Safecracker Handling Wygwam Style Attributes Poorly

Question

EE 2.6.1 WYGWAM 2.7.1

I have a Wygwam field. Inline image tags are not being written properly when entered through a Safecracker form. Inline image tags ARE being written properly when entered through the EE CP.

From the control panel, an img tag is written thusly:

<img alt=”” data-cke-saved-src=“something.jpg” src=“something.jpg” style=“width: 110px; height: 150px;”>

And from Safecracker, it looks like this:

<img alt=”” data-cke-saved-src=“something.jpg” src=“something.jpg” 110px;=”” height:=”” 150px;”=”“>

The style attribute is not encoding properly.

Andris over at P&T points us to line 1302 in safecracker_lib.php and suspects “the Security library is somehow deciding that style attribute is an XSS attack and is handling it rather poorly”

Is there something I can be doing to fix this?

I’ll gladly accept a patch if anyone can help. This is kind of a big deal. Thanks.

(I see a few answers that mention editing CKEditor config files. Ugh... really?)

Answer 1

In safecracker_lib.php around line 2625, there's a blank array being defined called $this->skip_xss_fieldtypes. Add wygwam to that array.

$this->skip_xss_fieldtypes = array('wygwam');