Download the PHP package typo3/html-sanitizer without Composer
On this page you can find all versions of the php package typo3/html-sanitizer. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download typo3/html-sanitizer
More information about typo3/html-sanitizer
Files in typo3/html-sanitizer
Package html-sanitizer
Short Description HTML sanitizer aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values.
License MIT
Informations about the package html-sanitizer
TYPO3 HTML Sanitizer
:information_source: Common safe HTML tags & attributes as given in
\TYPO3\HtmlSanitizer\Builder\CommonBuilder
still might be adjusted, extended or rearranged to more specific builders.
In a Nutshell
This typo3/html-sanitizer
package aims to be a standalone component that can be used by any PHP-based
project or library. Albeit it is released within the TYPO3 namespace, it is agnostic to specifics of
TYPO3 CMS.
\TYPO3\HtmlSanitizer\Behavior
contains declarative settings for a particular process for sanitizing HTML.\TYPO3\HtmlSanitizer\Visitor\VisitorInterface
(multiple different visitors can exist at the same time) are actually doing the work based on the declaredBehavior
. Visitors can modify nodes or mark them for deletion.\TYPO3\HtmlSanitizer\Sanitizer
can be considered as the working instance, invoking visitors, parsing and serializing HTML. In general this instance does not contain much logic on how to handle particular nodes, attributes or values\TYPO3\HtmlSanitizer\Builder\BuilderInterface
can be used to create multiple different builder instances - in terms of "presets" - which combine declaring a particularBehavior
, initialization ofVisitorInterface
instances, and finally returning a ready-to-useSanitizer
instance
Installation
Example & API
will result in the following sanitized output
:information_source: Changes
- since
v2.1.0
newly introduced nodesBehavior\Comment
andBehavior\CdataSection
are enabled per default for backward compatibility reasons, use e.g.$behavior->withoutNodes(new Behavior\Comment())
to remove them (later versions of this package won't have this fallback anymore) - since
v2.1.0
it is suggested to provide a\TYPO3\HtmlSanitizer\Behavior
when creating a new instance of\TYPO3\HtmlSanitizer\Sanitizer
, e.g.new Sanitizer($behavior, ...$visitors)
Find more details on all changes in UPGRADING.md.
Behavior
flags
Behavior::ENCODE_INVALID_TAG
keeps invalid tags, but "disarms" them (see<span>
in example)Behavior::ENCODE_INVALID_ATTR
keeps invalid attributes, but "disarms" the whole(!) tagBehavior::ENCODE_INVALID_COMMENT
"disarms" unexpected HTML comments by completely encoding themBehavior::ENCODE_INVALID_CDATA_SECTION
"disarms" unexpected HTML CDATA sections by completely encoding themBehavior::REMOVE_UNEXPECTED_CHILDREN
removes children forTag
entities that were created without explicitly usingTag::ALLOW_CHILDREN
, but actually contained child nodesBehavior::ALLOW_CUSTOM_ELEMENTS
allow using custom elements (having a hyphen-
) - however, it is suggested to explicitly name all known and allowed tags and avoid using this flag
License
In general the TYPO3 core is released under the GNU General Public License version
2 or any later version (GPL-2.0-or-later
). In order to avoid licensing issues and
incompatibilities this package is licenced under the MIT License. In case you
duplicate or modify source code, credits are not required but really appreciated.
Local Testing
Composer project oliverhader/html-sanitizer-demo offers a local development server to ease manual testing for potentially vulnerable XSS payloads.
Security Contact
In case of finding additional security issues in the TYPO3 project or in this package in particular, please get in touch with the TYPO3 Security Team, or directly report a vulnerability via GitHub.
All versions of html-sanitizer with dependencies
masterminds/html5 Version ^2.7.6
php Version ^7.2 || ^8.0
psr/log Version ^1.0 || ^2.0 || ^3.0