feature #943 Migrate from HTMLPurifier to html-sanitizer (tgalopin)

This PR was merged into the master branch.

Discussion
----------

Migrate from HTMLPurifier to html-sanitizer

I would like to propose the usage of html-sanitizer in remplacement of HTMLPurifier.

html-sanitizer is well integrated in modern Symfony applications (autowiring / autoconfiguration), it is better suited than HTMLPurifier to sanitize user inputs such as Markdown, it is faster and it creates HTML that's simpler and easier to understand. It is also IMO easier to extends and configure.

Commits
-------

13c5b03 Migrate from HTMLPurifier to html-sanitizer

Author: javiereguiluz

composer.json

@@ -10,7 +10,6 @@
         "doctrine/doctrine-migrations-bundle": "^1.3",
         "doctrine/orm": "^2.5.11",
         "erusev/parsedown": "^1.6",
-        "ezyang/htmlpurifier": "^4.9",
         "sensio/framework-extra-bundle": "^5.1",
         "sensiolabs/security-checker": "^5.0",
         "symfony/asset": "*",
@@ -29,6 +28,7 @@
         "symfony/validator": "*",
         "symfony/webpack-encore-bundle": "^1.1",
         "symfony/yaml": "*",
+        "tgalopin/html-sanitizer-bundle": "^1.1",
         "twig/extensions": "^1.5",
         "twig/twig": "^2.6",
         "white-october/pagerfanta-bundle": "^1.1"

composer.lock

@@ -17,4 +17,5 @@
     Doctrine\Bundle\MigrationsBundle\DoctrineMigrationsBundle::class => ['all' => true],
     Doctrine\Bundle\FixturesBundle\DoctrineFixturesBundle::class => ['dev' => true, 'test' => true],
     Symfony\WebpackEncoreBundle\WebpackEncoreBundle::class => ['all' => true],
+    HtmlSanitizer\Bundle\HtmlSanitizerBundle::class => ['all' => true],
 ];

config/bundles.php

@@ -0,0 +1,15 @@
+html_sanitizer:
+    default_sanitizer: 'default'
+    sanitizers:
+        default:
+            # Read https://github.com/tgalopin/html-sanitizer/blob/master/docs/1-getting-started.md#extensions
+            # to learn more about which extensions you would like to enable.
+            extensions:
+                - 'basic'
+                - 'list'
+                - 'table'
+                - 'image'
+                - 'code'
+
+            # Read https://github.com/tgalopin/html-sanitizer/blob/master/docs/3-configuration-reference.md
+            # to discover all the available options for each extension.