diff --git a/src/View/Parsers/HTMLValue.php b/src/View/Parsers/HTMLValue.php index ee44ec1421f..76b5ebc17af 100644 --- a/src/View/Parsers/HTMLValue.php +++ b/src/View/Parsers/HTMLValue.php @@ -32,7 +32,7 @@ public function __construct($fragment = null) */ public function setContent($content) { - $content = preg_replace('#?(html|head|body)[^>]*>#si', '', $content); + $content = preg_replace('#?(html|head(?!er)|body)[^>]*>#si', '', $content); $html5 = new HTML5(['disable_html_ns' => true]); $document = $html5->loadHTML( '
' . diff --git a/tests/php/View/Parsers/HTMLValueTest.php b/tests/php/View/Parsers/HTMLValueTest.php index 7ce889dd738..52563498ace 100644 --- a/tests/php/View/Parsers/HTMLValueTest.php +++ b/tests/php/View/Parsers/HTMLValueTest.php @@ -160,4 +160,32 @@ public function testValidHTMLInNoscriptTags() $this->assertEquals($noscript, $value->getContent(), 'Child tags are left untouched in noscript tags.'); } } + + public function provideOnlyStripIntendedTags(): array + { + return [ + [ + 'input' => 'blahblah
blahblah
blahblah
blahblah
blahblah
blahblah