Fix improved filtering of attributes

2021-04-22 10:05:51 +02:00 · 2021-04-22 10:05:51 +02:00 · 0eca5935c0
parent 541f6d8415
commit 0eca5935c0
1 changed files with 7 additions and 1 deletions
--- a/h5p.classes.php
+++ b/h5p.classes.php
@ -4319,7 +4319,13 @@ class H5PContentValidator {
          // Attribute name, href for instance.
          if (preg_match('/^([-a-zA-Z]+)/', $attr, $match)) {
            $attrName = strtolower($match[1]);
-            $skip = ($attrName == 'style' || substr($attrName, 0, 2) == 'on');
+            $skip = (
+              $attrname == 'style' ||
+              substr($attrname, 0, 2) == 'on' ||
+              substr($attrname, 0, 1) == '-' ||
+              // Ignore long attributes to avoid unnecessary processing overhead.
+              strlen($attrname) > 96
+            );
            $working = $mode = 1;
            $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr);
          }