1. class
  2. App
  3. \
  4. Sanitizer
  5. \
  6. StyleAttributeSanitizer

StyleAttributeSanitizer

final class StyleAttributeSanitizer implements AttributeSanitizerInterface

Filters the value of a style attribute down to a safe CSS property allow-list.

Symfony's HtmlSanitizer can only allow or drop the style attribute as a whole; it has no CSS-property-level filtering. Re-enabling style unfiltered would reopen CSS-based XSS vectors (expression(), url(javascript:), @import, behavior, ...). This sanitizer keeps only known-safe declarations (colours, borders, spacing, fonts, alignment) and drops everything else, so rich text authored in the editor can carry inline colours/backgrounds while staying XSS-safe.

Registered via with_attribute_sanitizers in config/packages/html_sanitizer.yaml. The attribute must also be allowed (via allow_attributes) for this sanitizer to run.

Constants

private ALLOWED_PROPERTIES

CSS properties safe to keep. Lower-case, exact match.
private BANNED_SUBSTRINGS

Substrings that cause a declaration to be rejected, whatever the property.

Methods

array|null
getSupportedElements()

No description

array
getSupportedAttributes()

No description

string|null
sanitizeAttribute(string $element, string $attribute, string $value, HtmlSanitizerConfig $config)

No description

Details

at line 47
array|null getSupportedElements()

No description

Return Value

array|null

at line 53
array getSupportedAttributes()

No description

Return Value

array

at line 58
string|null sanitizeAttribute(string $element, string $attribute, string $value, HtmlSanitizerConfig $config)

No description

Parameters

string $element
string $attribute
string $value
HtmlSanitizerConfig $config

Return Value

string|null