Merge pull request #4 from northernco/heading-sanitization

Allow id attributes and fragment URLs
northernco · Aug 1, 2020 · 8348583 · 8348583
2 parents e377e96 + 3da382d
commit 8348583
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/Service/MarkdownParser.php b/Service/MarkdownParser.php
@@ -16,10 +16,32 @@ public function __construct()
                 'max_input_length' => 1000000,
                 'extensions'       => ['basic', 'list', 'table', 'image', 'code', 'extra'],
                 'tags'             => [
+                    'a'    => [
+                        'allowed_schemes'    => ['http', 'https', null],
+                        'allowed_attributes' => ['href', 'name', 'title'],
+                    ],
                     'code' => ['allowed_attributes' => ['class']],
                     'em'   => ['allowed_attributes' => ['class']],
                     'th'   => ['allowed_attributes' => ['style']],
                     'td'   => ['allowed_attributes' => ['style']],
+                    'h1'   => [
+                        'allowed_attributes' => ['id', 'name'],
+                    ],
+                    'h2'   => [
+                        'allowed_attributes' => ['id', 'name'],
+                    ],
+                    'h3'   => [
+                        'allowed_attributes' => ['id', 'name'],
+                    ],
+                    'h4'   => [
+                        'allowed_attributes' => ['id', 'name'],
+                    ],
+                    'h5'   => [
+                        'allowed_attributes' => ['id', 'name'],
+                    ],
+                    'h6'   => [
+                        'allowed_attributes' => ['id', 'name'],
+                    ],
                 ],
             ]
         );