diff --git a/vendor/magento/framework/Validator/HTML/ConfigurableWYSIWYGValidator.php b/vendor/magento/framework/Validator/HTML/ConfigurableWYSIWYGValidator.php --- a/vendor/magento/framework/Validator/HTML/ConfigurableWYSIWYGValidator.php +++ b/vendor/magento/framework/Validator/HTML/ConfigurableWYSIWYGValidator.php (date 1739434891204) @@ -15,19 +15,6 @@ */ class ConfigurableWYSIWYGValidator implements WYSIWYGValidatorInterface { - /** - * @var string - */ - private static string $xssFiltrationPattern = - '/((javascript(\\\\x3a|:|%3A))|(data(\\\\x3a|:|%3A))|(vbscript:)|(script)|(alert\())|' - . '((\\\\x6A\\\\x61\\\\x76\\\\x61\\\\x73\\\\x63\\\\x72\\\\x69\\\\x70\\\\x74(\\\\x3a|:|%3A))|' - . '(\\\\x64\\\\x61\\\\x74\\\\x61(\\\\x3a|:|%3A)))/i'; - - /** - * @var string - */ - private static string $contentFiltrationPattern = "/(validateConfigured($xpath); $this->callAttributeValidators($xpath); $this->callTagValidators($xpath); - $this->validateAttributeValue($xpath); } /** @@ -110,8 +96,6 @@ private function validateConfigured(\DOMXPath $xpath): void { //Validating tags - $this->allowedTags['body'] = 'body'; - $this->allowedTags['html'] = 'html'; $found = $xpath->query( '//*[' . implode( @@ -120,7 +104,7 @@ function (string $tag): string { return "name() != '$tag'"; }, - $this->allowedTags + array_merge($this->allowedTags, ['body' => 'body', 'html' => 'html']) ) ) .']' @@ -250,9 +234,7 @@ $loaded = false; } ); - $matches = []; - preg_match_all(self::$contentFiltrationPattern, $content, $matches); - $loaded = !(count($matches[0]) > 1) && $dom->loadHTML($content, LIBXML_HTML_NOIMPLIED); + $loaded = $dom->loadHTML("$content"); restore_error_handler(); if (!$loaded) { throw new ValidationException(__('Invalid HTML content provided')); @@ -260,23 +242,4 @@ return $dom; } - - /** - * Validate values of html attributes - * - * @param \DOMXPath $xpath - * @return void - * @throws ValidationException - */ - private function validateAttributeValue(\DOMXPath $xpath): void - { - $nodes = $xpath->query('//@*'); - foreach ($nodes as $node) { - if (preg_match(self::$xssFiltrationPattern, $node->parentNode->getAttribute($node->nodeName))) { - throw new ValidationException( - __('Invalid value provided for attribute %1', $node->nodeName) - ); - } - } - } }