How can one configure HTML Purifier to allow specific style attributes like font-weight while still maintaining security measures against XSS attacks?

To configure HTML Purifier to allow specific style attributes like font-weight while still maintaining security against XSS attacks, you can use the `HTML.AllowedAttributes` configuration option. By specifying the allowed style attributes in this option, you can customize which attributes are permitted while ensuring that malicious code is filtered out. 

require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php';

$config = HTMLPurifier_Config::createDefault();
$config->set('HTML.AllowedAttributes', 'style');
$config->set('CSS.AllowedProperties', 'font-weight');

$purifier = new HTMLPurifier($config);

$dirty_html = '<span style="font-weight: bold; color: red;">Hello, World!</span>';
$clean_html = $purifier->purify($dirty_html);

echo $clean_html;

Keywords

HTML Purifier configuration style attributes font-weight XSS attacks

Related Questions