Applying a CSS whitelist to HTML in PHP

Question

Lets say I have the following $string...

<span style='text-decoration:underline; display:none;'>Some text</span>

I only want to allow the style text-decoration, so I want a PHP function like the following...

$string = stripStyles($string, array("text-decoration"));

Similar to strip_tags, but using an array instead. So $string will now be...

<span style='text-decoration:underline;'>Some text</span>

I am using Cake, so if this can be done with Sanitize then all the better.

Why is this getting off-topic votes to Programmers.SE? What am I missing? — Michael Berkowski, Jul 21 '11 at 23:48
Possible duplicate of [How to preform whitelist-based CSS filtering in PHP](http://stackoverflow.com/q/1364302) — genesis, Jul 21 '11 at 23:52
possible duplicate of [How to preform whitelist-based CSS filtering in PHP](http://stackoverflow.com/questions/1364302/how-to-preform-whitelist-based-css-filtering-in-php) — Jared Farrish, Jul 21 '11 at 23:54
Hmmm, it _is_ the same question, but I'm not fond of the answer there... — Wrikken, Jul 21 '11 at 23:54
@wrikken - Sounds like a good opportunity to offer a better solution. :) — Jared Farrish, Jul 21 '11 at 23:55
Agreed, a working function would be nice, not some psuedo code. — jchavannes, Jul 21 '11 at 23:57
@Wrikken: Unanswered question does not mean that you can create duplicate ;) — genesis, Jul 21 '11 at 23:57
@Jared: was counting down until someone said it indeed :) As it should be. Now, to find the time, and be complete, hm. — Wrikken, Jul 21 '11 at 23:58

Michael Berkowski · Answer 1 · 2011-07-22T00:02:18.047

This is tricky, but you should be able to do it with DOMDocument. This should get you started, but it's likely to require some serious tweaking.

// Load your html string
$dom = new DOMDocument();
$dom->loadHTML($your_html_string);

// Get all the <span> tags
$spans = $dom->getElementsByTagName("span");

// Loop over the span tags
foreach($spans as $span) {

  // If they have a style attribute that contains "text-decoration:"
  // attempt to replace the contents of the style attribute with only the text-decoration component.
  if ($style = $span->getAttribute("style")) {
    if (preg_match('/text-decoration:([^;]*);/i', $style)) {
      $span->setAttribute("style", preg_replace('/^(.*)text-decoration:([^;]*);(.*)$/i', "text-decoration:$2;", $style);
    }
    // Otherwise, erase the style attribute
    else $span->setAttribute("style", "");
  }
}

$output = $dom->saveHTML;

It's maybe better to attempt to parse the style attributes by explode()ing on ;

// This replaces the inner contents of the foreach ($spans as $span) above...

// Instead of the preg_replace()
$styles = explode(";", $style);
$replaced_style = FALSE;
foreach ($styles as $s) {
 if (preg_match('/text-decoration/', $s) {
   $span->setAttribute("style", $s);
   $replaced_style = TRUE;
 }
 //  If a text-decoration wasn't found, empty out the style
 if (!$replaced_style) $span->setAttribute("style", "");
}

There is, of course, http://stackoverflow.com/questions/3650125/how-to-parse-html-with-php/ — Jared Farrish, Jul 22 '11 at 00:14
@jchavannes The above is a large and complicated block of code, and should be more than enough to send you in the right direction if you aren't in over your head with this project requirement. Wrap it in a `function()` and replace the `getElementsByTagName()` with an xpath query as suggested in the comments if needed. — Michael Berkowski, Jul 22 '11 at 00:16

Applying a CSS whitelist to HTML in PHP

1 Answers1