phplaravelhtmlpurifier

Laravel HTMLPurifier filtering base64 encoded images


I am using Laravel HTMLPurifer to filter content inputted by a ckeditor form.

However the default configuration is filtering images that have the image content as a base64 encoded src.

I've looked at these links but the solutions provided in them did not work for me:

The main issue with these suggestions is that they work with the HTMLPurifier package not the Mews Laravel HTMLPurifier package. A similar situation is described in this question Laravel Mews HTMLPurifier - add custom config

I've tried this config:

return [
'encoding'      => 'UTF-8',
'finalize'      => true,
'cachePath'     => storage_path('app/purifier'),
'cacheFileMode' => 0755,
'settings'      => [
    'default' => [
        'HTML.Doctype'             => 'HTML 4.01 Transitional',
        'HTML.Allowed'             => 'div,b,strong,i,em,u,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src],table[border|width|style],tbody,tr,td,th,blockquote',
        'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align',
        'AutoFormat.AutoParagraph' => true,
        'AutoFormat.RemoveEmpty'   => true,
    ],
    'test'    => [
        'Attr.EnableID' => 'true',
    ],
    'URI' => [
        'AllowedSchemes' => [
            'data' => true
        ],
    ],
    "youtube" => [
        "HTML.SafeIframe"      => 'true',
        "URI.SafeIframeRegexp" => "%^(http://|https://|//)(www.youtube.com/embed/|player.vimeo.com/video/)%",
    ],
    'custom_definition' => [
        'id'  => 'html5-definitions',
        'rev' => 1,
        'debug' => false,
        'elements' => [
            // http://developers.whatwg.org/sections.html
            ['section', 'Block', 'Flow', 'Common'],
            ['nav',     'Block', 'Flow', 'Common'],
            ['article', 'Block', 'Flow', 'Common'],
            ['aside',   'Block', 'Flow', 'Common'],
            ['header',  'Block', 'Flow', 'Common'],
            ['footer',  'Block', 'Flow', 'Common'],

            // Content model actually excludes several tags, not modelled here
            ['address', 'Block', 'Flow', 'Common'],
            ['hgroup', 'Block', 'Required: h1 | h2 | h3 | h4 | h5 | h6', 'Common'],

            // http://developers.whatwg.org/grouping-content.html
            ['figure', 'Block', 'Optional: (figcaption, Flow) | (Flow, figcaption) | Flow', 'Common'],
            ['figcaption', 'Inline', 'Flow', 'Common'],

            // http://developers.whatwg.org/the-video-element.html#the-video-element
            ['video', 'Block', 'Optional: (source, Flow) | (Flow, source) | Flow', 'Common', [
                'src' => 'URI',
                'type' => 'Text',
                'width' => 'Length',
                'height' => 'Length',
                'poster' => 'URI',
                'preload' => 'Enum#auto,metadata,none',
                'controls' => 'Bool',
            ]],
            ['source', 'Block', 'Flow', 'Common', [
                'src' => 'URI',
                'type' => 'Text',
            ]],

            // http://developers.whatwg.org/text-level-semantics.html
            ['s',    'Inline', 'Inline', 'Common'],
            ['var',  'Inline', 'Inline', 'Common'],
            ['sub',  'Inline', 'Inline', 'Common'],
            ['sup',  'Inline', 'Inline', 'Common'],
            ['mark', 'Inline', 'Inline', 'Common'],
            ['wbr',  'Inline', 'Empty', 'Core'],

            // http://developers.whatwg.org/edits.html
            ['ins', 'Block', 'Flow', 'Common', ['cite' => 'URI', 'datetime' => 'CDATA']],
            ['del', 'Block', 'Flow', 'Common', ['cite' => 'URI', 'datetime' => 'CDATA']],
        ],
        'attributes' => [
            ['iframe', 'allowfullscreen', 'Bool'],
            ['table', 'height', 'Text'],
            ['td', 'border', 'Text'],
            ['th', 'border', 'Text'],
            ['tr', 'width', 'Text'],
            ['tr', 'height', 'Text'],
            ['tr', 'border', 'Text'],
        ],
    ],
    'custom_attributes' => [
        ['a', 'target', 'Enum#_blank,_self,_target,_top'],
    ],
    'custom_elements' => [
        ['u', 'Inline', 'Inline', 'Common'],
    ],
],

];

Any help is appreciated.


