{"id":20648513,"url":"https://github.com/lincanbin/white-html-filter","last_synced_at":"2025-04-16T14:54:46.661Z","repository":{"id":57015164,"uuid":"93810051","full_name":"lincanbin/White-HTML-Filter","owner":"lincanbin","description":"A lightweight php-based HTML tag and attribute whitelist filter. ","archived":false,"fork":false,"pushed_at":"2020-09-05T23:09:30.000Z","size":36,"stargazers_count":12,"open_issues_count":1,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-13T19:24:56.406Z","etag":null,"topics":["filter","html","php","whitelist","xss"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lincanbin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-06-09T02:20:07.000Z","updated_at":"2024-04-28T01:23:15.000Z","dependencies_parsed_at":"2022-08-22T09:31:39.585Z","dependency_job_id":null,"html_url":"https://github.com/lincanbin/White-HTML-Filter","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lincanbin%2FWhite-HTML-Filter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lincanbin%2FWhite-HTML-Filter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lincanbin%2FWhite-HTML-Filter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lincanbin%2FWhite-HTML-Filter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lincanbin","download_url":"https://codeload.github.com/lincanbin/White-HTML-Filter/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249252598,"owners_count":21238223,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["filter","html","php","whitelist","xss"],"created_at":"2024-11-16T17:09:09.679Z","updated_at":"2025-04-16T14:54:46.631Z","avatar_url":"https://github.com/lincanbin.png","language":"PHP","funding_links":["https://www.paypal.me/lincanbin"],"categories":[],"sub_categories":[],"readme":"# White HTML Filter      [![Build Status](https://travis-ci.org/lincanbin/White-HTML-Filter.svg?branch=master)](https://travis-ci.org/lincanbin/White-HTML-Filter)\n\nA php-based HTML tag and attribute whitelist filter. \n\nXSS filtering based on regular or textual replacement is not safe. This filter uses the DOMDocument based on `The Tokenization Algorithm`, which is more secure.\n\n## Requirements\n\n* PHP version 5.3.0 or higher.\n\n## Installation\n\nInstall this package via [Composer](https://getcomposer.org/).\n\n```\ncomposer require lincanbin/white-html-filter\n```\n\nOr edit your project's `composer.json` to require `lincanbin/white-html-filter` and then run `composer update`.\n\n```json\n\"require\": {\n    \"lincanbin/white-html-filter\": \"~1.3\"\n}\n```\n\n## Usage\n\n### Basic Usage\n\n\u003e **Note:** You should have composer's autoloader included `require 'vendor/autoload.php'` (that's obvious.)\n\nInstantiate WhiteHTMLFilter object\n\n```php\nuse lincanbin\\WhiteHTMLFilter;\n\n$html = \u003c\u003c\u003chtml\n\u003ciframe\u003e\u003c/iframe\u003e\n\u003cdiv class=\"contain\"\u003e\n\t\u003cspan style=\"color: #f00;\"\u003e\n\t\ttest中文\n\t\u003c/span\u003e\n\u003c/div\u003e\n\u003cdiv class=\"contain\" data-src=\"xxx\" onclick=\"javascript:alert('xxx');\"\u003e\n\t\u003caudio controls = \"play\"\u003e\n\t  \u003csource src=\"horse.ogg\" type=\"audio/ogg\"\u003e\n\t  \u003csource src=\"horse.mp3\" type=\"audio/mpeg\"\u003e\n\t  Your browser does not support the audio element.