1

I want something like this:

{{ 'bl<b>a</b>h [b]blah[/b]'|raw|simple_bbcode }}

But my changed tags ([b] to < b>) are still escaped even though the simple_bbcode filter is used after raw.

Now I have this:

{{ 'b<b>l</b>ah [b]blah[/b]'|simple_bbcode|raw }}

This makes the simple_bbcode work well but it also lets malicious tags get applied.

I know why this happens but I don't know how to make it work like I want. Any suggestions?

// EDIT

Forgot to mention that changing the filter into a function doesn't change anything.

2 Answers 2

1

Forget the previous answer, I found a working solution:

We have our text:

{{ '<b>We</b> have a <a href="#">link</a> that [b]should[/b] not work.'|simple_bbcode|raw }}

We'll assume that you have registered your simple_bbcode filter, so we'll skip that part and go straight to the filters code:

public function simpleBbcodeFilter($string)
{
    return preg_replace(array('/\[b\]/','/\[\/b\]/'), array('<b>', '</b>'), htmlspecialchars($string));
}

This way we first escape all html tags to disallow them. Then, with the replace we only allow the [b]*[/b] code to be converted to it's html tag. So only [b]*[/b] will work. If you put, for example [a]*[/a] will not be converted.

After that we mustn't forget to put |raw, as I wrote above. Is that what you were looking for?

4
  • Looks like it might work. I'll test it out soon. I forgot that |raw just turns off some twig filter which is just equivailent to using htmlspecialchars so you can just do it in another filter (like in your code) and turn off that twig's one. If you find this question challenging, remember to mark it since I need 15 rep (got 14) to mark other questions as helpful :) Jul 8, 2013 at 9:34
  • Marked up! If my answer helped you I would be glad if you accept it ;) Jul 8, 2013 at 9:39
  • Yup. Looks beautiful. Come for a beer some day! Jul 8, 2013 at 11:01
  • Hahahahaha, nice! See you around! Jul 8, 2013 at 11:05
1

Update: This answer doesn't solve the problem. See my other answer.

Did you try with {{ 'b<b>l</b>ah [b]blah[/b]'|simple_bbcode|striptags('<b>')|raw }} ?

I think it could work.

If you need to strip more tags like <b> just add them this way: striptags('<b><p><a>')

I hope I helped you, mate.

6
  • Yeah but if a user adds some other tags I want them to stay there but escaped..... Jul 5, 2013 at 11:05
  • Well, I tried this locally (not taking into account the simple_bbcode filter): {{ 'b<b>l</b>ah [b]blah[/b]<a></a>'|raw|striptags('<b>') }} That code seems to scape only <b> tags and allow the others. If you create your own filter with a black list of forbidden tags, could be your solution. Jul 5, 2013 at 11:19
  • Yeah but I want to DISALLOW the others and allow [b] / <b>. Plus making a blacklist is NEVER a solution and NEVER recommended. Jul 5, 2013 at 11:35
  • Maybe if you first scape the text with |raw and then with a custom filter you replace with a regexp the bbCode [b]something[/b] to <b>something</b> may work. Your TWIG template would be {{ 'something with html and bbcode'|raw|mybbcodereplacer }} Jul 8, 2013 at 7:45
  • What's the diffirence between this and the first example from my subject post? Jul 8, 2013 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.