Solution

  • Turns out that the issue was the that URI.AllowedSchemes was being placed in the wrong section.

        return [
        'encoding'      => 'UTF-8',
        'finalize'      => true,
        'cachePath'     => storage_path('app/purifier'),
        'cacheFileMode' => 0755,
        'settings'      => [
            'default' => [
                'HTML.Doctype'             => 'HTML 4.01 Transitional',
                'HTML.Allowed'             => 'div,b,strong,i,em,u,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src],table[border|width|style],tbody,tr,td,th,blockquote',
                'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align',
                'AutoFormat.AutoParagraph' => true,
                'AutoFormat.RemoveEmpty'   => true,
                'URI.AllowedSchemes' => [
                    'data' => true
                ],
            ],
            'test'    => [
                'Attr.EnableID' => 'true',
            ],
            "youtube" => [
                "HTML.SafeIframe"      => 'true',
                "URI.SafeIframeRegexp" => "%^(http://|https://|//)(www.youtube.com/embed/|player.vimeo.com/video/)%",
            ],
            'custom_definition' => [
                'id'  => 'html5-definitions',
                'rev' => 1,
                'debug' => false,
                'elements' => [
                    // http://developers.whatwg.org/sections.html
                    ['section', 'Block', 'Flow', 'Common'],
                    ['nav',     'Block', 'Flow', 'Common'],
                    ['article', 'Block', 'Flow', 'Common'],
                    ['aside',   'Block', 'Flow', 'Common'],
                    ['header',  'Block', 'Flow', 'Common'],
                    ['footer',  'Block', 'Flow', 'Common'],
    
                    // Content model actually excludes several tags, not modelled here
                    ['address', 'Block', 'Flow', 'Common'],
                    ['hgroup', 'Block', 'Required: h1 | h2 | h3 | h4 | h5 | h6', 'Common'],
    
                    // http://developers.whatwg.org/grouping-content.html
                    ['figure', 'Block', 'Optional: (figcaption, Flow) | (Flow, figcaption) | Flow', 'Common'],
                    ['figcaption', 'Inline', 'Flow', 'Common'],
    
                    // http://developers.whatwg.org/the-video-element.html#the-video-element
                    ['video', 'Block', 'Optional: (source, Flow) | (Flow, source) | Flow', 'Common', [
                        'src' => 'URI',
                        'type' => 'Text',
                        'width' => 'Length',
                        'height' => 'Length',
                        'poster' => 'URI',
                        'preload' => 'Enum#auto,metadata,none',
                        'controls' => 'Bool',
                    ]],
                    ['source', 'Block', 'Flow', 'Common', [
                        'src' => 'URI',
                        'type' => 'Text',
                    ]],
    
                    // http://developers.whatwg.org/text-level-semantics.html
                    ['s',    'Inline', 'Inline', 'Common'],
                    ['var',  'Inline', 'Inline', 'Common'],
                    ['sub',  'Inline', 'Inline', 'Common'],
                    ['sup',  'Inline', 'Inline', 'Common'],
                    ['mark', 'Inline', 'Inline', 'Common'],
                    ['wbr',  'Inline', 'Empty', 'Core'],
    
                    // http://developers.whatwg.org/edits.html
                    ['ins', 'Block', 'Flow', 'Common', ['cite' => 'URI', 'datetime' => 'CDATA']],
                    ['del', 'Block', 'Flow', 'Common', ['cite' => 'URI', 'datetime' => 'CDATA']],
                ],
                'attributes' => [
                    ['iframe', 'allowfullscreen', 'Bool'],
                    ['table', 'height', 'Text'],
                    ['td', 'border', 'Text'],
                    ['th', 'border', 'Text'],
                    ['tr', 'width', 'Text'],
                    ['tr', 'height', 'Text'],
                    ['tr', 'border', 'Text'],
                ],
            ],
            'custom_attributes' => [
                ['a', 'target', 'Enum#_blank,_self,_target,_top'],
            ],
            'custom_elements' => [
                ['u', 'Inline', 'Inline', 'Common'],
            ],
        ],
    ]