htmltags($tags = array('base', 'blink', 'body', 'doctype', 'embed', 'font', 'form', 'frame', 'frameset', 'html', 'iframe', 'input', 'marquee', 'meta', 'noscript', 'object', 'param', 'script', 'style'))
{
if ($tags)
{
if (is_array($tags))
{
$this->strip_htmltags = $tags;
}
else
{
$this->strip_htmltags = explode(',', $tags);
}
}
else
{
$this->strip_htmltags = false;
}
}

@mblaney
Copy link
Member

mblaney commented Feb 5, 2022

thanks @math-GH looks good

@mblaney mblaney merged commit baf82e8 into simplepie:master Feb 5, 2022
@jtojnar
Copy link
Contributor

jtojnar commented Feb 5, 2022

The issue with the changes is once we release it, we will not be able able to change it (until 2.0) unless we include more compatibility shims. We should strive to make any new API clearer from the get go, not try to make it look like API that was designed ages ago.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants