1 Topic by Bert

  • Bert
  • Member
  • Offline

Topic: Custom/non-standard attributes for elements?

Hi,

How can I allow custom attributes for elelments, I would like to allow the rel attribute for elements ul, li and input?

<ul rel="1">
    <li rel="a"><input rel="a" /></li>
    <li rel="b"><input rel="b" /></li>
    <li rel="c"><input rel="c" /></li>
    <ul rel="2">
        <li rel="a"><input rel="a" /></li>
        <li rel="b"><input rel="b" /></li>
        <li rel="c"><input rel="c" /></li>
    </ul>
</ul>

Thanks

2 Reply by patnaik (edited by patnaik 2012-07-22 00:04:59)

  • patnaik
  • Administrator
  • Offline

Re: Custom/non-standard attributes for elements?

Currently, htmLawed does not allow custom attributes for elements. It only allows the standard HTML attributes and a few non-standard attributes that are frequently used.

I have been thinking of adding support for custom attributes in htmLawed. Further below is a small modification that should allow for this.

In the function hl_tag() of htmLawed, content of opening tags is parsed to identify pairs of attribute names and values. Attribute names have to begin with an alphabet and can contain only alphabets, hyphens (-) and colons (:).  The name-value pairs are then scrutinized for adherence to standards and to the administrator's policies (around line 490 of the current htmLawed code). The logic is to check that an attribute (1) has not been denied (by admin.) through the 'deny_attribute' parameter of '$config', or, if so, is still allowed through '$spec', and (2) that it fits within the HTML standard rules.

The code modification, below, will let an attribute be allowed through '$spec' even if it does not fit the standard rules (like denial of 'rel' in 'input'). Such an attribute can be a standard HTML attribute (like 'rel') or a non-standard one (like, say, 'fb:like') as long as it fits the name criteria outlined above.

I have only partially tested this code. It should not introduce any vulnerability as long as you know the implications of the values allowed through '$spec'.

// modifying function hl_tag
// the content of ( ) of the  'if( )' clause at line 491 (htmLawed version 1.1.12) is changed

...
foreach($aA as $k=>$v){
 if(isset($rl[$k]) or ((isset($C['deny_attribute']['*']) ? isset($C['deny_attribute'][$k]) : !isset($C['deny_attribute'][$k])) && !isset($rl['n'][$k]) && !isset($rl['n']['*']) && (isset($aN[$k][$e]) or (isset($aNU[$k]) && !isset($aNU[$k][$e]))))){
  if(isset($aNE[$k])){$v = $k;}
  ...

Once this modified htmLawed is put to use, to allow the 'rel' attribute in 'input', 'li' and 'ul', you can define '$spec' as below.

$spec = 'input=rel; li=rel; ul=rel'; // bypass HTML standards; allow 'rel' in some elements
$config = ....
$out = htmLawed($in, $config, $spec);

3 Reply by Bert

  • Bert
  • Member
  • Offline

Re: Custom/non-standard attributes for elements?

Thanks patnaik just the job and thanks for the quick response.

Great work on the library, I tip my hat to you sir!

4 Reply by patnaik

  • patnaik
  • Administrator
  • Offline

Re: Custom/non-standard attributes for elements?

A new version of htmLawed, 1.1.13, with just one change for the feature discussed here, has been released.