如何使用HTML Purifier允许href ='javascript：myFunc（）'？

Question

I have some HTML that I wrote locally and want to run it through HTML purifier. It is entirely generated by me so I know there are no XSS vulnerabilities. I am trying to run it through the purifier, but href='javascript:myFunc()' is parsed out no matter what I try.

My current setup is:

$string = file_get_contents($myHTMLFile);
$schemes = array (
    'http' => true,
    'https' => true,
    'mailto' => true,
    'ftp' => true,
    'nntp' => true,
    'news' => true,
    'javascript' => true,
);
$config = HTMLPurifier_Config::createDefault();
$config->set('URL.AllowedSchemes', array($schemes));
$purifier = new HTMLPurifier($config);
$string = $purifier->purify($string);

This isn't working at all - all javascript is stripped out.

I have looked through all the various HTML Purifier config settings but can't find what I need. Are there any answers?

Thanks in advance

Answer 1

Simple answer: Don't use HTML Purifier on it. Use something like HTML Tidy instead.

More complex answer: Don't use javascript: URLs; instead, attach class attributes to links you would like to have JavaScript, and then have a JavaScript handler look for links that have this class and attach the JavaScript code as an onClick handler.

Even more complex answer: Create a new javascript URI scheme and program it only to accept the fixed string which is your function.