diff --git a/src/View/Shortcodes/EmbedShortcodeProvider.php b/src/View/Shortcodes/EmbedShortcodeProvider.php index e87b31a11..75c3cdb13 100644 --- a/src/View/Shortcodes/EmbedShortcodeProvider.php +++ b/src/View/Shortcodes/EmbedShortcodeProvider.php @@ -28,22 +28,6 @@ class EmbedShortcodeProvider implements ShortcodeHandler { use Configurable; - /** - * A whitelist of shortcode attributes which are allowed in the resultant markup. - * Note that the tinymce plugin restricts attributes on the client-side separately. - * - * @config - * @deprecated 4.12.0 Removed without equivalent functionality to replace it - */ - private static array $attribute_whitelist = [ - 'url', - 'thumbnail', - 'class', - 'width', - 'height', - 'caption', - ]; - /** * Gets the list of shortcodes provided by this handler * @@ -262,8 +246,17 @@ class EmbedShortcodeProvider implements ShortcodeHandler */ private static function buildAttributeListFromArguments(array $arguments, array $exclude = []): ArrayList { + // A whitelist of shortcode attributes which are allowed in the resultant markup. + // Note that the tinymce plugin restricts attributes on the client-side separately. + $whitelist = [ + 'url', + 'thumbnail', + 'class', + 'width', + 'height', + 'caption' + ]; // Clean out any empty arguments and anything not whitelisted - $whitelist = static::config()->get('attribute_whitelist'); $arguments = array_filter($arguments, function ($value, $key) use ($whitelist) { return in_array($key, $whitelist) && strlen(trim($value ?? '')); }, ARRAY_FILTER_USE_BOTH); diff --git a/tests/php/View/Shortcodes/EmbedShortcodeProviderTest.php b/tests/php/View/Shortcodes/EmbedShortcodeProviderTest.php index a485793a6..4bd3645f5 100644 --- a/tests/php/View/Shortcodes/EmbedShortcodeProviderTest.php +++ b/tests/php/View/Shortcodes/EmbedShortcodeProviderTest.php @@ -217,37 +217,4 @@ class EmbedShortcodeProviderTest extends EmbedUnitTest $html ); } - - public function testWhitelistIsConfigurable() - { - // Allow new whitelisted attribute - Config::modify()->merge(EmbedShortcodeProvider::class, 'attribute_whitelist', ['data-some-value']); - - $url = 'https://www.youtube.com/watch?v=dM15HfUYwF0'; - $html = $this->getShortcodeHtml( - $url, - $url, - << - EOT, - << $url, - 'caption' => 'A nice video', - 'width' => 779, - 'height' => 437, - 'data-some-value' => 'my-data', - 'onmouseover' => 'alert(2)', - 'style' => 'background-color:red;', - ], - ); - $this->assertEqualIgnoringWhitespace( - <<

A nice video

- EOT, - $html - ); - } }