.. include:: /Includes.rst.txt
.. _important-94484:
============================================
Important: #94484 - Introduce HTML Sanitizer
============================================
See :issue:`94484`
Description
===========
To sanitize and purge XSS from markup during frontend rendering, new
custom HTML sanitizer has been introduced, based on `masterminds/html5`.
Both :php:`\TYPO3\HtmlSanitizer\Builder\CommonBuilder` and
:php:`\TYPO3\HtmlSanitizer\Visitor\CommonVisitor` provide common configuration
which is in line with expected tags that are allowed in backend RTE.
Using a custom builder instance, it is possible to adjust for individual
demands - however, configuration possibilities cannot be modified using
TypoScript - basically since the existing syntax does not cover all
necessary scenarios.
PHP API
=======
The API is considered "internal", however it might be necessary to provide
custom markup handling, add additional tags, attributes or values. The whole
process of sanitization is based on an "allow-list" - everything that is not
allowed, is automatically denied.
The following example is meant to give a brief overview of the behavior and
corresponding possibilities.
.. code-block:: php
withName('my-custom')
->withTags(
(new Behavior\Tag('my-element', Behavior\Tag::ALLOW_CHILDREN))
->addAttrs(
(new Behavior\Attr('href'))->addValues(
new Behavior\RegExpAttrValue('#^(?:https?://|mailto:)#')
),
...$this->globalAttrs
)
);
}
}
As a result a new tag :html:`my-element` is which is allowed to
* have any safe global attribute (`id`, `class`, `data-*`, ...)
* have attribute `href`, in case corresponding value either starting with `http://`,
`http://` or `mailto:` - evaluated from the given regular expression
TypoScript
==========
stdWrap.htmlSanitize
--------------------
New :typoscript:`stdWrap` property :typoscript:`htmlSanitize` has been introduced
to control sanitization of markup, removing tags, attributes or values that have
not been allowed explicitly.
* `htmlSanitize = [boolean]` whether to invoke sanitization (enabled per default).
* `htmlSanitize.build = [string]` defines which specific builder (must be an
instance of :php:`\TYPO3\HtmlSanitizer\Builder\BuilderInterface`)
to be used for building a :php:`\TYPO3\HtmlSanitizer\Sanitizer`
instance using a particular :php:`\TYPO3\HtmlSanitizer\Behavior`.
This can either be a fully qualified class name or the name of a preset as
defined in :php:`$GLOBALS['TYPO3_CONF_VARS']['SYS']['htmlSanitizer']` - per
default, :php:`\TYPO3\CMS\Core\Html\DefaultSanitizerBuilder` is used.
.. code-block:: typoscript
10 = TEXT
10 {
value = 