\n\t\u003c/audio\u003e\n\u003c/div\u003e\n\u003cdiv class=\"contain\"\u003e\n\t\u003cspan style=\"color: #f00;\" class=\"aabc\"\u003etest\u003c/span\u003e\n\u003c/div\u003e\n\u003cIMG SRC=javascript:alert('XSS')\u003e\nhtml;\n\n$filter = new WhiteHTMLFilter();\n$filter-\u003eloadHTML($html);\n$filter-\u003eclean();\nvar_dump($filter-\u003eoutputHtml());\n```\n\n### Configuration\n* Remove allowed tags\n```php\nuse lincanbin\\WhiteHTMLFilter;\n$filter = new WhiteHTMLFilter();\n$filter-\u003econfig-\u003eremoveAllAllowTag();\n//Or\n$filter-\u003econfig-\u003eremoveFromTagWhiteList('div');\n$filter-\u003econfig-\u003eremoveFromTagWhiteList(array(\"div\", \"table\"));\n```\n\n* Add new allowed tags \n```php\nuse lincanbin\\WhiteHTMLFilter;\n$filter = new WhiteHTMLFilter();\n$filter-\u003econfig-\u003eremoveAllAllowTag();\n$filter-\u003econfig-\u003emodifyTagWhiteList(array(\n    \"img\" =\u003e array(\"alt\", \"src\", \"height\", \"width\"),\n    \"a\" =\u003e array(\"href\", \"rel\", \"target\", \"download\", \"type\")\n));\n```\n\n* Modify allowed HTML global attributes\n```php\nuse lincanbin\\WhiteHTMLFilter;\n$filter = new WhiteHTMLFilter();\n$filter-\u003econfig-\u003eWhiteListHtmlGlobalAttributes = array(\n    \"class\", \"style\", \"title\", \"data-*\"\n);\n```\n\n* Modify allowed css style (Leave blank to allow everything)\n```php\nuse lincanbin\\WhiteHTMLFilter;\n$filter = new WhiteHTMLFilter();\n$filter-\u003econfig-\u003eWhiteListStyle = array(\n    \"color\", \"border\", \"background\", \"position\"\n);\n```\n\n* Modify allowed css class (Leave blank to allow everything)\n```php\nuse lincanbin\\WhiteHTMLFilter;\n$filter = new WhiteHTMLFilter();\n$filter-\u003econfig-\u003eWhiteListCssClass = array(\n    \"container\", \"title\", \"sub-title\", \"sider-bar\"\n);\n```\n\n### Use Custom Attribute Value Filter\n```php\nuse lincanbin\\WhiteHTMLFilter;\n\n$html = \u003c\u003c\u003chtml\n\u003ciframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/lBOwxXxesBo\" frameborder=\"0\" allowfullscreen\u003e\n\u003c/iframe\u003e\n\u003ciframe width=\"560\" height=\"315\" src=\"https://www.94cb.com/\" frameborder=\"0\" allowfullscreen\u003e\u003c/iframe\u003e\nhtml;\n$filter = new WhiteHTMLFilter();\n$urlFilter = function($url) {\n    $regex = '~\n  ^(?:https?://)?                           # Optional protocol\n   (?:www[.])?                              # Optional sub-domain\n   (?:youtube[.]com/embed/|youtu[.]be/) # Mandatory domain name (w/ query string in .com)\n   ([^\u0026]{11})                               # Video id of 11 characters as capture group 1\n    ~x';\n    return (preg_match($regex, $url) === 1) ? $url : '';\n};\n\n$iframeRule = array(\n    'iframe' =\u003e array(\n        'src' =\u003e $urlFilter,\n        'width',\n        'height',\n        'frameborder',\n        'allowfullscreen'\n    )\n);\n\n$filter-\u003eloadHTML($html);\n$filter-\u003eclean();\nvar_dump($filter-\u003eoutputHtml());\n```\nResult:\n```html\n\u003ciframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/lBOwxXxesBo\" frameborder=\"0\" allowfullscreen=\"\"\u003e\u003c/iframe\u003e\n\u003ciframe width=\"560\" height=\"315\" src=\"\" frameborder=\"0\" allowfullscreen=\"\"\u003e\u003c/iframe\u003e\n\n```\n\n### Default Filter Configuration\n* [See here](https://github.com/lincanbin/White-HTML-Filter/blob/master/src/WhiteHTMLFilterConfig.php)\n\n## Donate for White HTML Filter\n\n* Alipay: \n\n![Alipay](https://www.94cb.com/upload/donate_small.png)\n\n* Wechat: \n\n![Wechat](https://www.94cb.com/upload/donate_weixin_small.png)\n\n* Paypal: \n\n  https://www.paypal.me/lincanbin\n  \n  \n## License\n\n``` \nCopyright 2017 Canbin Lin (lincanbin@hotmail.com)\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n   http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flincanbin%2Fwhite-html-filter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flincanbin%2Fwhite-html-filter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flincanbin%2Fwhite-html-filter/lists"}