NPM Resource Changed ? ? Pending

User tests: Successful: Unsuccessful:

avatar dgrammatiko
dgrammatiko
14 Jun 2021

Pull Request for Issue # .

Summary of Changes

By default, the sanitiser will remove all the form elements. This PR changes this behaviour so form elements would not disappear (on* events will still be removed).
The list of attributes comes directly from the MDN: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input#attributes

Testing Instructions

Apply the PR
Goto admin dashboard and open the browser console
pass some HTML to the sanitiser and check the result:

Joomla.sanitizeHtml(`<input type="text" onchange="alert('nope')" >`);

Check more attributes and elements (button, select, textarea)

Actual result BEFORE applying this Pull Request

Too strict

Expected result AFTER applying this Pull Request

Less strict

Documentation Changes Required

avatar dgrammatiko dgrammatiko - open - 14 Jun 2021
avatar dgrammatiko dgrammatiko - change - 14 Jun 2021
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 14 Jun 2021
Category JavaScript Repository NPM Change
avatar dgrammatiko dgrammatiko - change - 14 Jun 2021
Labels Added: NPM Resource Changed ?
avatar RickR2H
RickR2H - comment - 23 Jun 2021

@dgrammatiko I applied the patch and added to the console: Joomla.sanitizeHtml(<input type="text" onchange="alert('nope')" >);
Got the following in return: "<input type="text">"

Is this correct?


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34518.

avatar dgrammatiko
dgrammatiko - comment - 25 Jun 2021

Is this correct?

Yes, the onchange="alert('nope')" is Javascript so correctly was removed by the sanitizer

avatar RickR2H RickR2H - test_item - 25 Jun 2021 - Tested successfully
avatar RickR2H
RickR2H - comment - 25 Jun 2021

I have tested this item successfully on 1fe402d


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34518.

avatar jwaisner jwaisner - test_item - 29 Jun 2021 - Tested successfully
avatar jwaisner
jwaisner - comment - 29 Jun 2021

I have tested this item successfully on 1fe402d


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34518.

avatar jwaisner jwaisner - change - 29 Jun 2021
Status Pending Ready to Commit
avatar jwaisner
jwaisner - comment - 29 Jun 2021

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34518.

avatar wilsonge wilsonge - change - 29 Jun 2021
Status Ready to Commit Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 2021-06-29 08:38:03
Closed_By wilsonge
Labels Added: ?
avatar wilsonge wilsonge - close - 29 Jun 2021
avatar wilsonge wilsonge - merge - 29 Jun 2021
avatar wilsonge
wilsonge - comment - 29 Jun 2021

Thanks!

Add a Comment

Login with GitHub to post a comment