Enable the restriction of attributes

[MrSpoocy]

Description

I would like to customize the extension https://commonmark.thephpleague.com/2.3/extensions/attributes/ so that you can limit the attributes of the user by configuration. Currently I give the user too much freedom once the extension is activated because e.g. I only want the user to be able to set values for bootstrap pull-left as class.

If restricted is true (default: false that there is no BC), then only the keys in the configuration are allowed. If false, then only the values of the specified keys are restricted.

Example

'attributes' => [
    'restricted' => true,
    'class' => ['multiple value', 'allowed'],
    'id' => 'allowed_value',
    'title' => function ($value) {
        if (strlen($value) > 10) {
            return true;
        } else {
            return false;
       }
    },
    // Allow the key and accept any value in case the restricted is true
    'font' => null,
]

Did this project help you today? Did it make you happy in any way?

No response

[colinodell]

I like the idea!

I'd recommend moving all the attributes into a separate array in the configuration (so we're not listing them alongside any other non-attribute keys) - maybe even something like this:

'attributes' => [
    'allowed' => [
        'class' => ['multiple value', 'allowed'],
        'id' => 'allowed_value',
        'title' => function ($value) {
            if (strlen($value) > 10) {
                return true;
            } else {
                return false;
           }
        },
        // Allow the key and accept any value in case the restricted is true
        'font' => null,
    ],
]

If allowed is missing then we'll assume there are no restrictions (for BC reasons).

And I see three ways we could represent keys that allow any values:

• 'font' => null, as you suggest
• 'font' => true
• 'font' (just a value, not a key-value pair)

I don't have a strong preference either way on this.

Are you open to implementing this yourself? If so, please feel free to create a new PR from the main branch :)

[MrSpoocy]

I prefer "null" or value only, because this way we may allow values to be interpreted later.

'attributes' => [
    'allowed' => [
        'data-enable' => true,

// true

• {data-enable=1}
• {data-enable="true"}
• {data-enable=true}
• {data-enable}

// false

• {data-enable=0}
• {data-enable=""}

That's exactly what I was planning to do, extend it via pull request, just wanted to make sure if you agreed with that before I bothered.

[colinodell]

That works for me!

[DanielEScherzer]

From https://commonmark.thephpleague.com/2.7/extensions/attributes/

As of version 2.7.0, this extension can be configured by providing a attributes array with nested configuration options.

allow
An array of allowed attributes. An empty array [] (default) allows virtually all attributes.

Note: Attributes starting with on (e.g. onclick or onerror) are capable of executing JavaScript code and are therefore never allowed by default. You must explicitly add them to the allow list if you want to use them.

@MrSpoocy are you still planning to work on this?