FIX Don't strip <header> tag from HTMLValue (#11302)

silverstripe · Jul 9, 2024 · c13ec34 · c13ec34
1 parent 1943f9d
commit c13ec34
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 1 deletion.
diff --git a/src/View/Parsers/HTMLValue.php b/src/View/Parsers/HTMLValue.php
@@ -32,7 +32,7 @@ public function __construct($fragment = null)
      */
     public function setContent($content)
     {
-        $content = preg_replace('#</?(html|head|body)[^>]*>#si', '', $content);
+        $content = preg_replace('#</?(html|head(?!er)|body)[^>]*>#si', '', $content);
         $html5 = new HTML5(['disable_html_ns' => true]);
         $document = $html5->loadHTML(
             '<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>' .

diff --git a/tests/php/View/Parsers/HTMLValueTest.php b/tests/php/View/Parsers/HTMLValueTest.php
@@ -160,4 +160,32 @@ public function testValidHTMLInNoscriptTags()
             $this->assertEquals($noscript, $value->getContent(), 'Child tags are left untouched in noscript tags.');
         }
     }
+
+    public function provideOnlyStripIntendedTags(): array
+    {
+        return [
+            [
+                'input' => '<html><head></head><body><div><p>blahblah</p></div></body></html>',
+                'expected' => '<div><p>blahblah</p></div>',
+            ],
+            [
+                'input' => '<html><head></head><body><header></header><div><p>blahblah</p></div></body></html>',
+                'expected' => '<header></header><div><p>blahblah</p></div>',
+            ],
+            [
+                'input' => '<html some-attribute another-attribute="something"><head></head><body><div><p>blahblah</p></div></body></html>',
+                'expected' => '<div><p>blahblah</p></div>',
+            ],
+        ];
+    }
+
+    /**
+     * @dataProvider provideOnlyStripIntendedTags
+     */
+    public function testOnlyStripIntendedTags(string $input, string $expected): void
+    {
+        $value = new HTMLValue();
+        $value->setContent($input);
+        $this->assertEquals($expected, $value->getContent(), 'Invalid HTML can be parsed');
+    }
 }