iframe in Grav 2.0

After upgrading a test site, I just upgraded my staging site to Grav 2.0. The upgrade was very smooth again. One issue: I have a few pages with an embedded iFrame that runs a p5js Javascript file. This has been working fine, but after the upgrade the page with the iframe only shows the iframe HTML as text on the page. Any suggestions for troubleshooting?

There are quite a few blogs by Andy dedicated to Grav 2 and I highly recommend reading them all.

A few are about Markdown and why code in Markdown breaks:

• https://getgrav.org/blog/grav-2-markdown-enhancements
  This one mentions why <iframe> doesn't work anymore. See section Disallowed Raw HTML (tagfilter)
• https://getgrav.org/blog/grav-2-dev-markdown-extensions
• https://getgrav.org/blog/grav-2-twig-content-security
  Why Twig (code) doesn't run in content (Markdown) anymore by default.

Thanks very much for both replies. I'll spend some time going through the blog before I migrate my production site.

Hi All,

I've the same 'issue'; iframe tags aren't rendered as HTML but plain text after upgrading to Grav 2. I've added security configuration overrides to enable iframe tags as suggested by @rhuk,but it doesn't make a diffence, iframes are still rendered as text.

My security.yaml's content is this:

xss_dangerous_tags:
  - applet
  - meta
  - xml
  - blink
  - link
  - style
  - script
  - embed
  - object
  - frame
  - frameset
  - ilayer
  - layer
  - bgsound
  - title
  - base
  - isindex
  - svg
  - math
  - option
  - select

In my case the security risk iframe introduces is fine. Are there any other ways or extra config options to make them work?

I had to make a change to user/config/system.yaml to get iframes to work. I read the blog posts that pamtbaau mentioned in the above reply, and added a gfm: key in system.yaml. The pages section has this:

pages:
  markdown:
    gfm:
      tagfilter: false

I'm not planning to upgrade my production site for now, but this worked on a test site.

@dmeissner thanks a lot, I confirm this is working for me a well, to render iframes.

The above change in security.yaml didnn't influence iframes' rendering, so I've reverted that change.

@davidm, @martonlente, If Andy's solution didn't work for the both of you, then there might be an issue. Would you (@davidm) mind creating an issue at https://github.com/getgrav/grav/issues ? That would be a good way to put it on Andy's todo list.

Thanks

Actually, it's working for me now, maybe I wasn't clear about that. The first thing I tried was to remove iframe from the list of dangerous HTML tags, but that didn't work. After reading Andy's articles, I edited system.yaml directly to add the "tagfilter: false" key, and that worked. That might not be appropriate for some sites, but mine is a simple blog with no comments or other content from outside sources, so I think it should be OK for my site.

But I will create an issue as you suggest, since Andy's original suggestion of using the admin plugin to remove iframe from the Dangerous HTML list didn't work.

@davidm I think @pamtbaau meant that the solution Andy proposed (creating a custom security.yaml to explicitly list xss_dangerous_tags) was supposed to work on its own. 'Enabling' iframe rendering by disabling the GFM tagfilter in system config seems like a workaround to the issue of the above security settings being ignored. Is this correct?

I think maybe that's what was meant. In my case, the first thing I tried was to use the admin plugin to make a change under the Configuration -> Security page. I removed "iframe" from the Dangerous HTML Tags list on that page. Testing it now, I see that what Grav does when I make that change with the admin plugin is to create a file user/config/security.yaml, that contains only the list of dangerous tags, with iframe removed. I guess that overrides the system/config/security.yaml file. When I reverted the change in the admin page, the user/config/security.yaml file disappeared.

Since the first attempt didn't work, I edited user/config/system.yaml directly as described above, and that worked. It does seem like a workaround, since I assume it disables filtering completely, even if I only wanted to remove iframes from the list.

Issue created by @dmeissner on Github: https://github.com/getgrav/grav/issues/4213

Reply from Andy :

The "Dangerous HTML Tags" list you edited only feeds the security scanner (the warning on save). It never escaped your iframe at render, which is why editing it did nothing.

What escapes <iframe> in Grav 2.x is a separate GitHub Flavored Markdown feature, the "tagfilter." It escapes a fixed list of raw tags (script, iframe, style, etc.) in Markdown output. That list is part of the GFM spec and isn't editable, and it's the behavior change you hit on the upgrade.

The key point: markdown.gfm.tagfilter: false is a fine thing to set, and it is NOT "turning off all sanitization." The tagfilter is just a narrow escape pass. Your real XSS protection is the security.xss_* layer, and it stays fully active either way (dangerous protocols, on* handlers, inline styles, svg/math, etc. are all still filtered). On a site where you and trusted authors write the content, disabling it is a perfectly sensible trade.

The one place I'd keep it on is a site rendering untrusted or user-submitted Markdown. There, leave it enabled and add your iframe via shortcode-core or a Twig partial instead.

So your config is fine and your site isn't wide open. I'll also get the admin help text and 2.x upgrade notes clarified, since the overlap is genuinely confusing.