Opened 11 years ago
Closed 11 years ago
#11508 closed Bug (fixed)
DataProcessor processing nested (encoded) attributes
Reported by: | Olek Nowodziński | Owned by: | Olek Nowodziński |
---|---|---|---|
Priority: | Normal | Milestone: | CKEditor 4.3.3 |
Component: | Core : Parser | Version: | 4.0 |
Keywords: | Cc: | wim.leers@… |
Description
- Open replacebycode sample.
- Enable
allowedContent: true
CKEDITOR.replace( 'editor1', { allowedContent: true } );
- Call
CKEDITOR.instances.editor1.dataProcessor.toHtml( '<p><img data-foo="<a href="XXX">YYY</a>" /></p>' )
data-foo
attribute contains encoded HTML:<a href="XXX">YYY</a>
Expected:
<p><img data-foo="<a href="XXX">YYY</a>" /></p>
Actual:
<p><img data-foo="<a data-cke-saved-href="XXX">YYY</a> href="XXX">YYY</a>" /></p>
What happened?
Dataprocessor considered href="XXX"
as an attribute of <img>
and tried to protect it, making a lot of mess. The RegExp responsible for that is not perfect
protectAttributeRegex = /\s(on\w+|href|src|name)\s*=\s*(?:(?:"[^"]*")|(?:'[^']*')|(?:[^ "'>]+))/gi;
|(?:[^ "'>]+)
matches href="XXX"
as an unquoted attribute of <img>
(this kind of attributes is allowed in HTML)
Another TC:
Paste
<p><img data-foo="<a href="XXX">YYY</a>" /></p>
into source view and switch modes twice.
Change History (6)
comment:1 Changed 11 years ago by
Owner: | set to Olek Nowodziński |
---|---|
Status: | new → assigned |
comment:2 Changed 11 years ago by
Status: | assigned → review |
---|
comment:3 Changed 11 years ago by
Cc: | wim.leers@… added |
---|
comment:4 Changed 11 years ago by
I was able to notice a small decrease on performance on setDate with this code (between 5-10%), but it is hard to measure it for sure. Still it has little impact on the overall editor experience. If we really want to talk about performance, then better to try to not have that code at all, which is a much bigger task.
I don't see better ways to solve this problem though. I just pushed a minor simplification to the regex and I think the proposed solution is fine.
comment:5 Changed 11 years ago by
Status: | review → review_passed |
---|
comment:6 Changed 11 years ago by
Resolution: | → fixed |
---|---|
Status: | review_passed → closed |
git:abb150f landed in master (eb840d1 tests).
Pushed a fix to t/11508 (+tests).
Note: Although I didn't notice performance loss (quite contrary in fact, which is funny) it may still be an issue because changes in RegExp made it more general. Watch out.