Enable the restriction of attributes

[MrSpoocy]

Description

I would like to customize the extension https://commonmark.thephpleague.com/2.3/extensions/attributes/ so that you can limit the attributes of the user by configuration. Currently I give the user too much freedom once the extension is activated because e.g. I only want the user to be able to set values for bootstrap pull-left as class.

If restricted is true (default: false that there is no BC), then only the keys in the configuration are allowed. If false, then only the values of the specified keys are restricted.

Example

'attributes' => [
    'restricted' => true,
    'class' => ['multiple value', 'allowed'],
    'id' => 'allowed_value',
    'title' => function ($value) {
        if (strlen($value) > 10) {
            return true;
        } else {
            return false;
       }
    },
    // Allow the key and accept any value in case the restricted is true
    'font' => null,
]

Did this project help you today? Did it make you happy in any way?

No response

[colinodell]

I like the idea!

I'd recommend moving all the attributes into a separate array in the configuration (so we're not listing them alongside any other non-attribute keys) - maybe even something like this:

'attributes' => [
    'allowed' => [
        'class' => ['multiple value', 'allowed'],
        'id' => 'allowed_value',
        'title' => function ($value) {
            if (strlen($value) > 10) {
                return true;
            } else {
                return false;
           }
        },
        // Allow the key and accept any value in case the restricted is true
        'font' => null,
    ],
]

If allowed is missing then we'll assume there are no restrictions (for BC reasons).

And I see three ways we could represent keys that allow any values:

• 'font' => null, as you suggest
• 'font' => true
• 'font' (just a value, not a key-value pair)

I don't have a strong preference either way on this.

Are you open to implementing this yourself? If so, please feel free to create a new PR from the main branch :)

[MrSpoocy]

I prefer "null" or value only, because this way we may allow values to be interpreted later.

'attributes' => [
    'allowed' => [
        'data-enable' => true,

// true

• {data-enable=1}
• {data-enable="true"}
• {data-enable=true}
• {data-enable}

// false

• {data-enable=0}
• {data-enable=""}

That's exactly what I was planning to do, extend it via pull request, just wanted to make sure if you agreed with that before I bothered.

[colinodell]

That works for me!