laravel 使用http purifier来过滤xss攻击,如何允许iframe来发布b站视频
环境:
//: <> (对待提问越认真,就越容易得到答复。)
//: <> (对待提问越认真,就越容易得到答复。)
//: <> (对待提问越认真,就越容易得到答复。)
//: <> (重要的事情说三遍!)
1. 运行环境
使用laravel8.0,php 7.4
2.测试代码
<?php
return [
'encoding' => 'UTF-8',
'finalize' => true,
'cachePath' => storage_path('app/purifier'),
'cacheFileMode' => 0755,
'settings' => [
'user_post_body' => [
'HTML.Doctype' => 'HTML 4.01 Transitional',
'HTML.Allowed' => 'div,b,strong,i,em,a[href|title],ul,ol,ol[start],li,p[style],br,span[style],img[width|height|alt|src],*[style|class],pre,hr,code,h2,h3,h4,h5,h6,blockquote,del,table,thead,tbody,tr,th,td',
'CSS.AllowedProperties' => 'font,font-size,font-weight,font-style,margin,width,height,font-family,text-decoration,padding-left,color,background-color,text-align',
'AutoFormat.AutoParagraph' => true,
'AutoFormat.RemoveEmpty' => true,
],
'bilibili' => [
"HTML.SafeIframe" => 'true',
"URI.SafeIframeRegexp" => "%^https://player\.bilibili\.com/player\.html%"
],
],
];
按教程,这样没有效果
请教下大神,如何才能允许iframe,来播放b站的视频,同时能够防止iframe的xss攻击,感谢!
推荐文章: