Skip to content

[HTML Sanitizer] PHP-Config with fluent interface examples don't work #18024

Closed
@spackmat

Description

@spackmat

Hey, we just implemented the new HTML Sanitizer feature the first time and stumbled upon some not-working examples in the doctmentation:

https://symfony.com/doc/current/html_sanitizer.html#drop-attributes

The PHP-config examples state for some settings that a fluent interface is used, where the "Standalone Use" example show the actual variants with two parameters. For example the allowAttribute settings:

// that does not work:
// config/packages/framework.php
use Symfony\Config\FrameworkConfig;

return static function (FrameworkConfig $framework) {
    $framework->htmlSanitizer()
        ->sanitizer('app.post_sanitizer')
            // allow "src' on <iframe> elements
            ->allowAttribute('src')
                ->element('iframe')

            // allow "data-attr" on all elements currently allowed
            ->allowAttribute('data-attr')
                ->element('*')
    ;
};

// that does work, like it is shown in the "Standalone Use" example:
// config/packages/framework.php
use Symfony\Config\FrameworkConfig;

return static function (FrameworkConfig $framework) {
    $framework->htmlSanitizer()
        ->sanitizer('app.post_sanitizer')
            // allow "src' on <iframe> elements
            ->allowAttribute('src', ['iframe'})

            // allow "data-attr" on all elements currently allowed
            ->allowAttribute('data-attr', '*')
    ;
};

Maybe that fluent interface came from a previous state and was removed later.

Metadata

Metadata

Assignees

No one assigned

    Labels

    HtmlSanitizerhasPRA Pull Request has already been submitted for this issue.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions