Project

General

Profile

Actions

Bug #95158

closed

HtmlSanitizer accidentally enforced again due to sys_note changes

Added by Oliver Hader about 3 years ago. Updated about 3 years ago.

Status:
Closed
Priority:
Should have
Assignee:
Category:
Security
Target version:
Start date:
2021-09-10
Due date:
% Done:

100%

Estimated time:
(Total: 0.00 h)
TYPO3 Version:
11
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

Issue #67556 introduced default configuration to be able to render links (anchor tags) in sys_note representation in backend context. Side-note: Usually the backend context does not have any frontend TypoScript config in lib.parseFunc_RTE, that's why links defined in RTE were not substituted.

As a negative side-effect <f:format.html parseFuncTSPath="">{content}</f:format.html> now (again) enforces HtmlSanitizer, which is to the expected behavior.

Possible solution:
  • revert change https://review.typo3.org/c/Packages/TYPO3.CMS/+/70740 (was for v11.4.0 only)
  • introduce new feature(sic!) <f:transform.link> (or f:format.link, I don't care about the name here)
    • which transforms <a href="t3://whatever"> into proper <a href="https://my-site.com/url"> tags
    • which is independent from any frontend and TypoScript context
    • which can be used in backend as well
  • substitute corresponding backend templates to apply HTML sanitization and link transformation, WITHOUT invoking ContentObjectRenderer::parseFunc

(in backend, e.g. the apply following replacement manually)

<f:format.html parseFuncTSPath="">{content -> f:format.raw()}</f:format.html>

to

{content -> f:transform.link() -> f:sanitize.html(build: 'default')}
// it also would be possible to define a custom HtmlSanitizer builder for e.g. sys_news, or reports, or ...

Subtasks 2 (0 open2 closed)

Feature #95176: Introduce <f:transform.html> view-helperClosed2021-09-10

Actions
Bug #95179: Transform internal URIs in backend user interfaceClosed2021-09-10

Actions

Related issues 2 (0 open2 closed)

Related to TYPO3 Core - Bug #95169: Reports ExtensionComposerStatus missing link to EMClosed2021-09-09

Actions
Related to TYPO3 Core - Bug #67556: System news cannot render RTE contentClosed2015-06-17

Actions
Actions

Also available in: Atom PDF