<p>As far as I know right now as I've brawled through the same issue maybe there is a way to achieve it. Unfortunately is not usable for dynamic script URLs like Buzzsprout's.</p>
<h3>htmlpurifier config <code>/config/htmlpurifier/config.json</code></h3>
<p>First of all <code>HTML.SafeScripting</code> is meant to be <strong>array of allowed script URLs</strong>. So static URL like <code>https://platform.twitter.com/widgets.js</code> should pass. Buzzsprout on the other hand has dynamic script links which in theory could be covered by regex (as it works in <code>URI.SafeIframeRegexp</code>) but the validator for <code>HTML.SafeScripting</code> only uses case sensitive string comparison (see <code>vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/SafeScripting.php</code>).</p>
<p>If you also use <code>HTML.AllowedElements</code> or <code>HTML.Allowed</code> you need to add <code>script</code> to them as well. <code>HTML.AllowedElements</code> is array so you have to add next string entry, <code>HTML.Allowed</code> is string with comma separated list of tags (eventually with allowed attributes).</p>
<h3>Redactor config <code>/config/redactor/config.json</code></h3>
<p>Next you need to fiddle with Redactor settings to prevent <code>&lt;script&gt;</code> tags to be removed or broken.</p>
<pre class="lang-json prettyprint-override"><code>{
...
    &quot;allowedTags&quot;: [&quot;script&quot;],
    &quot;removeScript&quot;: false,
    &quot;autoparseLinks&quot;: false
}
</code></pre>
<ul>
<li><code>allowedTags</code> - allow tag itself, so it can be used in the editor</li>
<li><code>removeScript</code> - as a safety measure Redactor will remove scripts by default, this will turn if off</li>
<li><code>autoparseLinks</code> - in my case Redactor has tried to make a clickable link from URL in leftover script tag resulting in broken HTML - this will prevent it, but also pasted links will not be automatically converted to clickable links and therefore user needs to insert links to the document via the editor tool</li>
</ul>

CC BY-SA 4.0
2024-01-10T16:03:41.193Z
2024-01-11T08:26:34.743Z
2024-01-11T08:26:34.743Z
muffir
<p>I understand the implications of having a script tag in my redactor field.</p>

<p>But I am importing approx. 5k articles in to a Redactor field, some of which have various  tags from embedded Podcasts, Twitter cards etc.. These are obviously getting stripped out. </p>

<p>(It's not possible for me to go through all of the entries and break out those embeds in to a Matrix style set etc..)</p>

<p>So I <strong>need</strong> to be able to edit the HTML Purifier config to allow these tags.</p>

<p>My <code>/config/htmlpurifier/config.json</code> file looks like below but I am not having any luck.</p>

<pre><code>{
    "Core.AggressivelyRemoveScript": false,
    "HTML.SafeScripting": ["script"]
}
</code></pre>

<p>And my Redactor config:</p>

<pre><code>{
  "buttons": ["formatting", "bold", "italic", "unorderedlist", "orderedlist", "link", "image", "video", "html"],
  "plugins": ["fullscreen", "video", "clips", "table"],
  "linkNewTab": true,
  "toolbarFixed": true,
  "allowedTags": ["script"]
}
</code></pre>

<p>Has any ever managed to get Script tags to work and can offer some guidance here? There's a few other Script related configs here <a href="http://htmlpurifier.org/live/configdoc/plain.html" rel="nofollow noreferrer">http://htmlpurifier.org/live/configdoc/plain.html</a> I've tried all of them.</p>

<p>Example of an embed in one of my imported articles.</p>

<pre><code>&lt;script src="https://www.buzzsprout.com/xxxxxxxxxxx" type="text/javascript" charset="utf-8"&gt;&lt;/script&gt;
</code></pre>

<p>I've seen other questions similar to this but no real solution other than put script tags in plain text etc.. but this is not an option in this case. Thanks!</p>

CC BY-SA 4.0
2019-11-15T13:47:21.450Z
Did you ever find a solution to this?
Alex Kendrick
CC BY-SA 4.0
2019-11-15T13:49:42.027Z
Nope, afraid not. From what I can remember I did a mass search and replace to put the script tags inside a plain text field to use in an matrix block.
Mark
<redactor><config>
HTML Purifier Allow <script
# HTML Purifier Allow <script

(Asked by: username_0 on 2019-01-20)

I understand the implications of having a script tag in my redactor field.
But I am importing approx. 5k articles in to a Redactor field, some of which have various  tags from embedded Podcasts, Twitter cards etc.. These are obviously getting stripped out. 
(It's not possible for me to go through all of the entries and break out those embeds in to a Matrix style set etc..)
So I need to be able to edit the HTML Purifier config to allow these tags.
My /config/htmlpurifier/config.json file looks like below but I am not having any luck.
{
    "Core.AggressivelyRemoveScript": false,
    "HTML.SafeScripting": ["script"]
}

And my Redactor config:
{
  "buttons": ["formatting", "bold", "italic", "unorderedlist", "orderedlist", "link", "image", "video", "html"],
  "plugins": ["fullscreen", "video", "clips", "table"],
  "linkNewTab": true,
  "toolbarFixed": true,
  "allowedTags": ["script"]
}

Has any ever managed to get Script tags to work and can offer some guidance here? There's a few other Script related configs here http://htmlpurifier.org/live/configdoc/plain.html I've tried all of them.
Example of an embed in one of my imported articles.


I've seen other questions similar to this but no real solution other than put script tags in plain text etc.. but this is not an option in this case. Thanks!

**Tags:** redactor, config
> **Comments:**
> **username_1**: Did you ever find a solution to this?  
> **username_0**: Nope, afraid not. From what I can remember I did a mass search and replace to put the script tags inside a plain text field to use in an matrix block.  

---

## 1 answers

### Answer by username_2 on 2024-01-10. Score: 2 | Accepted answer

As far as I know right now as I've brawled through the same issue maybe there is a way to achieve it. Unfortunately is not usable for dynamic script URLs like Buzzsprout's.

### htmlpurifier config `/config/htmlpurifier/config.json`

First of all `HTML.SafeScripting` is meant to be **array of allowed script URLs**. So static URL like `https://platform.twitter.com/widgets.js` should pass. Buzzsprout on the other hand has dynamic script links which in theory could be covered by regex (as it works in `URI.SafeIframeRegexp`) but the validator for `HTML.SafeScripting` only uses case sensitive string comparison (see `vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/SafeScripting.php`).

If you also use `HTML.AllowedElements` or `HTML.Allowed` you need to add `script` to them as well. `HTML.AllowedElements` is array so you have to add next string entry, `HTML.Allowed` is string with comma separated list of tags (eventually with allowed attributes).

### Redactor config `/config/redactor/config.json`

Next you need to fiddle with Redactor settings to prevent


---

