feat: Add allowfullscreen attr for iframe (#411)

ezyang · Jun 30, 2024 · 70754a2 · 70754a2
1 parent 9723267
commit 70754a2
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 11 deletions.
diff --git a/library/HTMLPurifier/HTMLModule/Iframe.php b/library/HTMLPurifier/HTMLModule/Iframe.php
@@ -28,22 +28,28 @@ public function setup($config)
  if ($config->get('HTML.SafeIframe')) {
  $this->safe = true;
  }
+ $attrs = array(
+ 'src' => 'URI#embedded',
+ 'width' => 'Length',
+ 'height' => 'Length',
+ 'name' => 'ID',
+ 'scrolling' => 'Enum#yes,no,auto',
+ 'frameborder' => 'Enum#0,1',
+ 'longdesc' => 'URI',
+ 'marginheight' => 'Pixels',
+ 'marginwidth' => 'Pixels',
+ );
+
+ if ($config->get('HTML.Trusted')) {
+ $attrs['allowfullscreen'] = 'Bool#allowfullscreen';
+ }
+
  $this->addElement(
  'iframe',
  'Inline',
  'Flow',
  'Common',
- array(
- 'src' => 'URI#embedded',
- 'width' => 'Length',
- 'height' => 'Length',
- 'name' => 'ID',
- 'scrolling' => 'Enum#yes,no,auto',
- 'frameborder' => 'Enum#0,1',
- 'longdesc' => 'URI',
- 'marginheight' => 'Pixels',
- 'marginwidth' => 'Pixels',
- )
+ $attrs
  );
  }
 }

diff --git a/tests/HTMLPurifier/HTMLT/safe-iframe-youtube-allowfullscreen.htmlt b/tests/HTMLPurifier/HTMLT/safe-iframe-youtube-allowfullscreen.htmlt
@@ -0,0 +1,9 @@
+--INI--
+HTML.SafeIframe = true
+HTML.Trusted = true
+URI.SafeIframeRegexp = "%^http://www.youtube.com/embed/%"
+--HTML--
+<iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0" allowfullscreen></iframe>
+--EXPECT--
+<iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0" allowfullscreen="allowfullscreen"></iframe>
+--# vim: et sw=4 sts=4