Relax restrictions on class names for syntaxhighlighter [#647476]

Hi, I recently noticed a conflict between syntaxhighlighter and this module. Syntaxhighlighter will take an element like this:

<pre class="brush: jscript;fontsize: 100; first-line: 1; ">

and render the code inside the tag as a syntax highlighted div. It is very useful if you are publishing code snippets in drupal content

Obviously, this is not possible given your validation rules to match that 'class name'. Syntaxhighlighter will go through and change that pre tag and generate a div with the appropriate style, so it does validate, but the wysiwyg_filter strips out the class before it has a chance.

Is there any interest in broadening what is allowable in the class name? Why can't you just accept '*' and let it expand to /.*/ ?

Comment	File	Size	Author
#2	wysiwyg_filter-classname-707484-2.patch	1.41 KB	sheldonkreger

Comments

Comment #1

markus_petrux commented 1 December 2009 at 08:26

Status:

Active

» Closed (works as designed)

class validate is strict because it could be used to cause harm to the page. WYSIWYG Filter is not compatible with this kind of requirements. Things would be easier if Syntaxighighlighter in client-side was generating a macro, something that does not use HTML tags, for example [syntaxhighlighter: brush: jscript;fontsize: 100; first-line: 1;]. Then this could be expanded to HTML using a separate input format that executes after WYSIWYG Filter.

Comment #2

sheldonkreger commented 15 January 2014 at 22:58

Version:	6.x-1.3	» 7.x-1.x-dev
Issue summary:	View changes
Status:	Closed (works as designed)	» Active

Status	File	Size
new	wysiwyg_filter-classname-707484-2.patch	1.41 KB

I ran into this issue today in 7.x. JS files inside Syntaxhighlighter uses classnames containing ";" and ":" . . . I'm not sure why these could be dangerous, other than just being invalid and therefore not recognized by CSS or JS.

I'm using a plugin for CKEditor which allows the user to embed code snippets inside the wysiwyg. It uses pre and a unique class name to execute JS to apply the syntax highlighting upon page load. Obviously, this won't work if the class is stripped out. And, this module currently won't allow admins to add these classes to the whitelist.

Attached is a patch which resolves the issue by allowing ";" and ":" during the regex validation.