Skip to content

Fixes 2814, 2815 #2816

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
simondate wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Fixes 2814, 2815 #2816

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2c7cbcf
Fixes #2814
simondate Feb 12, 2025
d4c5480
Fixes #2815
simondate Feb 12, 2025
a8e607a
Allows attributes, classes and styles
simondate Feb 12, 2025
1deb05e
Changed allowEmpty to be imported via config
simondate Feb 17, 2025
0b54fbe
Added attributes for <a> tags
simondate Feb 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions frontend/src/modules/scaffold/backboneFormsOverrides.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@ define([
htmlSupport: {
// Convert all allow/disallow strings to regexp, as config is json only
allow: convertStringsToRegExDeep((Origin.constants.ckEditorHtmlSupport && Origin.constants.ckEditorHtmlSupport.allow) || []),
allowEmpty: ['span', 'i'],
disallow: convertStringsToRegExDeep((Origin.constants.ckEditorHtmlSupport && Origin.constants.ckEditorHtmlSupport.disallow) || [])
},
on: {
Expand Down
5 changes: 4 additions & 1 deletion lib/configuration.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,10 @@ function Configuration() {
maxLoginAttempts: 3,
ckEditorHtmlSupport: {
allow: [{
name: "^(blockquote|ul|ol|span)$"
name: "^(blockquote|ul|ol|span)$",
"attributes": true,
Copy link
Member

@oliverfoster oliverfoster Mar 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't this allow onclick attributes on all of the aforementioned tags? Which means that one AAT user could add JavaScript that another user could execute?

Copy link

@StuartNicholls StuartNicholls Mar 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was added to allow aria-hidden, if we think the above is a risk then we can add specific attributes. I believe like this:

attributes: { foo: 'true', bar: true }

Copy link
Member

@oliverfoster oliverfoster Mar 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It definitely is a risk if it allows all attributes.

Copy link

@StuartNicholls StuartNicholls Mar 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@simondate , so allow, aria-hidden, aria-label?

Copy link
Member Author

@simondate simondate Mar 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would want data-glossaryterm included as it's the way you open glossary items within elements on the page.

If onclick is the only thing we're concerned about could we just disable that?

Copy link
Member

@oliverfoster oliverfoster Mar 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this work?

      {
        "name": ".*",
        "attributes": "^(id|role|aria-.+|data-.+|target|href)$",
        "classes": true,
        "styles": true
      },

In theory that should allow all aria- and data- prefixed attributes as well as role and id.

Copy link
Member

@oliverfoster oliverfoster Apr 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bump

Copy link
Member Author

@simondate simondate Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've been using this PR for months with my own clients, no issue.

I just thought that we weren't doing any more merges to the "Legacy" AAT anymore?

Copy link
Member

@oliverfoster oliverfoster Nov 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's been waiting for you to respond to the above question. It has security implications.

Copy link
Member Author

@simondate simondate Nov 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might also need target so that links can open in a new tab/window.

@StuartNicholls / @fosterc1 can you think of anything else you would want?

"classes": true,
"styles": true
},{
name: ".*",
classes: true,
Expand Down
2 changes: 2 additions & 0 deletions routes/index/index.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,7 @@
List,
ListProperties,
Paragraph,
RemoveFormat,
SelectAll,
ShowBlocks,
SourceEditing,
Expand Down Expand Up @@ -126,6 +127,7 @@
List,
ListProperties,
Paragraph,
RemoveFormat,
SelectAll,
ShowBlocks,
SourceEditing,
Expand Down