Follow-up to #2105841: Xss filter() mangles image captions and title/alt/data attributes
Problem/Motivation
\Drupal\Component\Utility\Xss::filter() cleans potentially dangerous protocols like "javascript:" from element attributes. It does this by stripping any set of characters that ends with a colon, unless the string is "http:" or "https:".
The filter strips out valid attribute name/value combinations that provide RDF metadata, such as rel="schema:author" or property="foaf:name".
Some attributes are exempt from this treatment, including `alt`, `title`, and any `data-*` attribute. In #2105841: Xss filter() mangles image captions and title/alt/data attributes, the decision was made to hard-code the exempt attributes list, and possibly make the list configurable in a follow-up issue.
Proposed resolution
None yet.
Remaining tasks
None.
User interface changes
None.
API changes
None.
Beta phase evaluation
| Issue category | Bug because RDF attributes are being stripped |
|---|---|
| Issue priority | Major because ... Critical/Not critical because ... |
| Unfrozen changes | Unfrozen because it is a bug fix |
| Prioritized changes | The main goal of this issue is bug fix and security |
-->