typo3fluid-styled-content

How to use t3:// TypoLinks in TYPO3 HTML Content Elements without disabling `parseFunc.htmlSanitize` globally?


Since the release of the security patches in August 2021 that prevents Cross-Site Scripting via Rich-Text Content I noticed that the output of HTML Content Elements suddenly changed in our projects. Some tag attributes and tags got removed by the newly introduced HTML Sanitizer (when the template is modified so that t3:// style TypoLinks get rendered).

So simply overriding the default Html.html Fluid Template, changing the <f:format.raw> to <f:format.html> and adding a html decoding like in the following example is no longer sufficient.

<f:section name="Main">
    <f:comment> We use this to render links and other stuff in html elements </f:comment>
    <f:format.htmlentitiesDecode>
        <f:format.html parseFuncTSPath="lib.parseFunc">
            {data.bodytext}
        </f:format.html>
    </f:format.htmlentitiesDecode>
</f:section>

The easiest way to prevent changes in your html codes output provided by HTML Content Elements is to disable the sanitizer globally by adding lib.parseFunc.htmlSanitize = 0 to your TypoScript config, what is not ideal.

How can I disable the parseFunc.htmlSanitize only for this purpose?

Or is there an other solution to render TypoLinks within HTML Content Elements?

Note: You don't need to disable the HTML Sanitizer if you do not override the Html.html template!


Solution

  • Simply make a copy of lib.parseFunc and disable the sanitizer in this copy.

    lib.parseHtmlFunc < lib.parseFunc
    lib.parseHtmlFunc.htmlSanitize = 0
    

    Then use this lib in your Html.html template.

    <f:section name="Main">
        <f:comment> We use this to render links and other stuff in html elements </f:comment>
        <f:format.htmlentitiesDecode>
            <f:format.html parseFuncTSPath="lib.parseHtmlFunc">
                {data.bodytext}
            </f:format.html>
        </f:format.htmlentitiesDecode>
    </f:section>
    

    Thanks to @OliverHader for bringing me to the right track.