Documentation

RichTextSanitiser
in package

FinalYes

Helper that strictly validates and sanitises user submitted HTML Intended for use with front-end instances of TinyMCE to ensure XSS is impossible.

Tags
note

Operates in a whitelist mode; if a tag or attribute doesn't appear on the list it won't appear on the output.

Table of Contents

Constants

ATTR_TYPE_CLASS  : mixed = 2
ATTR_TYPE_SRC  : mixed = 3
ATTR_TYPE_STYLE  : mixed = 4
ATTR_TYPE_TEXT  : mixed = 0
ATTR_TYPE_URL  : mixed = 1

Properties

$default_permitted_tags  : mixed
The default set of tags (and attributes) that are permitted
$dom_doc  : mixed
$errors  : mixed
$local_resources  : bool
$permitted_tags  : mixed

Methods

__construct()  : mixed
Construct the sanitiser given a string of HTML
getErrors()  : array<string|int, mixed>
Get the list of errors produced during @see RichTextSanitiser::sanitise
hasErrors()  : bool
Checks whether any errors occurred during sanitising
sanitise()  : string
Gets a sanitised copy of the HTML
setLocalResources()  : void
Set whether to only allow local resources to be referenced by automatically fetching attributes e.g. the src attribute on an <img> tag. Does not apply to the href attribute as that won't be automatically fetched by a browser.
encodeAttributeValue()  : string|bool
Encodes the value of an attribute using the correct encoding based on type
sanitiseNode()  : mixed
Recursively sanitises a node and its children, echoing any output in order of appearance

Constants

Properties

$default_permitted_tags

The default set of tags (and attributes) that are permitted

public static mixed $default_permitted_tags = ['div' => ['class' => self::ATTR_TYPE_CLASS], 'p' => ['class' => self::ATTR_TYPE_CLASS, 'style' => self::ATTR_TYPE_STYLE], 'span' => ['class' => self::ATTR_TYPE_CLASS], 'strong' => null, 'em' => null, 'h1' => ['class' => self::ATTR_TYPE_CLASS], 'h2' => ['class' => self::ATTR_TYPE_CLASS], 'h3' => ['class' => self::ATTR_TYPE_CLASS], 'h4' => ['class' => self::ATTR_TYPE_CLASS], 'h5' => ['class' => self::ATTR_TYPE_CLASS], 'h6' => ['class' => self::ATTR_TYPE_CLASS], 'h7' => ['class' => self::ATTR_TYPE_CLASS], 'img' => ['src' => self::ATTR_TYPE_SRC, 'alt' => self::ATTR_TYPE_TEXT], 'a' => ['class' => self::ATTR_TYPE_CLASS, 'href' => self::ATTR_TYPE_URL, 'title' => self::ATTR_TYPE_TEXT], 'ul' => ['class' => self::ATTR_TYPE_CLASS], 'ol' => ['class' => self::ATTR_TYPE_CLASS], 'li' => ['class' => self::ATTR_TYPE_CLASS]]

$local_resources

private bool $local_resources = false

Permit only local (i.e. on the current server) resources in src attributes

Methods

__construct()

Construct the sanitiser given a string of HTML

public __construct(string $richtextData[, array<string|int, mixed> $permitted_tags = null ]) : mixed
Parameters
$richtextData : string

The HTML to sanitise

$permitted_tags : array<string|int, mixed> = null

An optional array of permitted tags to override the defaults

getErrors()

Get the list of errors produced during @see RichTextSanitiser::sanitise

public getErrors() : array<string|int, mixed>
Return values
array<string|int, mixed> —

An array of error messages. Obviously, you must HTML encode each entry for them to be safe for web use as they may contain values from the DOM.

hasErrors()

Checks whether any errors occurred during sanitising

public hasErrors() : bool
Return values
bool

sanitise()

Gets a sanitised copy of the HTML

public sanitise() : string
Return values
string —

HTML with any elements or attributes not appearing on the whitelist removed

setLocalResources()

Set whether to only allow local resources to be referenced by automatically fetching attributes e.g. the src attribute on an <img> tag. Does not apply to the href attribute as that won't be automatically fetched by a browser.

public setLocalResources(bool $local) : void
Parameters
$local : bool

True if only local resources are allowed, false if any resource is permitted

encodeAttributeValue()

Encodes the value of an attribute using the correct encoding based on type

private encodeAttributeValue(int $type, string $value) : string|bool
Parameters
$type : int

The attribute type code, e.g. ATTR_TYPE_URL

$value : string

The attribute value as seen in the DOM

Return values
string|bool —

A safely encoded attribute value or false if the value fails the checks

sanitiseNode()

Recursively sanitises a node and its children, echoing any output in order of appearance

private sanitiseNode(DOMNode $node) : mixed
Parameters
$node : DOMNode

The node to sanitise

On this page

Search results