Image Style Percentage

[egknight]

Why are image style height percentage stripped but not for pixels?

Input

<img class="img-fluid" src="/storage/uploads/abc.jpeg" alt="abc.jpeg" style="width: 25%;">

Output

<img class="img-fluid" src="/storage/uploads/abc.jpeg" alt="abc.jpeg">

I've configured my settings as follows, including style within img[]

'HTML.Allowed'             => 'div,b,strong,i,em,u,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src|class|style]',

If I pass the height and width as pixels, it works as expected.

Thanks

[qwebdev]

Looks like by default sizes can only be fixed values. You can disable the pixels check with something like this:

[
            'HTML.Allowed'             => 'div,b,strong,i,em,u,a[href|title],ul,ol,li,p[style],br,span[style],img[alt|src|style],code,pre',
            'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align,width,max-width',
            // This config option allows for b64 & regular linked images
            'URI.AllowedSchemes' => ['data' => true,'src'=>true,'http' => true, 'https' => true,],
            // This config option disables the pixel checks
            'HTML.MaxImgLength'   => NULL,
            'CSS.MaxImgLength'   => NULL,
]

[subtronic]

I try this case, and this is don't work.
Input:

<img src="<some_correct_uri>" alt="5cd85f1bb85ad.jpg" style="float: none; width: 50%;">

Output:

<img src="<same_correct_uri>" alt="5cd85f1bb85ad.jpg">

And my config:

['Cache.DefinitionImpl' => null,
            'HTML.Doctype'             => 'HTML 4.01 Transitional',
            'HTML.Allowed'             => 'div,b,strong,i,em,u,a[href|title],ul,ol,li,p[style],br,span[style],img[style|width|height|alt|src|data-filename],h1,h2,h3,h4,h5,h6,sup,sub,strike,pre,blockquote',
            'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align,width,height',
            'AutoFormat.AutoParagraph' => true,
            'AutoFormat.RemoveEmpty'   => true,
            'HTML.MaxImgLength' => null,
            'CSS.MaxImgLength' => null,
]

[totten]

Why are image style height percentage stripped but not for pixels?

I was wondering about this too, and trying to understand the "imagecrash" attack referenced in the docs. Just to try to move it forward a bit, here are the main citations I could find:

• http://htmlpurifier.org/live/configdoc/plain.html#CSS.MaxImgLength

  This parameter sets the maximum allowed length on img tags, effectively the width and height properties. Only absolute units of measurement (in, pt, pc, mm, cm) and pixels (px) are allowed. This is in place to prevent imagecrash attacks, disable with null at your own risk. This directive is similar to %HTML.MaxImgLength, and both should be concurrently edited, although there are subtle differences in the input format (the CSS max is a number with a unit).

• Something wrong with <img> tag's percentage length #102 (comment)

  To enable percentage-based widths on images, set CSS.MaxImgLength to NULL. This default is to protect against imagecrash attacks. (Though, eight years [ED: 16 years] after this code was added, maybe it's time to change the default.)

• http://blog.ezyang.com/2010/10/the-html-purification-manifesto/

  Consider the imagecrash attack, which can bluescreen an unwitting Windows user simply by setting the width and height of an image to 999999.

I'm just playing at "archaeologist" here, so I may get this wrong, but let me also try to fill-out a narrative:

There was a browser-side bug circa 2008 (e.g. IE6 or IE7). Now-a-days, the pipeline for OS+browser security-fixes is more optimized. But in 2008, rolling-out a browser-update could be slow/contentious (esp for large orgs). Faced with slow browser-updates, people who run intermediate systems (eg servers w/PHP) might feel obliged to deploy a quick work-around.

The work-around faces this tension:

• Philosophically, imposing some kind of limit is always a good practice. The idea is timeless.
• Practically, the specific problem is obsolete. In 2024, there isn't much of an audience running vulnerable 2008 web-browsers.

I guess the fix depends on whether one feels more practical or more philosophical:

• Practically, you can disable the check (as suggested earlier). This is cheap+easy.
• Philosophically, limits are good. But the limits should be updated to support modern practices. This would take more work. (Percentages are common, so add complementary setting CSS.MaxImgLengthPct=200%. Also, 8k is common in consumer-grade hardware, so raise the default CSS.MaxImgLength=7680).

How's that for a narrative? Somewhere in the ballpark?

[ezyang]

I am ok with changing default here.