Skip to content

Fixes 2814, 2815 #2816

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Fixes 2814, 2815 #2816

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2c7cbcf
Fixes #2814
simondate Feb 12, 2025
d4c5480
Fixes #2815
simondate Feb 12, 2025
a8e607a
Allows attributes, classes and styles
simondate Feb 12, 2025
1deb05e
Changed allowEmpty to be imported via config
simondate Feb 17, 2025
0b54fbe
Added attributes for <a> tags
simondate Feb 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions frontend/src/modules/scaffold/backboneFormsOverrides.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@ define([
htmlSupport: {
// Convert all allow/disallow strings to regexp, as config is json only
allow: convertStringsToRegExDeep((Origin.constants.ckEditorHtmlSupport && Origin.constants.ckEditorHtmlSupport.allow) || []),
allowEmpty: ['span', 'i'],
disallow: convertStringsToRegExDeep((Origin.constants.ckEditorHtmlSupport && Origin.constants.ckEditorHtmlSupport.disallow) || [])
},
on: {
Expand Down
5 changes: 4 additions & 1 deletion lib/configuration.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,10 @@ function Configuration() {
maxLoginAttempts: 3,
ckEditorHtmlSupport: {
allow: [{
name: "^(blockquote|ul|ol|span)$"
name: "^(blockquote|ul|ol|span)$",
"attributes": true,
Copy link
Member

@oliverfoster oliverfoster Mar 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't this allow onclick attributes on all of the aforementioned tags? Which means that one AAT user could add JavaScript that another user could execute?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was added to allow aria-hidden, if we think the above is a risk then we can add specific attributes. I believe like this:

attributes: { foo: 'true', bar: true }

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It definitely is a risk if it allows all attributes.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@simondate , so allow, aria-hidden, aria-label?

Copy link
Member Author

@simondate simondate Mar 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would want data-glossaryterm included as it's the way you open glossary items within elements on the page.

If onclick is the only thing we're concerned about could we just disable that?

Copy link
Member

@oliverfoster oliverfoster Mar 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wouldn't go with disabling things. Something new is always added that makes denies redundant. Permissive allows are generally a better idea (as per the French vs British legal system).

How about we don't set the default config to allow/deny extra things that are specific to a vendor, but we instead just add allowEmpty and RemoveFormat to support the given use-case?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

allowEmpty would fix the original issue, but I feel the glossary extension should be supported, considering it's a Core extension

Copy link
Member

@oliverfoster oliverfoster Mar 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this work?

      {
        "name": ".*",
        "attributes": "^(id|role|aria-.+|data-.+)$",
        "classes": true,
        "styles": true
      },

In theory that should allow all aria- and data- prefixed attributes as well as role and id.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bump

"classes": true,
"styles": true
},{
name: ".*",
classes: true,
Expand Down
2 changes: 2 additions & 0 deletions routes/index/index.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,7 @@
List,
ListProperties,
Paragraph,
RemoveFormat,
SelectAll,
ShowBlocks,
SourceEditing,
Expand Down Expand Up @@ -126,6 +127,7 @@
List,
ListProperties,
Paragraph,
RemoveFormat,
SelectAll,
ShowBlocks,
SourceEditing,
Expand Down