HtmlPurifier - keeps removing my tables - what is the right config? - config

Question

I have a table that keeps beeing removed by html purifier
the content is an email that needs to be populated
<table>
<thead>
<th>fieldA</th>
<th>fieldB</th>
<th>fieldC</th>
<th>fieldD</th>
</thead>
<tbody>
<!--[[[order_list]]]-->
</tbody>
</table>
where < ! - - [[[order_list]]] - - > is replaced at runtime, but htmlpurifier keeps removing my table (the comments are there for ckeditor, otherwise it gets removed)
I tried to disable the AutoFormat.RemoveEmpty :
$config = \HTMLPurifier_Config::createDefault();
$config->set('AutoFormat.RemoveEmpty', false);
Validator::$purifier = new \HTMLPurifier($config);
$val=Validator::$purifier->purify($data);
it does not work at all, the table yet gets removed
how can I fix this ?
thanks
[edit: tried this so far...]
$config = \HTMLPurifier_Config::createDefault();
// $config->set('AutoFormat.RemoveEmpty', false);
// ----------------------------------------------- from stackoverflow
$def = $config->getHtmlDefinition(true);
$element = $def->addElement(
'tbody',
false,
'Flow', // <-- here is the change - we're not requiring 'tr' any more
'Common',
[
'align' => 'Enum#left,center,right,justify,char',
'charoff' => 'Length',
'valign' => 'Enum#top,middle,bottom,baseline',
]
);
$config->set('HTML.AllowedComments', array('[[[[order_list]]]'));
Validator::$purifier = new \HTMLPurifier($config);

Answer 1

The problem you're encountering is that tbody cannot be empty by the HTML standard ("Each row group must contain at least one row") (and much of HTML Purifier's security comes from strategically requiring the HTML to be standards-compliant), a comment does not count as content, and it's thus removed. That said, the "living" standard of HTML doesn't require this ("Zero or more tr ..."), so it should be safe to fiddle with.
In any case, you can see HTML Purifier's requirement in the file library/HTMLPurifier/HTMLModule/Tables.php:
$this->addElement('tbody', false, 'Required: tr', 'Common', $cell_align);
If you want to overwrite the way HTML Purifier treats tbody elements, check out the Customize documentation. Your solution would look a little like this (although this example does not cache the HTML definition, you may want to fiddle with yours until yours does):
require_once (__DIR__ . '/library/HTMLPurifier.auto.php');
$dirty_html = '<table>
<thead>
<th>fieldA</th>
<th>fieldB</th>
<th>fieldC</th>
<th>fieldD</th>
</thead>
<tbody>
<!--[[[order_list]]]-->
</tbody>
</table>';
$config = HTMLPurifier_Config::createDefault();
$def = $config->getHtmlDefinition(true);
$element = $def->addElement(
'tbody',
false,
'Flow', // <-- here is the change - we're not requiring 'tr' any more
'Common',
[
'align' => 'Enum#left,center,right,justify,char',
'charoff' => 'Length',
'valign' => 'Enum#top,middle,bottom,baseline',
]
);
$purifier = new HTMLPurifier($config);
$clean_html = $purifier->purify($dirty_html);
This spits out (though I removed the whitespace):
<table><thead></thead><tbody></tbody></table>
If the result still does not seem right to you because thead was emptied out, know that thead was emptied because you have "stray" th tags in it - they're not wrapped by tr. That is required to be standards-compliant even by the "living" standard (as it only permits tr children), but you could of course also change that behaviour by tweaking HTML Purifier if you want. That might have unintended consequences for browser rendering, though, be careful!
That said, this alone will still kill the <!-- [[[order_list]]] --> comment, since HTML Purifier by default disallows all comments for security reasons (there've historically been quite a few browser exploits busting out of HTML comments, although not so much in recent years).
To fix this, you can whitelist the specific comment you want to preserve like this:
...
$config = HTMLPurifier_Config::createDefault();
$config->set('HTML.AllowedComments', ['[[[order_list]]]']);
$def = $config->getHtmlDefinition(true);
...
This will spit out (though I again removed the whitespace):
<table><thead></thead><tbody><!--[[[order_list]]]--></tbody></table>