HTMLPurifier: Allow async, defer, charset attributes of <script> embeds

[bar9]

Relevant for the Widget Plugin:

For e.g. Twitter or Instagram embeds, see related stack overflow question for reference

As several other HTML5 features are affected, this library might point to a feasible direction, however they don't seem to support the mentioned attributes for <script> yet.

With the following config:
"HTML.SafeScripting": ["https://platform.twitter.com/widgets.js", "//www.instagram.com/embed.js"],
when including a Twitter embed widget,
async and defer attributes are just stripped, which is just a site performance issue but does not affect functionality. The charset tag is more problematic: All Markup after the widget is deleted on save.

[brandonkelly]

We already do add support for HTML5 attributes, FTR:

https://github.com/craftcms/cms/blob/e916d854d869d55de286c0e2ffe5f4e1161d8219/src/helpers/HtmlPurifier.php#L48-L73

Can you supply example embed codes we should test against?

[bar9]

I'm having trouble with any Twitter widget, for instance the following:

<blockquote class="twitter-tweet" data-lang="de"><p lang="en" dir="ltr">Super proud of the entire Blue Team who came together and made it happen <a href="https://twitter.com/hashtag/nevergetsold?src=hash&amp;ref_src=twsrc%5Etfw">#nevergetsold</a> <a href="https://twitter.com/hashtag/gradatimferociter?src=hash&amp;ref_src=twsrc%5Etfw">#gradatimferociter</a> <a href="https://t.co/f6e2pdnwGn">https://t.co/f6e2pdnwGn</a></p>&mdash; Jeff Bezos (@JeffBezos) <a href="https://twitter.com/JeffBezos/status/1019742477018730496?ref_src=twsrc%5Etfw">19. Juli 2018</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

The async and charset attributes are stripped from the script tag, and all markup after the closing script tag as well.

[mark-chief]

@bar9 Did you manage to get a solution for adding <script> tags from Twitter or other media platforms in the end? Be grateful for any insight.

[tom-byrom]

We already do add support for HTML5 attributes, FTR:

https://github.com/craftcms/cms/blob/e916d854d869d55de286c0e2ffe5f4e1161d8219/src/helpers/HtmlPurifier.php#L48-L73

Can you supply example embed codes we should test against?

@brandonkelly that may be so but 'async' is still not supported nor is 'charset'. Any news on when you can add support for these attributes?

Thanks

[andris-sevcenko]

We'll be moving to Html Sanitizer in Craft 4, which will make this issue easier to tackle than with the Html purifier.