Standard
class Standard extends Xss implements EditorXssFilterInterface (View source)
Defines the standard text editor XSS filter.
Properties
| static protected array | $adminTags | The list of HTML tags allowed by filterAdmin(). |
from Xss |
| static protected array | $htmlTags | The default list of HTML tags allowed by filter(). |
from Xss |
Methods
Filters HTML to prevent cross-site-scripting (XSS) vulnerabilities.
Applies a very permissive XSS/HTML filter for admin-only use.
Processes an HTML tag.
Whether this element needs to be removed altogether.
Gets the standard list of HTML tags allowed by Xss::filter().
Filters HTML to prevent XSS attacks when a user edits it in a text editor.
Applies a very permissive XSS/HTML filter to data-attributes.
Get all allowed tags from a restrictions data structure.
Get all forbidden tags from a restrictions data structure.
Details
in
Xss at line 59
static string
filter($string, array $html_tags = NULL)
Filters HTML to prevent cross-site-scripting (XSS) vulnerabilities.
Based on kses by Ulf Harnhammar, see http://sourceforge.net/projects/kses. For examples of various XSS attacks, see: http://ha.ckers.org/xss.html.
This code does four things:
- Removes characters and constructs that can trick browsers.
- Makes sure all HTML entities are well-formed.
- Makes sure all HTML tags and attributes are well-formed.
- Makes sure no HTML tags contain URLs with a disallowed protocol (e.g. javascript:).
in
Xss at line 122
static string
filterAdmin(string $string)
Applies a very permissive XSS/HTML filter for admin-only use.
Use only for fields where it is impractical to use the whole filter system, but where some (mainly inline) mark-up is desired (so \Drupal\Component\Utility\Html::escape() is not acceptable).
Allows all tags that can be used inside an HTML body, save for scripts and styles.
in
Xss at line 143
static protected string
split(string $string, array $html_tags, string $class)
Processes an HTML tag.
in
Xss at line 202
static protected string
attributes(string $attributes)
Processes a string of HTML attributes.
static protected bool
needsRemoval($html_tags, $elem)
Whether this element needs to be removed altogether.
in
Xss at line 350
static array
getAdminTagList()
Gets the list of HTML tags allowed by Xss::filterAdmin().
in
Xss at line 360
static array
getHtmlTagList()
Gets the standard list of HTML tags allowed by Xss::filter().
static string
filterXss(string $html, FilterFormatInterface $format, FilterFormatInterface $original_format = NULL)
Filters HTML to prevent XSS attacks when a user edits it in a text editor.
Should filter as minimally as possible, only to remove XSS attack vectors.
Is only called when:
- loading a non-XSS-safe text editor for a $format that contains a filter preventing XSS attacks (a FilterInterface::TYPE_HTML_RESTRICTOR filter): if the output is safe, it should also be safe to edit.
- loading a non-XSS-safe text editor for a $format that doesn't contain a filter preventing XSS attacks, but we're switching from a previous text format ($original_format is not NULL) that did prevent XSS attacks: if the output was previously safe, it should be safe to switch to another text format and edit.
static protected string
filterXssDataAttributes(string $html)
Applies a very permissive XSS/HTML filter to data-attributes.
static protected array
getAllowedTags(array|false $restrictions)
Get all allowed tags from a restrictions data structure.
static protected array
getForbiddenTags(array|false $restrictions)
Get all forbidden tags from a restrictions data structure.