TYPO3 Core

Where is that <form action=""><input name="test" /></form> coming from? Did you allow to add HTML forms in CKEditor?!

From my point of view, given <form> example is markup that shall be used as is, thus, it should be <f:format.raw><form action=""><input name="test" /></form></f:format.raw> instead of <f:format.html>@.

Besides that, the very example you used, was encoded in previous versions (before TYPO3 v11.3.2, v10.4.19, v9.5.29), so even without having the HTML sanitizer in place

<f:format.html><form action=""><input name="test" /></form></f:format.html>

<form action=""><input name="test" /></form>

The html is not added by users.
We have some html code generated by a standalone fluid view that is rendered this way.
Using the format raw viewhelper is better in this situation and I will replace the viewhelper.

However the disable problem still seems to be there when changing the htmlSanitize value.

Robert van Kammen wrote in #note-7:

The html is not added by users.
We have some html code generated by a standalone fluid view that is rendered this way.
Using the format raw viewhelper is better in this situation and I will replace the viewhelper.

Yes, in case the block contains only generated markup (e.g. by Fluid template or view-helper), using <f:format.raw> is the better alternative - in that scenario not sanitization would happen.

However the disable problem still seems to be there when changing the htmlSanitize value.

I successfully tested the following again (f:format.html uses TypoScript path lib.parseFunc_RTE per default):

<f:format.html><b onmouseover="alert(1)">Just testing</b></f:format.html>
// + having TypoScript `lib.parseFunc_RTE.htmlSanitize = 0`
// ... as a result XSS `onmouseover` is not removed

However, there was one case with parseFuncTSPath="", when it was not possible to disable HTML sanitization:

<f:format.html parseFuncTSPath=""><b onmouseover="alert(1)">Just testing</b></f:format.html>
// in this case NO TypoScript path is used and thus, it cannot be disabled via TypoScript

... that's why a change in issue #94786 introduces a new `htmlSanitize` argument for that view-helper - it is still pending at the time of writing this comment.

<f:format.html parseFuncTSPath="" htmlSanitize="0"><b onmouseover="alert(1)">Just testing</b></f:format.html>
// ... as a result XSS `onmouseover` is not removed

Thanks for the information. With the introduction of this new viewhelper this issue is resolved.

Robert van Kammen wrote in #note-9:

Thanks for the information. With the introduction of this new viewhelper this issue is resolved.

Will this new ViewHelper be included in the upcoming 9.5.30/10.4.20 point release?

Apart from that, we have exactly the same problem. Disabling HTML sanitization globally in Typoscript just doesn't work at all, using <format.raw> doesn't help as well. We still have a couple of tags in our Fluid templates like <script>, <input> or <figure> that are rendered in HTML entities, making some pages unusable and we just don't get it to work with the suggestions given so far! Funny thing is, some templates seem to work, some don't, but we couldn't figure out so far the reason for this...

Couldn't you make the list of blocked tags/elements configurable via Typoscript, just like styles.content.allowTags? Unfortunately, that setting is ignored as well... :-/

(9.5.29 / 10.4.19 seems to me like the most frustrating / work-generating TYPO3 point release update in years, at least if you have to to with Frontend / Fluid templating!)