MC-34385: Filter fields allowing HTML

Author: ogorkun

app/code/Magento/Cms/Model/Page.php

@@ -13,6 +13,8 @@
 use Magento\Framework\DataObject\IdentityInterface;
 use Magento\Framework\Exception\LocalizedException;
 use Magento\Framework\Model\AbstractModel;
+use Magento\Framework\Validation\ValidationException;
+use Magento\Framework\Validator\HTML\WYSIWYGValidatorInterface;
 
 /**
  * Cms Page Model
@@ -64,25 +66,34 @@ class Page extends AbstractModel implements PageInterface, IdentityInterface
      */
     private $customLayoutRepository;
 
+    /**
+     * @var WYSIWYGValidatorInterface
+     */
+    private $wysiwygValidator;
+
     /**
      * @param \Magento\Framework\Model\Context $context
      * @param \Magento\Framework\Registry $registry
      * @param \Magento\Framework\Model\ResourceModel\AbstractResource|null $resource
      * @param \Magento\Framework\Data\Collection\AbstractDb|null $resourceCollection
      * @param array $data
      * @param CustomLayoutRepository|null $customLayoutRepository
+     * @param WYSIWYGValidatorInterface|null $wysiwygValidator
      */
     public function __construct(
         \Magento\Framework\Model\Context $context,
         \Magento\Framework\Registry $registry,
         \Magento\Framework\Model\ResourceModel\AbstractResource $resource = null,
         \Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null,
         array $data = [],
-        ?CustomLayoutRepository $customLayoutRepository = null
+        ?CustomLayoutRepository $customLayoutRepository = null,
+        ?WYSIWYGValidatorInterface $wysiwygValidator = null
     ) {
         parent::__construct($context, $registry, $resource, $resourceCollection, $data);
         $this->customLayoutRepository = $customLayoutRepository
             ?? ObjectManager::getInstance()->get(CustomLayoutRepository::class);
+        $this->wysiwygValidator = $wysiwygValidator
+            ?? ObjectManager::getInstance()->get(WYSIWYGValidatorInterface::class);
     }
 
     /**
@@ -615,6 +626,26 @@ public function beforeSave()
         $this->setData('layout_update_selected', $layoutUpdate);
         $this->customLayoutRepository->validateLayoutSelectedFor($this);
 
+        //Validating Content HTML.
+        $oldValue = null;
+        if ($this->getId()) {
+            if ($this->getOrigData()) {
+                $oldValue = $this->getOrigData(self::CONTENT);
+            } elseif (array_key_exists(self::CONTENT, $this->getStoredData())) {
+                $oldValue = $this->getStoredData()[self::CONTENT];
+            }
+        }
+        if ($this->getContent() && $this->getContent() !== $oldValue) {
+            try {
+                $this->wysiwygValidator->validate($this->getContent());
+            } catch (ValidationException $exception) {
+                throw new ValidationException(
+                    __('Content HTML contains restricted elements. %1', $exception->getMessage()),
+                    $exception
+                );
+            }
+        }
+
         return parent::beforeSave();
     }
 

app/code/Magento/Cms/Model/PageRepository/Validator/ContentValidator.php

@@ -233,8 +233,8 @@
             <argument name="repository" xsi:type="object">Magento\Cms\Model\PageRepository</argument>
             <argument name="validators" xsi:type="array">
                 <item name="layout_update" xsi:type="object">Magento\Cms\Model\PageRepository\Validator\LayoutUpdateValidator</item>
-                <item name="content" xsi:type="object">Magento\Cms\Model\PageRepository\Validator\ContentValidator</item>
             </argument>
+            <argument name="hydrator" xsi:type="object">Magento\Framework\EntityManager\AbstractModelHydrator</argument>
         </arguments>
     </type>
     <preference for="Magento\Cms\Model\Page\CustomLayoutManagerInterface" type="Magento\Cms\Model\Page\CustomLayout\CustomLayoutManager" />
@@ -257,9 +257,4 @@
             </argument>
         </arguments>
     </type>
-    <type name="Magento\Cms\Model\PageRepository\Validator\ContentValidator">
-        <arguments>
-            <argument name="hydrator" xsi:type="object">Magento\Framework\EntityManager\AbstractModelHydrator</argument>
-        </arguments>
-    </type>
 </config>