Online PHP editor | output for 2C0tY

<?php const STAR_PROTECTOR = '__zqh6vxfbk3cg__'; function load($html) { $html = str_replace('*', STAR_PROTECTOR, $html); $document = <<<EOD <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /></head> <body>!html</body> </html> EOD; // PHP's \DOMDocument serialization adds extra whitespace when the markup // of the wrapping document contains newlines, so ensure we remove all // newlines before injecting the actual HTML body to be processed. $document = strtr($document, ["\n" => '', '!html' => $html]); $dom = new \DOMDocument(); // Ignore warnings during HTML soup loading. @$dom->loadHTML($document); return $dom; } function simulate_filter_html_parsing(string $input) { print "-----\n$input\n-----\n"; $parsed_nodes = load($input)->getElementsByTagName('body')->item(0)->childNodes; foreach ($parsed_nodes as $node) { // ⚠️ See @larowlan's https://www.drupal.org/project/drupal/issues/3280602#comment-14517052 comment if ($node->nodeType !== XML_ELEMENT_NODE) { // Skip the empty text nodes inside tags. continue; } print 'tag: '; var_dump($node->tagName); foreach ($node->attributes as $name => $attribute) { // Put back any trailing * on wildcard attribute name. $name = str_replace(STAR_PROTECTOR, '*', $name); // Put back any trailing * on wildcard attribute value and parse out // the allowed attribute values. $allowed_attribute_values = preg_split('/\s+/', str_replace(STAR_PROTECTOR, '*', $attribute->value), -1, PREG_SPLIT_NO_EMPTY); print 'attr: '; var_dump($name); // if ($attr-) if (!empty($allowed_attribute_values)) { print 'attr values: '; var_dump($allowed_attribute_values); } } } print "\n\n"; } // ⚠️ Uncomment this if you want to convince yourself this really is running for all PHP versions // print phpversion() . "\n"; simulate_filter_html_parsing('<foo data-*>'); simulate_filter_html_parsing('<foo data-*="foo bar">'); simulate_filter_html_parsing('<__preprocessed-global-attribute__ data-*="foo bar">'); // ⚠️ This is the specific example @larowlan cited at https://www.drupal.org/project/drupal/issues/3280602#comment-14517052 simulate_filter_html_parsing('<__preprocessed-wildcard-text-container__ class="text-align-left text-align-center text-align-right text-align-justify" />'); // ⚠️ 3vl.org unfortunately has disabled phpinfo for security reasons… so we cannot check the libxml version //var_dump(phpinfo(INFO_MODULES));