@@ -370,7 +370,7 @@ attributes from the `W3C Standard Proposal`_ are allowed.
370
370
->allowElement('img', 'src')
371
371
372
372
// allow the <h1 > element with all safe attributes
373
- ->allowElement('h1')
373
+ ->allowElement('h1', '*' )
374
374
;
375
375
};
376
376
@@ -611,14 +611,13 @@ This option allows you to disallow attributes that were allowed before.
611
611
$framework->htmlSanitizer()
612
612
->sanitizer('app.post_sanitizer')
613
613
// allow the "data-attr" on all safe elements...
614
- ->allowAttribute('data-attr')
615
- ->element('*')
614
+ ->allowAttribute('data-attr', '*')
616
615
617
616
// ...except for the <section > element
618
617
->dropAttribute('data-attr', ['section'])
619
618
620
619
// disallows "style' on any allowed element
621
- ->dropAttribute('style')
620
+ ->dropAttribute('style', '*' )
622
621
;
623
622
};
624
623
@@ -630,13 +629,13 @@ This option allows you to disallow attributes that were allowed before.
630
629
$postSanitizer = new HtmlSanitizer(
631
630
(new HtmlSanitizerConfig())
632
631
// allow the "data-attr" on all safe elements...
633
- ->allowAttribute('data-attr')
632
+ ->allowAttribute('data-attr', '*' )
634
633
635
634
// ...except for the <section> element
636
635
->dropAttribute('data-attr', ['section'])
637
636
638
637
// disallows "style' on any allowed element
639
- ->dropAttribute('style')
638
+ ->dropAttribute('style', '*' )
640
639
);
641
640
642
641
Force Attribute Values
@@ -688,7 +687,7 @@ element (even if the original one didn't contain a ``rel`` attribute):
688
687
return static function (FrameworkConfig $framework): void {
689
688
$framework->htmlSanitizer()
690
689
->sanitizer('app.post_sanitizer')
691
- ->forceAttribute('a', 'rel', 'noopener noreferrer')
690
+ ->forceAttribute('a', [ 'rel' => 'noopener noreferrer'] )
692
691
;
693
692
};
694
693
@@ -793,7 +792,7 @@ URLs of ``<a>`` elements:
793
792
// specifies the allowed hosts, the attribute will be dropped if the
794
793
// URL contains a different host. Subdomains are allowed: e.g. the following
795
794
// config would also allow 'www.symfony.com', 'live.symfony.com', etc.
796
- ->allowedLinkHost( 'symfony.com')
795
+ ->allowedLinkHosts([ 'symfony.com'] )
797
796
798
797
// whether to allow relative links (i.e. URLs without scheme and host)
799
798
->allowRelativeLinks(true)
@@ -912,7 +911,7 @@ the HTML sanitizer: ``src``, ``href``, ``lowsrc``, ``background`` and ``ping``.
912
911
913
912
// specifies the allowed hosts, the attribute will be dropped if the URL
914
913
// contains a different host which is not a subdomain of the allowed host
915
- ->allowedMediaHost( 'symfony.com') // Also allows any subdomain (i.e. www.symfony.com)
914
+ ->allowedMediaHosts([ 'symfony.com'] ) // Also allows any subdomain (i.e. www.symfony.com)
916
915
917
916
// whether to allow relative URLs (i.e. URLs without scheme and host)
918
917
->allowRelativeMedias(true)
0 commit comments