I understand the implications of having a script tag in my redactor field.

But I am importing approx. 5k articles in to a Redactor field, some of which have various tags from embedded Podcasts, Twitter cards etc.. These are obviously getting stripped out.

(It's not possible for me to go through all of the entries and break out those embeds in to a Matrix style set etc..)

So I need to be able to edit the HTML Purifier config to allow these tags.

My /config/htmlpurifier/config.json file looks like below but I am not having any luck.

    "Core.AggressivelyRemoveScript": false,
    "HTML.SafeScripting": ["script"]

And my Redactor config:

  "buttons": ["formatting", "bold", "italic", "unorderedlist", "orderedlist", "link", "image", "video", "html"],
  "plugins": ["fullscreen", "video", "clips", "table"],
  "linkNewTab": true,
  "toolbarFixed": true,
  "allowedTags": ["script"]

Has any ever managed to get Script tags to work and can offer some guidance here? There's a few other Script related configs here http://htmlpurifier.org/live/configdoc/plain.html I've tried all of them.

Example of an embed in one of my imported articles.

<script src="https://www.buzzsprout.com/xxxxxxxxxxx" type="text/javascript" charset="utf-8"></script>

I've seen other questions similar to this but no real solution other than put script tags in plain text etc.. but this is not an option in this case. Thanks!

  • Did you ever find a solution to this? Commented Nov 15, 2019 at 13:47
  • Nope, afraid not. From what I can remember I did a mass search and replace to put the script tags inside a plain text field to use in an matrix block.
    – Mark
    Commented Nov 15, 2019 at 13:49

1 Answer 1


As far as I know right now as I've brawled through the same issue maybe there is a way to achieve it. Unfortunately is not usable for dynamic script URLs like Buzzsprout's.

htmlpurifier config /config/htmlpurifier/config.json

First of all HTML.SafeScripting is meant to be array of allowed script URLs. So static URL like https://platform.twitter.com/widgets.js should pass. Buzzsprout on the other hand has dynamic script links which in theory could be covered by regex (as it works in URI.SafeIframeRegexp) but the validator for HTML.SafeScripting only uses case sensitive string comparison (see vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/SafeScripting.php).

If you also use HTML.AllowedElements or HTML.Allowed you need to add script to them as well. HTML.AllowedElements is array so you have to add next string entry, HTML.Allowed is string with comma separated list of tags (eventually with allowed attributes).

Redactor config /config/redactor/config.json

Next you need to fiddle with Redactor settings to prevent <script> tags to be removed or broken.

    "allowedTags": ["script"],
    "removeScript": false,
    "autoparseLinks": false
  • allowedTags - allow tag itself, so it can be used in the editor
  • removeScript - as a safety measure Redactor will remove scripts by default, this will turn if off
  • autoparseLinks - in my case Redactor has tried to make a clickable link from URL in leftover script tag resulting in broken HTML - this will prevent it, but also pasted links will not be automatically converted to clickable links and therefore user needs to insert links to the document via the editor tool

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.